backend git:20261007.04729edA

Immutable. This exact content never changes and is served at /api/v1/blob/2b85113269b3c4e1.

---
name: backend
description: "Use when building or reviewing backend systems: APIs, database schemas, auth, file uploads, webhooks, microservices, query optimization (Node, Python, Go, Java). Covers layered architecture, REST, JWT, error handling, logging, N+1 and indexing. Not for reviewing only (use /backend-critique)."
---

# Backend Development Skill

## Before Building — Clarify:
1. **Framework/Language**: Node.js (Express/Fastify/Hono), Python (FastAPI/Django), Go, Java Spring?
2. **Database**: Relational (PostgreSQL/MySQL) or NoSQL (MongoDB/Redis)?
3. **Auth method**: JWT, sessions, OAuth, API keys?
4. **Deployment target**: Serverless, containers, VPS?
5. **Scale expectations**: Requests/sec, data volume?

## API Design Principles

### REST Best Practices
- Use nouns for resources, verbs for HTTP methods
- `GET /users/:id` not `GET /getUser`
- Consistent response envelope:
```json
{
  "data": {},
  "error": null,
  "meta": { "page": 1, "total": 100 }
}
```
- Use correct HTTP status codes (200, 201, 400, 401, 403, 404, 422, 500)
- Version your API: `/api/v1/...`

### Request Validation
- Validate and sanitize ALL inputs before processing
- Return descriptive 422 errors with field-level messages
- Use Zod (TS), Pydantic (Python), or class-validator

## Database Patterns

### Schema Design
- Use UUIDs over sequential IDs for public-facing IDs
- Always include `created_at`, `updated_at` timestamps
- Index foreign keys and frequently queried columns
- Soft deletes with `deleted_at` when data history matters

### Query Optimization
- Avoid N+1 queries — use JOINs or eager loading
- Use `EXPLAIN ANALYZE` to debug slow queries
- Paginate all list endpoints (cursor-based for large datasets)
- Cache expensive queries with Redis (TTL based on data freshness)

## Authentication & Sessions
- Hash passwords with bcrypt (cost factor 12+)
- JWT: short-lived access tokens (15min) + refresh tokens (7-30 days)
- Store refresh tokens in httpOnly cookies, not localStorage
- Always validate token on protected routes middleware-level

## Error Handling
- Centralized error handler middleware
- Never expose stack traces in production responses
- Log errors with context (user ID, request ID, timestamp)
- Use structured logging (JSON) for easy querying

## Code Structure (Node.js example)
```
src/
├── routes/        # Route definitions only
├── controllers/   # Request/response handling
├── services/      # Business logic
├── repositories/  # Database queries
├── middleware/    # Auth, validation, logging
├── models/        # DB schemas/types
└── utils/         # Shared helpers
```

## Performance Checklist
- [ ] Database connections pooled (not opened per request)
- [ ] Async/await used correctly (no blocking the event loop)
- [ ] Background jobs offloaded to queue (Bull, Celery, etc.)
- [ ] Rate limiting on public endpoints
- [ ] Response compression enabled (gzip/brotli)
- [ ] Health check endpoint at `GET /health`

## Security Reminders
- Parameterized queries always (no string concatenation in SQL)
- CORS configured restrictively
- Helmet.js or equivalent security headers
- Secrets in environment variables, never in code