Backend Development Skill

Comprehensive backend development guidance for production-grade applications.

Activation Context

This skill activates during:

• API design and development (REST/GraphQL)
• Database schema design and query optimization
• Authentication/authorization implementation
• Security audits and vulnerability reviews
• Microservices architecture discussions

Resources

API Development Workflow

1. API Design First

Before implementation:

• Define resource models and relationships
• Design endpoint structure following REST conventions
• Document request/response schemas
• Plan authentication strategy
• Consider rate limiting and caching

2. Framework-Specific Implementation

Node.js (Express/NestJS):

// Clean architecture with dependency injection
// Input validation with zod/class-validator
// Error handling middleware
// See references/nodejs-patterns.md

Python (FastAPI):

# Pydantic models for validation
# Async/await for I/O operations
# Dependency injection system
# See references/python-patterns.md

Go (Gin):

// Structured error handling
// Middleware chain
// Context propagation
// See references/go-patterns.md

3. Quality Checklist

Before deploying an API:

• Input validation on all endpoints
• Authentication/authorization implemented
• Rate limiting configured
• Error responses standardized
• API documentation complete (OpenAPI/Swagger)
• Integration tests written
• Security audit passed

Database Best Practices

Schema Design

Query Optimization

1. Avoid N+1 Queries

   • Use JOINs or batch loading
   • Implement DataLoader pattern for GraphQL

2. Index Strategy

   • B-tree for equality/range queries
   • Composite indexes for multi-column queries
   • Covering indexes for frequently accessed columns

3. Query Analysis

   python scripts/sql_analyzer.py "SELECT * FROM users WHERE..."
   

Security Implementation

Authentication Patterns

Authorization Patterns

Security Audit

Run the security scanner:

python scripts/security_audit.py <api-directory>

Checks for:

• SQL injection vulnerabilities
• XSS attack vectors
• Insecure authentication
• Missing input validation
• Hardcoded secrets
• CORS misconfiguration

API Templates

Quick-start templates available in assets/templates/:

Architecture Patterns

Clean Architecture

src/
├── domain/           # Business entities
├── application/      # Use cases
├── infrastructure/   # External services
└── presentation/     # Controllers/handlers

Microservices Communication

Error Handling

Standard Error Response

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid input data",
    "details": [
      { "field": "email", "message": "Invalid email format" }
    ],
    "requestId": "abc-123"
  }
}

HTTP Status Code Guidelines

Output Format

Claude responds in Chinese per CLAUDE.md.

Backend Analysis Report
========================

Module: {module_name}
Framework: {Express/FastAPI/Gin}

Issues Found:
- {specific issue description}

Optimization Suggestions:
1. {suggestion 1}
2. {suggestion 2}

Security Assessment:
- Authentication: {status}
- Authorization: {status}
- Input Validation: {status}

========================