thanh-kit 2.5.0

package/templates/skills/arch-performance-optimization/SKILL.md

@@ -0,0 +1,306 @@
+---
+name: performance-optimization
+description: Use when analyzing and improving performance for database queries, API endpoints, or frontend rendering.
+allowed-tools: Read, Write, Edit, Grep, Glob, Bash, Task
+---
+
+# Performance Optimization Workflow
+
+## When to Use This Skill
+- Slow API response times
+- Database query optimization
+- Frontend rendering issues
+- Memory usage concerns
+- Scalability planning
+
+## Pre-Flight Checklist
+- [ ] Identify performance bottleneck
+- [ ] Gather baseline metrics
+- [ ] Determine acceptable thresholds
+- [ ] Plan measurement approach
+
+## Performance Analysis Framework
+
+### Step 1: Identify Bottleneck Type
+
+```
+Performance Issue
+├── Database (slow queries, N+1)
+├── API (serialization, processing)
+├── Network (payload size, latency)
+└── Frontend (rendering, bundle size)
+```
+
+### Step 2: Measure Baseline
+
+```bash
+# API response time
+curl -w "@curl-format.txt" -o /dev/null -s "http://api/endpoint"
+
+# Database query time (SQL Server)
+SET STATISTICS TIME ON;
+SELECT * FROM Table WHERE ...;
+
+# Frontend bundle analysis
+npm run build -- --stats-json
+npx webpack-bundle-analyzer stats.json
+```
+
+## Database Optimization
+
+### N+1 Query Detection
+```csharp
+// :x: N+1 Problem
+var employees = await repo.GetAllAsync();
+foreach (var emp in employees)
+{
+    // Each iteration queries database!
+    Console.WriteLine(emp.Department.Name);
+}
+
+// :white_check_mark: Eager Loading
+var employees = await repo.GetAllAsync(
+    e => e.CompanyId == companyId,
+    ct,
+    e => e.Department,      // Include Department
+    e => e.Manager          // Include Manager
+);
+```
+
+### Query Optimization
+```csharp
+// :x: Loading all columns
+var employees = await repo.GetAllAsync();
+var names = employees.Select(e => e.Name);
+
+// :white_check_mark: Projection
+var names = await repo.GetAllAsync(
+    q => q.Where(e => e.IsActive)
+          .Select(e => e.Name));
+```
+
+### Index Recommendations
+```sql
+-- Frequently filtered columns
+CREATE INDEX IX_Employee_CompanyId ON Employees(CompanyId);
+CREATE INDEX IX_Employee_Status ON Employees(Status);
+
+-- Composite index for common queries
+CREATE INDEX IX_Employee_Company_Status
+ON Employees(CompanyId, Status)
+INCLUDE (FullName, Email);
+
+-- Full-text search index
+CREATE FULLTEXT INDEX ON Employees(FullName, Email);
+```
+
+### Paging Patterns
+```csharp
+// :x: Loading all then paging in memory
+var all = await repo.GetAllAsync();
+var page = all.Skip(skip).Take(take);
+
+// :white_check_mark: Database-level paging
+var page = await repo.GetAllAsync(
+    (uow, q) => q
+        .Where(e => e.IsActive)
+        .OrderBy(e => e.Id)
+        .Skip(skip)
+        .Take(take));
+```
+
+## API Optimization
+
+### Parallel Operations
+```csharp
+// :x: Sequential
+var users = await userRepo.GetAllAsync();
+var companies = await companyRepo.GetAllAsync();
+var settings = await settingsRepo.GetAllAsync();
+
+// :white_check_mark: Parallel (Tuple Await)
+var (users, companies, settings) = await (
+    userRepo.GetAllAsync(),
+    companyRepo.GetAllAsync(),
+    settingsRepo.GetAllAsync()
+);
+```
+
+### Response Size
+```csharp
+// :x: Returning entire entity
+return new Result { Employee = employee };
+
+// :white_check_mark: Return only needed fields
+return new Result
+{
+    Id = employee.Id,
+    Name = employee.FullName,
+    Status = employee.Status
+};
+```
+
+### Caching
+```csharp
+// Static data caching
+private static readonly ConcurrentDictionary<string, LookupData> _cache = new();
+
+public async Task<LookupData> GetLookupAsync(string key)
+{
