rask-review

name	rask-review
description	Review a Rask diff or PR for security, performance, memory usage, and .NET/C# best practices before merge. Use whenever reviewing changes in the Rask repo, or as the review step of rask-ship. Runs the built-in /code-review and /security-review, then adds Rask framework-aware checks.

rask-review

First run the generic passes, then apply the Rask-specific lens below. Address findings before opening/merging the PR.

/code-review          # correctness + reuse/simplification/efficiency on the diff
/security-review      # security scan of pending changes

Security

• XSS: only Text HTML-encodes; Raw emits verbatim. Any new Raw/HtmlSerializer path with user-influenced content is a finding.
• Auth handshake: redeem rejects cross-origin (IsSameOrigin); redeem-ticket TTL respected; SessionUserProvider.Clear() invalidates; JWT only rides the WS as ?access_token=.
• Scoped assets stay .AllowAnonymous() + nosniff + immutable cache; no secrets in payloads.
• Route guards: [Authorize]/[AllowAnonymous] and client redirects (/login, /forbidden) intact.

Performance / memory

• Render hot path stays allocation-lean: no LINQ, no per-render closures, pooled StringBuilder/writers; prefer spans/UTF-8 literals.
• Diff codec must still win on bytes; SessionRenderCache.TryComputeDiff rotates on every call — never Snapshot() after it on the same render.
• Any hot-path change requires run-benchmarks evidence (Allocated delta) in the PR.

.NET / C# best practices

• Prefer standard .NET / BCL APIs over hand-rolled code — don't reinvent the wheel. Flag any custom implementation of something the framework/BCL already provides.
• Refactor opportunistically: if the diff touches duplicated or unclear code, extract/clean it (within reason, with tests) rather than copy-pasting more.
• Nullable correctness; sealed types; file-scoped namespaces; modern pattern matching.
• No sync-over-async; propagate CancellationToken (esp. Virtualize ItemsProvider).
• Dispose/unsubscribe symmetry: RouteState.Changed / IUserProvider.Changed subscribed in OnMount, unsubscribed in OnUnmount; no StateHasChanged() in OnUnmount.

Hold UX, security, and performance together

Judge every change on all three at once — a win on one must not silently regress another. Good developer/user experience (clear APIs, helpful errors, no flicker), safe defaults, and a lean hot path are co-equal acceptance criteria, not trade-offs to make quietly.

Rask invariants

• Attribute render order (id, class, style, data-*, then tag-specific).
• Root renders a full shell — RASK021. Keyed lists in projections — RASK022.
• Components constructed via the generated factory, not new — RASK014.
• Inject framework services through the ctor, not as non-nullable settable props (RASK002).