thanh-kit 2.5.0 → 2.5.2

package/templates/skills/arch-cross-service-integration/SKILL.md

@@ -1,48 +0,0 @@
----
-name: cross-service-integration
-description: Quick decision guide for cross-service communication patterns. For implementation details, use the backend-message-bus skill.
-allowed-tools: Read, Grep, Glob
----
-
-# Cross-Service Integration Decision Guide
-
-> **For implementation details, activate the `backend-message-bus` skill.**
-
-## Quick Decision Matrix
-
-| Scenario | Pattern | Skill to Use |
-|----------|---------|--------------|
-| Sync entity data to other services | Entity Event Bus | `backend-message-bus` |
-| Need real-time data, no local copy | Direct API Call | N/A (simple HttpClient) |
-| Initial data population | Full Sync Job | `backend-background-job` |
-| Cross-service database access | :x: NEVER DO THIS | - |
-
-## When to Use Message Bus
-
-✅ **Use Entity Event Bus when:**
-- Source service owns the data
-- Target services need local copies
-- Eventual consistency is acceptable
-- Decoupling is important
-
-❌ **Don't use when:**
-- You need real-time, up-to-the-second data
-- Data is only needed occasionally (use API call)
-- You're accessing data within the same service
-
-## Key Principles
-
-1. **Data Ownership**: Each entity has ONE owner service
-2. **No Shared DB**: Never access another service's database directly
-3. **Event-Driven**: Use message bus for cross-service sync
-4. **Idempotency**: Consumers must handle duplicate messages
-
-## Implementation Steps
-
-1. Define data ownership
-2. Create message in `YourApp.Shared/CrossServiceMessages/`
-3. Implement producer in source service
-4. Implement consumer in target service
-5. Handle dependencies and race conditions
-
-→ **See `backend-message-bus` skill for detailed patterns and code examples.**

package/templates/skills/arch-performance-optimization/SKILL.md

@@ -1,306 +0,0 @@
----
-name: performance-optimization
-description: Use when analyzing and improving performance for database queries, API endpoints, or frontend rendering.
-allowed-tools: Read, Write, Edit, Grep, Glob, Bash, Task
----
-
-# Performance Optimization Workflow
-
-## When to Use This Skill
-- Slow API response times
-- Database query optimization
-- Frontend rendering issues
-- Memory usage concerns
-- Scalability planning
-
-## Pre-Flight Checklist
-- [ ] Identify performance bottleneck
-- [ ] Gather baseline metrics
-- [ ] Determine acceptable thresholds
-- [ ] Plan measurement approach
-
-## Performance Analysis Framework
-
-### Step 1: Identify Bottleneck Type
-
-```
-Performance Issue
-├── Database (slow queries, N+1)
-├── API (serialization, processing)
-├── Network (payload size, latency)
-└── Frontend (rendering, bundle size)
-```
-
-### Step 2: Measure Baseline
-
-```bash
-# API response time
-curl -w "@curl-format.txt" -o /dev/null -s "http://api/endpoint"
-
-# Database query time (SQL Server)
-SET STATISTICS TIME ON;
-SELECT * FROM Table WHERE ...;
-
-# Frontend bundle analysis
-npm run build -- --stats-json
-npx webpack-bundle-analyzer stats.json
-```
-
-## Database Optimization
-
-### N+1 Query Detection
-```csharp
-// :x: N+1 Problem
-var employees = await repo.GetAllAsync();
-foreach (var emp in employees)
-{
-    // Each iteration queries database!
-    Console.WriteLine(emp.Department.Name);
-}
-
-// :white_check_mark: Eager Loading
-var employees = await repo.GetAllAsync(
-    e => e.CompanyId == companyId,
-    ct,
-    e => e.Department,      // Include Department
-    e => e.Manager          // Include Manager
-);
-```
-
-### Query Optimization
-```csharp
-// :x: Loading all columns
-var employees = await repo.GetAllAsync();
-var names = employees.Select(e => e.Name);
-
-// :white_check_mark: Projection
-var names = await repo.GetAllAsync(
-    q => q.Where(e => e.IsActive)
-          .Select(e => e.Name));
-```
-
-### Index Recommendations
-```sql
--- Frequently filtered columns
-CREATE INDEX IX_Employee_CompanyId ON Employees(CompanyId);
-CREATE INDEX IX_Employee_Status ON Employees(Status);
-
--- Composite index for common queries
-CREATE INDEX IX_Employee_Company_Status
-ON Employees(CompanyId, Status)
-INCLUDE (FullName, Email);
-
--- Full-text search index
-CREATE FULLTEXT INDEX ON Employees(FullName, Email);
-```
-
-### Paging Patterns
-```csharp
-// :x: Loading all then paging in memory
-var all = await repo.GetAllAsync();
-var page = all.Skip(skip).Take(take);
-
-// :white_check_mark: Database-level paging
-var page = await repo.GetAllAsync(
-    (uow, q) => q
-        .Where(e => e.IsActive)
-        .OrderBy(e => e.Id)
-        .Skip(skip)
-        .Take(take));
-```
-
-## API Optimization
-
-### Parallel Operations
-```csharp
-// :x: Sequential
-var users = await userRepo.GetAllAsync();
-var companies = await companyRepo.GetAllAsync();
-var settings = await settingsRepo.GetAllAsync();
-
-// :white_check_mark: Parallel (Tuple Await)
-var (users, companies, settings) = await (
-    userRepo.GetAllAsync(),
-    companyRepo.GetAllAsync(),
-    settingsRepo.GetAllAsync()
-);
-```
-
-### Response Size
-```csharp
-// :x: Returning entire entity
-return new Result { Employee = employee };
-
-// :white_check_mark: Return only needed fields
-return new Result
-{
-    Id = employee.Id,
-    Name = employee.FullName,
-    Status = employee.Status
-};
-```
-
-### Caching
-```csharp
-// Static data caching
-private static readonly ConcurrentDictionary<string, LookupData> _cache = new();
-
-public async Task<LookupData> GetLookupAsync(string key)
-{
-    if (_cache.TryGetValue(key, out var cached))
-        return cached;
-
-    var data = await LoadFromDbAsync(key);
-    _cache.TryAdd(key, data);
-    return data;
-}
-```
-
-## Frontend Optimization
-
-### Bundle Size
-```typescript
-// :x: Import entire library
-import _ from 'lodash';
-
-// :white_check_mark: Import specific functions
-import { debounce } from 'lodash-es/debounce';
-```
-
-### Lazy Loading
-```typescript
-// :white_check_mark: Lazy load routes
-const routes: Routes = [
-  {
-    path: 'feature',
-    loadChildren: () => import('./feature/feature.module')
-      .then(m => m.FeatureModule)
-  }
-];
-```
-
-### Change Detection
-```typescript
-// :white_check_mark: OnPush for performance
-@Component({
-  changeDetection: ChangeDetectionStrategy.OnPush
-})
-
-// :white_check_mark: Track-by for lists
-trackByItem = this.ngForTrackByItemProp<Item>('id');
-
-// Template
-@for (item of items; track trackByItem)
-```
-
-### Virtual Scrolling
-```typescript
-// For large lists
-import { CdkVirtualScrollViewport } from '@angular/cdk/scrolling';
-
-<cdk-virtual-scroll-viewport itemSize="50">
-  @for (item of items; track item.id) {
-    <div class="item">{{ item.name }}</div>
-  }
-</cdk-virtual-scroll-viewport>
-```
-
-## Background Job Optimization
-
-### Bounded Parallelism
-```csharp
-// :x: Unbounded
-await items.ParallelAsync(ProcessAsync);
-
-// :white_check_mark: Bounded
-await items.ParallelAsync(ProcessAsync, maxConcurrent: 5);
-```
-
-### Batch Processing
-```csharp
-// :x: One at a time
-foreach (var item in items)
-    await repo.UpdateAsync(item);
-
-// :white_check_mark: Batch update
-await repo.UpdateManyAsync(items, dismissSendEvent: true);
-```
-
-## Performance Monitoring
-
-### Logging Slow Operations
-```csharp
-var sw = Stopwatch.StartNew();
-var result = await ExecuteOperation();
-sw.Stop();
-
-if (sw.ElapsedMilliseconds > 1000)
-    Logger.LogWarning("Slow operation: {Ms}ms", sw.ElapsedMilliseconds);
-```
-
-### Database Query Logging
-```csharp
-// In DbContext configuration
-optionsBuilder.LogTo(
-    Console.WriteLine,
-    new[] { DbLoggerCategory.Database.Command.Name },
-    LogLevel.Information);
-```
-
-## Performance Checklist
-
-### Database
-- [ ] Indexes on filtered columns
-- [ ] Eager loading for relations
-- [ ] Projection for partial data
-- [ ] Paging at database level
-- [ ] No N+1 queries
-
-### API
-- [ ] Parallel operations where possible
-- [ ] Response DTOs (not entities)
-- [ ] Caching for static data
-- [ ] Pagination for lists
-
-### Frontend
-- [ ] Lazy loading for routes
-- [ ] OnPush change detection
-- [ ] Track-by for lists
-- [ ] Virtual scrolling for large lists
-- [ ] Tree-shaking imports
-
-### Background Jobs
-- [ ] Bounded parallelism
-- [ ] Batch operations
-- [ ] Paged processing
-- [ ] Appropriate scheduling
-
-## Anti-Patterns to AVOID
-
-:x: **SELECT * in production**
-```csharp
-var all = await context.Table.ToListAsync();
-```
-
-:x: **Synchronous I/O**
-```csharp
-var result = asyncOperation.Result;  // Blocks thread
-```
-
-:x: **Unbounded result sets**
-```csharp
-await repo.GetAllAsync();  // Could be millions
-```
-
-:x: **Repeated database calls in loops**
-```csharp
-foreach (var id in ids)
-    await repo.GetByIdAsync(id);  // N queries
-```
-
-## Verification Checklist
-- [ ] Baseline metrics recorded
-- [ ] Bottleneck identified and addressed
-- [ ] Changes measured against baseline
-- [ ] No new performance issues introduced
-- [ ] Monitoring in place

package/templates/skills/arch-security-review/SKILL.md

@@ -1,344 +0,0 @@
----
-name: security-review
-description: Use when reviewing code for security vulnerabilities, implementing authorization, or ensuring data protection.
-allowed-tools: Read, Write, Edit, Grep, Glob, Bash, Task
----
-
-# Security Review Workflow
-
-## When to Use This Skill
-- Security audit of code changes
-- Implementing authentication/authorization
-- Data protection review
-- Vulnerability assessment
-
-## Pre-Flight Checklist
-- [ ] Identify security-sensitive areas
-- [ ] Review OWASP Top 10 relevance
-- [ ] Check for existing security patterns
-- [ ] Plan remediation approach
-
-## OWASP Top 10 Checklist
-
-### 1. Broken Access Control
-```csharp
-// :x: VULNERABLE - No authorization check
-[HttpGet("{id}")]
-public async Task<Employee> Get(string id)
-    => await repo.GetByIdAsync(id);
-
-// :white_check_mark: SECURE - Authorization enforced
-[HttpGet("{id}")]
-[PlatformAuthorize(Roles.Manager, Roles.Admin)]
-public async Task<Employee> Get(string id)
-{
-    var employee = await repo.GetByIdAsync(id);
-
-    // Verify access to this specific resource
-    if (employee.CompanyId != RequestContext.CurrentCompanyId())
-        throw new UnauthorizedAccessException();
-
-    return employee;
-}
-```
-
-### 2. Cryptographic Failures
-```csharp
-// :x: VULNERABLE - Storing plain text secrets
-var apiKey = config["ApiKey"];
-await SaveToDatabase(apiKey);
-
-// :white_check_mark: SECURE - Encrypt sensitive data
-var encryptedKey = encryptionService.Encrypt(apiKey);
-await SaveToDatabase(encryptedKey);
-
-// Use secure configuration
-var apiKey = config.GetValue<string>("ApiKey");  // From Azure Key Vault
-```
-
-### 3. Injection
-```csharp
-// :x: VULNERABLE - SQL Injection
-var sql = $"SELECT * FROM Users WHERE Name = '{name}'";
-await context.Database.ExecuteSqlRawAsync(sql);
-
-// :white_check_mark: SECURE - Parameterized query
-await context.Users.Where(u => u.Name == name).ToListAsync();
-
-// Or if raw SQL needed:
-await context.Database.ExecuteSqlRawAsync(
-    "SELECT * FROM Users WHERE Name = @p0", name);
-```
-
-### 4. Insecure Design
-```csharp
-// :x: VULNERABLE - No rate limiting
-[HttpPost("login")]
-public async Task<IActionResult> Login(LoginRequest request)
-    => await authService.Login(request);
-
-// :white_check_mark: SECURE - Rate limiting applied
-[HttpPost("login")]
-[RateLimit(MaxRequests = 5, WindowSeconds = 60)]
-public async Task<IActionResult> Login(LoginRequest request)
-    => await authService.Login(request);
-```
-
-### 5. Security Misconfiguration
-```csharp
-// :x: VULNERABLE - Detailed errors in production
-app.UseDeveloperExceptionPage();  // Exposes stack traces
-
-// :white_check_mark: SECURE - Generic errors in production
-if (env.IsDevelopment())
-    app.UseDeveloperExceptionPage();
-else
-    app.UseExceptionHandler("/Error");
-```
-
-### 6. Vulnerable Components
-```bash
-# Check for vulnerable packages
-dotnet list package --vulnerable
-
-# Update vulnerable packages
-dotnet outdated
-```
-
-### 7. Authentication Failures
-```csharp
-// :x: VULNERABLE - Weak password policy
-if (password.Length >= 4) { }
-
-// :white_check_mark: SECURE - Strong password policy
-public class PasswordPolicy
-{
-    public bool Validate(string password)
-    {
-        return password.Length >= 12
-            && password.Any(char.IsUpper)
-            && password.Any(char.IsLower)
-            && password.Any(char.IsDigit)
-            && password.Any(c => !char.IsLetterOrDigit(c));
-    }
-}
-```
-
-### 8. Data Integrity Failures
-```csharp
-// :x: VULNERABLE - No validation of external data
-var userData = await externalApi.GetUserAsync(id);
-await SaveToDatabase(userData);
-
-// :white_check_mark: SECURE - Validate external data
-var userData = await externalApi.GetUserAsync(id);
-var validation = userData.Validate();
-if (!validation.IsValid)
-    throw new ValidationException(validation.Errors);
-await SaveToDatabase(userData);
-```
-
-### 9. Logging Failures
-```csharp
-// :x: VULNERABLE - Logging sensitive data
-Logger.LogInformation("User login: {Email} {Password}", email, password);
-
-// :white_check_mark: SECURE - Redact sensitive data
-Logger.LogInformation("User login: {Email}", email);
-// Never log passwords, tokens, or PII
-```
-
-### 10. SSRF (Server-Side Request Forgery)
-```csharp
-// :x: VULNERABLE - User-controlled URL
-var url = request.WebhookUrl;
-await httpClient.GetAsync(url);  // Could access internal services
-
-// :white_check_mark: SECURE - Validate and restrict URLs
-if (!IsAllowedUrl(request.WebhookUrl))
-    throw new SecurityException("Invalid webhook URL");
-
-private bool IsAllowedUrl(string url)
-{
-    var uri = new Uri(url);
-    return AllowedDomains.Contains(uri.Host)
-        && uri.Scheme == "https";
-}
-```
-
-## Authorization Patterns
-
-### Controller Level
-```csharp
-[ApiController]
-[Route("api/[controller]")]
-[PlatformAuthorize]  // Require authentication
-public class EmployeeController : PlatformBaseController
-{
-    [HttpPost]
-    [PlatformAuthorize(Roles.Admin, Roles.Manager)]  // Role-based
-    public async Task<IActionResult> Create(...)
