finalproject-MC-FB-add prompts.md and readme.md#255
Open
Franco-Borgato wants to merge 1 commit into
Open
Conversation
📝 WalkthroughWalkthroughThe changes replace Spanish documentation scaffolds with fully populated English content in ChangesDocumentation rewrite
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@prompts.md`:
- Line 273: Choose the single Railway-deployed branch based on the actual
configuration, then align all deployment references to that choice: update
prompts.md lines 273-273, readme.md lines 48-48, 259-259, 286-287, and 804-804;
replace any contradictory branch claims while preserving the surrounding project
and environment descriptions.
- Line 1: Fix repository-root documentation links: in prompts.md lines 1-1,
target docs/prompts/prompts.md; in readme.md lines 40-40 and 101-101, target
docs/guia-de-uso.md; and in readme.md line 124, target docs/deploy.md. Preserve
the surrounding documentation text.
In `@readme.md`:
- Line 219: Update the repository-tree code fence in readme.md to use the text
language tag, changing the unlabeled fence to ```text while preserving its
contents.
- Line 515: Update the “Global conventions” statement to qualify the
created_at/updated_at requirement with the schema’s documented exceptions,
including audit_log using changed_at and appointment_notifications lacking
displayed timestamps; preserve the other UUID, soft-delete, appointment-state,
and clinic_id/RLS conventions.
- Around line 183-195: The README overstates PostgreSQL RLS as a production
isolation guarantee while Railway runs the backend as the superuser postgres.
Update the RLS architecture and deployment descriptions to explicitly scope RLS
guarantees to a non-superuser forced-RLS runtime, or state that the current
application-layer clinic_id filtering is the effective isolation boundary and
RLS is optional defense in depth; keep the documented runtime configuration
consistent throughout the affected sections.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1,125 +1,273 @@ | |||
| > Detalla en esta sección los prompts principales utilizados durante la creación del proyecto, que justifiquen el uso de asistentes de código en todas las fases del ciclo de vida del desarrollo. Esperamos un máximo de 3 por sección, principalmente los de creación inicial o los de corrección o adición de funcionalidades que consideres más relevantes. | |||
| Puedes añadir adicionalmente la conversación completa como link o archivo adjunto si así lo consideras | |||
| **Session structure:** The project went through two major stages. **Documentation stage (Sessions 1–3):** product definition with BMAD's Analyst agent, generation of the complete technical documentation via the `doc-generator` agent, and a critical architectural review that fixed the MVP scope and the adoption of 2026 standards. **Implementation stage (Sessions 4–46):** per-layer ticket generation, scaffolding, configuration of the `/implement-us` flow and iterative development of the User Stories —Phase 1 (US-001 to US-025, US-027, US-DASH), Phase 1.5 Client Portal (US-033 to US-041, US-427) and cross-cutting ones (US-PROFILE, US-PETPHOTO, US-DESIGN)— each with its PR to `dev`, closing with the **deployment of the complete system on Railway**. This document selects, for each delivery section, the **most relevant** prompts from both stages. The full chronological log lives in [docs/prompts/prompts.md](../docs/prompts/prompts.md). | |||
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Fix repository-root documentation links.
prompts.md#L1-L1: change the target todocs/prompts/prompts.md.readme.md#L40-L40: change the target todocs/guia-de-uso.md.readme.md#L101-L101: change the target todocs/guia-de-uso.md.readme.md#L124-L124: change the target todocs/deploy.md.
📍 Affects 2 files
prompts.md#L1-L1(this comment)readme.md#L40-L40readme.md#L101-L101readme.md#L124-L124
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@prompts.md` at line 1, Fix repository-root documentation links: in prompts.md
lines 1-1, target docs/prompts/prompts.md; in readme.md lines 40-40 and 101-101,
target docs/guia-de-uso.md; and in readme.md line 124, target docs/deploy.md.
Preserve the surrounding documentation text.
| > Convention sustained throughout implementation: one PR per User Story onto `dev`, with a per-ticket changelog and manual testing against real Postgres before closing; the arc closed with the Railway deployment. | ||
|
|
||
| **Prompt 3:** | ||
| **~44 PRs merged to `dev`** were completed (`#388`–`#456`): Phase 1 (US-001 to US-025, US-027, US-DASH), Phase 1.5 — Client Portal (US-033 to US-041, US-427) and cross-cutting ones (US-PROFILE, US-PETPHOTO, US-DESIGN). Each PR closes its parent issue and its tickets, with the test suite (backend > 900, frontend > 850) and, for the critical flows, Playwright specs. The `dev` branch is the one Railway tracks for deployment; PRs to `main` remain for the phase closure. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Document one authoritative Railway deployment branch.
prompts.md#L273-L273: retaindevonly if it is the actual deployed branch.readme.md#L48-L48: update the project-sheet branch statement to match Railway.readme.md#L259-L259: update the infrastructure deployment claim.readme.md#L286-L287: align the environment table with the actual branch configuration.readme.md#L804-L804: keep the closing note consistent with that choice.
📍 Affects 2 files
prompts.md#L273-L273(this comment)readme.md#L48-L48readme.md#L259-L259readme.md#L286-L287readme.md#L804-L804
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@prompts.md` at line 273, Choose the single Railway-deployed branch based on
the actual configuration, then align all deployment references to that choice:
update prompts.md lines 273-273, readme.md lines 48-48, 259-259, 286-287, and
804-804; replace any contradictory branch claims while preserving the
surrounding project and environment descriptions.