+    if (_cache.TryGetValue(key, out var cached))
+        return cached;
+
+    var data = await LoadFromDbAsync(key);
+    _cache.TryAdd(key, data);
+    return data;
+}
+```
+
+## Frontend Optimization
+
+### Bundle Size
+```typescript
+// :x: Import entire library
+import _ from 'lodash';
+
+// :white_check_mark: Import specific functions
+import { debounce } from 'lodash-es/debounce';
+```
+
+### Lazy Loading
+```typescript
+// :white_check_mark: Lazy load routes
+const routes: Routes = [
+  {
+    path: 'feature',
+    loadChildren: () => import('./feature/feature.module')
+      .then(m => m.FeatureModule)
+  }
+];
+```
+
+### Change Detection
+```typescript
+// :white_check_mark: OnPush for performance
+@Component({
+  changeDetection: ChangeDetectionStrategy.OnPush
+})
+
+// :white_check_mark: Track-by for lists
+trackByItem = this.ngForTrackByItemProp<Item>('id');
+
+// Template
+@for (item of items; track trackByItem)
+```
+
+### Virtual Scrolling
+```typescript
+// For large lists
+import { CdkVirtualScrollViewport } from '@angular/cdk/scrolling';
+
+<cdk-virtual-scroll-viewport itemSize="50">
+  @for (item of items; track item.id) {
+    <div class="item">{{ item.name }}</div>
+  }
+</cdk-virtual-scroll-viewport>
+```
+
+## Background Job Optimization
+
+### Bounded Parallelism
+```csharp
+// :x: Unbounded
+await items.ParallelAsync(ProcessAsync);
+
+// :white_check_mark: Bounded
+await items.ParallelAsync(ProcessAsync, maxConcurrent: 5);
+```
+
+### Batch Processing
+```csharp
+// :x: One at a time
+foreach (var item in items)
+    await repo.UpdateAsync(item);
+
+// :white_check_mark: Batch update
+await repo.UpdateManyAsync(items, dismissSendEvent: true);
+```
+
+## Performance Monitoring
+
+### Logging Slow Operations
+```csharp
+var sw = Stopwatch.StartNew();
+var result = await ExecuteOperation();
+sw.Stop();
+
+if (sw.ElapsedMilliseconds > 1000)
+    Logger.LogWarning("Slow operation: {Ms}ms", sw.ElapsedMilliseconds);
+```
+
+### Database Query Logging
+```csharp
+// In DbContext configuration
+optionsBuilder.LogTo(
+    Console.WriteLine,
+    new[] { DbLoggerCategory.Database.Command.Name },
+    LogLevel.Information);
+```
+
+## Performance Checklist
+
+### Database
+- [ ] Indexes on filtered columns
+- [ ] Eager loading for relations
+- [ ] Projection for partial data
+- [ ] Paging at database level
+- [ ] No N+1 queries
+
+### API
+- [ ] Parallel operations where possible
+- [ ] Response DTOs (not entities)
+- [ ] Caching for static data
+- [ ] Pagination for lists
+
+### Frontend
+- [ ] Lazy loading for routes
+- [ ] OnPush change detection
+- [ ] Track-by for lists
+- [ ] Virtual scrolling for large lists
+- [ ] Tree-shaking imports
+
+### Background Jobs
+- [ ] Bounded parallelism
+- [ ] Batch operations
+- [ ] Paged processing
+- [ ] Appropriate scheduling
+
+## Anti-Patterns to AVOID
+
+:x: **SELECT * in production**
+```csharp
+var all = await context.Table.ToListAsync();
+```
+
+:x: **Synchronous I/O**
+```csharp
+var result = asyncOperation.Result;  // Blocks thread
+```
+
+:x: **Unbounded result sets**
+```csharp
+await repo.GetAllAsync();  // Could be millions
+```
+
+:x: **Repeated database calls in loops**
+```csharp
+foreach (var id in ids)
+    await repo.GetByIdAsync(id);  // N queries
+```
+
+## Verification Checklist
+- [ ] Baseline metrics recorded
+- [ ] Bottleneck identified and addressed
+- [ ] Changes measured against baseline
+- [ ] No new performance issues introduced
+- [ ] Monitoring in place

package/templates/skills/arch-security-review/SKILL.md

@@ -0,0 +1,344 @@
+---
+name: security-review
+description: Use when reviewing code for security vulnerabilities, implementing authorization, or ensuring data protection.
+allowed-tools: Read, Write, Edit, Grep, Glob, Bash, Task
+---
+
+# Security Review Workflow
+
+## When to Use This Skill
+- Security audit of code changes
+- Implementing authentication/authorization
+- Data protection review
+- Vulnerability assessment
+
+## Pre-Flight Checklist
+- [ ] Identify security-sensitive areas
+- [ ] Review OWASP Top 10 relevance
+- [ ] Check for existing security patterns
+- [ ] Plan remediation approach
+
+## OWASP Top 10 Checklist
+
+### 1. Broken Access Control
+```csharp
+// :x: VULNERABLE - No authorization check
+[HttpGet("{id}")]
+public async Task<Employee> Get(string id)
+    => await repo.GetByIdAsync(id);
+
+// :white_check_mark: SECURE - Authorization enforced
+[HttpGet("{id}")]
+[PlatformAuthorize(Roles.Manager, Roles.Admin)]
+public async Task<Employee> Get(string id)
+{
+    var employee = await repo.GetByIdAsync(id);
+
+    // Verify access to this specific resource
+    if (employee.CompanyId != RequestContext.CurrentCompanyId())
+        throw new UnauthorizedAccessException();
+
+    return employee;
+}
+```
+
+### 2. Cryptographic Failures
+```csharp
+// :x: VULNERABLE - Storing plain text secrets
+var apiKey = config["ApiKey"];
+await SaveToDatabase(apiKey);
+
+// :white_check_mark: SECURE - Encrypt sensitive data
+var encryptedKey = encryptionService.Encrypt(apiKey);
+await SaveToDatabase(encryptedKey);
+
+// Use secure configuration
+var apiKey = config.GetValue<string>("ApiKey");  // From Azure Key Vault
+```
+
+### 3. Injection
+```csharp
+// :x: VULNERABLE - SQL Injection
+var sql = $"SELECT * FROM Users WHERE Name = '{name}'";
+await context.Database.ExecuteSqlRawAsync(sql);
+
+// :white_check_mark: SECURE - Parameterized query
+await context.Users.Where(u => u.Name == name).ToListAsync();
+
+// Or if raw SQL needed:
+await context.Database.ExecuteSqlRawAsync(
+    "SELECT * FROM Users WHERE Name = @p0", name);
+```
+
+### 4. Insecure Design
+```csharp
+// :x: VULNERABLE - No rate limiting
+[HttpPost("login")]
+public async Task<IActionResult> Login(LoginRequest request)
+    => await authService.Login(request);
+
+// :white_check_mark: SECURE - Rate limiting applied
+[HttpPost("login")]
+[RateLimit(MaxRequests = 5, WindowSeconds = 60)]
+public async Task<IActionResult> Login(LoginRequest request)
+    => await authService.Login(request);
+```
+
+### 5. Security Misconfiguration
+```csharp
+// :x: VULNERABLE - Detailed errors in production
+app.UseDeveloperExceptionPage();  // Exposes stack traces
+
+// :white_check_mark: SECURE - Generic errors in production
+if (env.IsDevelopment())
+    app.UseDeveloperExceptionPage();
+else
+    app.UseExceptionHandler("/Error");
+```
+
+### 6. Vulnerable Components
+```bash
+# Check for vulnerable packages
+dotnet list package --vulnerable
+
+# Update vulnerable packages
+dotnet outdated
+```
+
+### 7. Authentication Failures
+```csharp
+// :x: VULNERABLE - Weak password policy
+if (password.Length >= 4) { }
+
+// :white_check_mark: SECURE - Strong password policy
+public class PasswordPolicy
+{
+    public bool Validate(string password)
+    {
+        return password.Length >= 12
+            && password.Any(char.IsUpper)
+            && password.Any(char.IsLower)
+            && password.Any(char.IsDigit)
+            && password.Any(c => !char.IsLetterOrDigit(c));
+    }
+}
+```
+
+### 8. Data Integrity Failures
+```csharp
+// :x: VULNERABLE - No validation of external data
+var userData = await externalApi.GetUserAsync(id);
+await SaveToDatabase(userData);
+
+// :white_check_mark: SECURE - Validate external data
+var userData = await externalApi.GetUserAsync(id);
+var validation = userData.Validate();
+if (!validation.IsValid)
+    throw new ValidationException(validation.Errors);
+await SaveToDatabase(userData);
+```
+
+### 9. Logging Failures
+```csharp
+// :x: VULNERABLE - Logging sensitive data
+Logger.LogInformation("User login: {Email} {Password}", email, password);
+
+// :white_check_mark: SECURE - Redact sensitive data
+Logger.LogInformation("User login: {Email}", email);
+// Never log passwords, tokens, or PII
+```
+
+### 10. SSRF (Server-Side Request Forgery)
+```csharp
+// :x: VULNERABLE - User-controlled URL
+var url = request.WebhookUrl;
+await httpClient.GetAsync(url);  // Could access internal services
+
+// :white_check_mark: SECURE - Validate and restrict URLs
+if (!IsAllowedUrl(request.WebhookUrl))
+    throw new SecurityException("Invalid webhook URL");
+
+private bool IsAllowedUrl(string url)
+{
+    var uri = new Uri(url);
+    return AllowedDomains.Contains(uri.Host)
+        && uri.Scheme == "https";
+}
+```
+
+## Authorization Patterns
+
+### Controller Level
+```csharp
+[ApiController]
+[Route("api/[controller]")]
+[PlatformAuthorize]  // Require authentication
+public class EmployeeController : PlatformBaseController
+{
+    [HttpPost]
+    [PlatformAuthorize(Roles.Admin, Roles.Manager)]  // Role-based
+    public async Task<IActionResult> Create(...)
+}
+```
+
+### Handler Level
+```csharp
+protected override async Task<PlatformValidationResult<T>> ValidateRequestAsync(
+    PlatformValidationResult<T> validation, CancellationToken ct)
+{
+    return await validation
+        // Check role
+        .And(_ => RequestContext.HasRole(Roles.Admin), "Admin role required")
+        // Check company access
+        .And(_ => entity.CompanyId == RequestContext.CurrentCompanyId(),
+            "Access denied: different company")
+        // Check ownership
+        .And(_ => entity.OwnerId == RequestContext.UserId() ||
+            RequestContext.HasRole(Roles.Admin),
+            "Access denied: not owner");
+}
+```
+
+### Query Level
+```csharp
+// Always filter by company/user context
+var employees = await repo.GetAllAsync(
+    e => e.CompanyId == RequestContext.CurrentCompanyId()
+        && (e.IsPublic || e.OwnerId == RequestContext.UserId()));
+```
+
+## Data Protection
+
+### Sensitive Data Handling
+```csharp
+public class SensitiveDataHandler
+{
+    // Encrypt at rest
+    public string EncryptForStorage(string plainText)
+        => encryptionService.Encrypt(plainText);
+
+    // Mask for display
+    public string MaskEmail(string email)
+    {
+        var parts = email.Split('@');
+        return $"{parts[0][0]}***@{parts[1]}";
+    }
+
+    // Never log sensitive data
+    public void LogUserAction(User user)
+    {
+        Logger.LogInformation("User action: {UserId}", user.Id);
+        // NOT: Logger.Log("User: {Email} {Phone}", user.Email, user.Phone);
+    }
+}
+```
+
+### File Upload Security
+```csharp
+public async Task<IActionResult> Upload(IFormFile file)
+{
+    // Validate file type
+    var allowedTypes = new[] { ".pdf", ".docx", ".xlsx" };
+    var extension = Path.GetExtension(file.FileName).ToLowerInvariant();
+    if (!allowedTypes.Contains(extension))
+        return BadRequest("Invalid file type");
+
+    // Validate file size
+    if (file.Length > 10 * 1024 * 1024)  // 10MB
+        return BadRequest("File too large");
+
+    // Scan for malware (if available)
+    if (!await antivirusService.ScanAsync(file))
+        return BadRequest("File rejected by security scan");
+
+    // Generate safe filename
+    var safeFileName = $"{Guid.NewGuid()}{extension}";
+
+    // Save to isolated storage
+    await fileService.SaveAsync(file, safeFileName);
+
+    return Ok();
+}
+```
+
+## Security Scanning Commands
+
+```bash
+# .NET vulnerability scan
+dotnet list package --vulnerable
+
+# Outdated packages
+dotnet outdated
+
+# Secret scanning
+grep -r "password\|secret\|apikey" --include="*.cs" --include="*.json"
+
+# Hardcoded credentials
+grep -r "Password=\"" --include="*.cs"
+grep -r "connectionString.*password" --include="*.json"
+```
+
+## Security Review Checklist
+
+### Authentication
+- [ ] Strong password policy enforced
+- [ ] Account lockout after failed attempts
+- [ ] Secure session management
+- [ ] JWT tokens properly validated
+- [ ] Refresh token rotation
+
+### Authorization
+- [ ] All endpoints require authentication
+- [ ] Role-based access control implemented
+- [ ] Resource-level permissions checked
+- [ ] No privilege escalation possible
+
+### Input Validation
+- [ ] All inputs validated
+- [ ] SQL injection prevented (parameterized queries)
+- [ ] XSS prevented (output encoding)
+- [ ] File uploads validated
+- [ ] URL validation for redirects
+
+### Data Protection
+- [ ] Sensitive data encrypted at rest
+- [ ] HTTPS enforced
+- [ ] No sensitive data in logs
+- [ ] Proper error handling (no stack traces)
+
+### Dependencies
+- [ ] No known vulnerable packages
+- [ ] Dependencies regularly updated
+- [ ] Third-party code reviewed
+
+## Anti-Patterns to AVOID
+
+:x: **Trusting client input**
+```csharp
+var isAdmin = request.IsAdmin;  // User-supplied!
+```
+
+:x: **Exposing internal errors**
+```csharp
+catch (Exception ex) { return BadRequest(ex.ToString()); }
+```
+
+:x: **Hardcoded secrets**
+```csharp
+var apiKey = "sk_live_xxxxx";
+```
+
+:x: **Insufficient logging**
+```csharp
+// No audit trail for sensitive operations
+await DeleteAllUsers();
+```
+
+## Verification Checklist
+- [ ] OWASP Top 10 reviewed
+- [ ] Authentication/authorization verified
+- [ ] Input validation complete
+- [ ] Sensitive data protected
+- [ ] No hardcoded secrets
+- [ ] Logging appropriate (no PII)
+- [ ] Dependencies scanned