-}
-```
-
-### Handler Level
-```csharp
-protected override async Task<PlatformValidationResult<T>> ValidateRequestAsync(
-    PlatformValidationResult<T> validation, CancellationToken ct)
-{
-    return await validation
-        // Check role
-        .And(_ => RequestContext.HasRole(Roles.Admin), "Admin role required")
-        // Check company access
-        .And(_ => entity.CompanyId == RequestContext.CurrentCompanyId(),
-            "Access denied: different company")
-        // Check ownership
-        .And(_ => entity.OwnerId == RequestContext.UserId() ||
-            RequestContext.HasRole(Roles.Admin),
-            "Access denied: not owner");
-}
-```
-
-### Query Level
-```csharp
-// Always filter by company/user context
-var employees = await repo.GetAllAsync(
-    e => e.CompanyId == RequestContext.CurrentCompanyId()
-        && (e.IsPublic || e.OwnerId == RequestContext.UserId()));
-```
-
-## Data Protection
-
-### Sensitive Data Handling
-```csharp
-public class SensitiveDataHandler
-{
-    // Encrypt at rest
-    public string EncryptForStorage(string plainText)
-        => encryptionService.Encrypt(plainText);
-
-    // Mask for display
-    public string MaskEmail(string email)
-    {
-        var parts = email.Split('@');
-        return $"{parts[0][0]}***@{parts[1]}";
-    }
-
-    // Never log sensitive data
-    public void LogUserAction(User user)
-    {
-        Logger.LogInformation("User action: {UserId}", user.Id);
-        // NOT: Logger.Log("User: {Email} {Phone}", user.Email, user.Phone);
-    }
-}
-```
-
-### File Upload Security
-```csharp
-public async Task<IActionResult> Upload(IFormFile file)
-{
-    // Validate file type
-    var allowedTypes = new[] { ".pdf", ".docx", ".xlsx" };
-    var extension = Path.GetExtension(file.FileName).ToLowerInvariant();
-    if (!allowedTypes.Contains(extension))
-        return BadRequest("Invalid file type");
-
-    // Validate file size
-    if (file.Length > 10 * 1024 * 1024)  // 10MB
-        return BadRequest("File too large");
-
-    // Scan for malware (if available)
-    if (!await antivirusService.ScanAsync(file))
-        return BadRequest("File rejected by security scan");
-
-    // Generate safe filename
-    var safeFileName = $"{Guid.NewGuid()}{extension}";
-
-    // Save to isolated storage
-    await fileService.SaveAsync(file, safeFileName);
-
-    return Ok();
-}
-```
-
-## Security Scanning Commands
-
-```bash
-# .NET vulnerability scan
-dotnet list package --vulnerable
-
-# Outdated packages
-dotnet outdated
-
-# Secret scanning
-grep -r "password\|secret\|apikey" --include="*.cs" --include="*.json"
-
-# Hardcoded credentials
-grep -r "Password=\"" --include="*.cs"
-grep -r "connectionString.*password" --include="*.json"
-```
-
-## Security Review Checklist
-
-### Authentication
-- [ ] Strong password policy enforced
-- [ ] Account lockout after failed attempts
-- [ ] Secure session management
-- [ ] JWT tokens properly validated
-- [ ] Refresh token rotation
-
-### Authorization
-- [ ] All endpoints require authentication
-- [ ] Role-based access control implemented
-- [ ] Resource-level permissions checked
-- [ ] No privilege escalation possible
-
-### Input Validation
-- [ ] All inputs validated
-- [ ] SQL injection prevented (parameterized queries)
-- [ ] XSS prevented (output encoding)
-- [ ] File uploads validated
-- [ ] URL validation for redirects
-
-### Data Protection
-- [ ] Sensitive data encrypted at rest
-- [ ] HTTPS enforced
-- [ ] No sensitive data in logs
-- [ ] Proper error handling (no stack traces)
-
-### Dependencies
-- [ ] No known vulnerable packages
-- [ ] Dependencies regularly updated
-- [ ] Third-party code reviewed
-
-## Anti-Patterns to AVOID
-
-:x: **Trusting client input**
-```csharp
-var isAdmin = request.IsAdmin;  // User-supplied!
-```
-
-:x: **Exposing internal errors**
-```csharp
-catch (Exception ex) { return BadRequest(ex.ToString()); }
-```
-
-:x: **Hardcoded secrets**
-```csharp
-var apiKey = "sk_live_xxxxx";
-```
-
-:x: **Insufficient logging**
-```csharp
-// No audit trail for sensitive operations
-await DeleteAllUsers();
-```
-
-## Verification Checklist
-- [ ] OWASP Top 10 reviewed
-- [ ] Authentication/authorization verified
-- [ ] Input validation complete
-- [ ] Sensitive data protected
-- [ ] No hardcoded secrets
-- [ ] Logging appropriate (no PII)
-- [ ] Dependencies scanned