Comment on lines
+183
to
+195
| **Chosen pattern:** Three-layer architecture (Presentation / Application / Data) with decoupled async orchestration (ARQ) for the AI pipeline and a daily Railway cron for reminders. Multi-tenancy with **defense in depth**: `clinic_id` filter in SQLAlchemy queries + PostgreSQL Row-Level Security as a second engine-level layer. The Client Portal adds a **third per-owner isolation layer** (client RLS, US-427). | ||
|
|
||
| **Justification:** | ||
| - **FastAPI + PostgreSQL** provide a typed, async-native, high-performance backend. Pydantic v2 makes the extraction schema (`ClinicalRecordExtraction`) serve simultaneously as the tool_use schema for Claude and as the shape of the JSONB in `clinical_records_ai`. | ||
| - **Expo (Expo Router + Tamagui)** with a web build via React Native Web shares the UI between web and mobile from the first component — the `services/` and `store/` layers port without a rewrite. The same bundle serves the staff area and the client portal. | ||
| - **ARQ** decouples the AI pipeline (Whisper's variable latency + 2 Claude calls) from the HTTP response. Async-native, the same Redis already used for refresh tokens — without adding Celery. | ||
| - **PostgreSQL Row-Level Security** on every table with `clinic_id`: if a query omits the filter, the engine returns zero rows instead of leaking between clinics. Cross-tenant clinical data leaks become impossible at the engine level. | ||
| - **Railway-only** removes the operational friction of two clouds (no CORS, no env duplication); the 6 services communicate over the internal private network. | ||
|
|
||
| **Trade-offs and implementation decisions:** | ||
| - **Groq Whisper instead of OpenAI `whisper-1`:** Groq was adopted (`whisper-large-v3`, via the OpenAI SDK with a `base_url` override) for its free tier without a card, enough for MVP development. Changing provider is config. | ||
| - **SMTP (`aiosmtplib`) instead of Resend:** migrated in US-004 to deliver to any recipient without verifying a domain (Gmail App Password in dev; SES/Mailgun/Brevo in prod). Config-only to change provider. | ||
| - **RLS adds setup complexity:** two DB users (`app_runtime` with forced RLS, `app_admin` with `BYPASSRLS` for Alembic) + `set_config('app.clinic_id', …, true)` per request. The portal additionally adds `set_config('app.client_id', …)`. On Railway the backend connects as `postgres` (superuser, bypasses RLS): isolation still holds via the application-layer `clinic_id` filter (RLS = defense-in-depth, not a functioning requirement; optional hardening documented in `docs/deploy.md`). |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== readme.md line count ==\n'
wc -l readme.md || true
printf '\n== readme.md around cited lines ==\n'
sed -n '170,210p' readme.md
printf '\n---\n'
sed -n '290,340p' readme.md
printf '\n== repo search for relevant terms ==\n'
rg -n -i 'railway|postgres|bypassrls|forcerls|app_runtime|app_admin|row-level security|rls|clinic_id|client_id' .Repository: LIDR-academy/AI4Devs-finalproject
Length of output: 39294
🏁 Script executed:
#!/bin/bash
set -euo pipefail
wc -l readme.md
sed -n '170,210p' readme.md
printf '\n---\n'
sed -n '290,340p' readme.md
printf '\n---\n'
rg -n -i 'railway|postgres|bypassrls|forcerls|app_runtime|app_admin|row-level security|rls|clinic_id|client_id' .Repository: LIDR-academy/AI4Devs-finalproject
Length of output: 39197
Scope the RLS guarantee to the non-superuser runtime
readme.md:183-195, 297-300, 328
postgres bypasses RLS, so this can’t be presented as an engine-level production guarantee while Railway uses that role. Either run the backend under the forced-RLS user or reword this to say RLS is defense in depth and the application-layer clinic_id filter is the actual isolation boundary.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@readme.md` around lines 183 - 195, The README overstates PostgreSQL RLS as a
production isolation guarantee while Railway runs the backend as the superuser
postgres. Update the RLS architecture and deployment descriptions to explicitly
scope RLS guarantees to a non-superuser forced-RLS runtime, or state that the
current application-layer clinic_id filtering is the effective isolation
boundary and RLS is optional defense in depth; keep the documented runtime
configuration consistent throughout the affected sections.
|
|
||
| Monorepo organization with frontend/backend separation: | ||
|
|
||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add a language tag to the repository-tree fence.
Change the unlabeled fence to ```text so markdownlint MD040 passes.
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 219-219: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@readme.md` at line 219, Update the repository-tree code fence in readme.md to
use the text language tag, changing the unlabeled fence to ```text while
preserving its contents.
Source: Linters/SAST tools
|
|
||
| ### **3.2. Description of the main entities:** | ||
|
|
||
| **Global conventions:** UUID as PK; `created_at`/`updated_at` on all tables; soft delete with `deleted_at` on clinical and business models (except `appointments`, which uses a state change); `clinic_id` with RLS enabled on every tenant-scoped table. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Correct the “all tables” timestamp convention.
The schema shown below includes exceptions such as changed_at on audit_log and no displayed timestamps on appointment_notifications. State the convention with its exceptions so readers do not infer an incorrect schema contract.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@readme.md` at line 515, Update the “Global conventions” statement to qualify
the created_at/updated_at requirement with the schema’s documented exceptions,
including audit_log using changed_at and appointment_notifications lacking
displayed timestamps; preserve the other UUID, soft-delete, appointment-state,
and clinic_id/RLS conventions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit