repo/
  .cursor/
    rules/
      00-project.mdc
      10-auth-service.mdc
      20-ci-cd.mdc
      30-security.mdc
    commands/
      design-doc-auth.md
      plan-migration.md
      run-auth-tests.md
      cut-canary-release.md
      rollback-prod.md
    hooks.json
    hooks/
      format.sh
      verify.sh
      grind.ts
    mcp.json
    sandbox.json
    BUGBOT.md
  docs/
    design/
    adr/
    runbooks/
  services/
    auth-service-node/        # Node/TS
    auth-service-java/        # Java/Spring
  k8s/
    base/
      auth-service/
        deployment.yaml
        service.yaml
        hpa.yaml
        configmap.yaml
    rollouts/                 # 选项B：Argo Rollouts
      auth-service-rollout.yaml
  .github/workflows/          # GitHub Actions

---
description: "Project-wide engineering rules: commands, repo layout, definition of done"
alwaysApply: true
---
 
# Repo overview
- This is a microservices repo. Services live under `services/*`.
- Prefer small, reviewable commits. Never mix refactors + behavior changes in one commit.
 
# Build & verify signals (must be runnable locally)
- Node services: `pnpm -C services/<svc> lint && pnpm -C services/<svc> test`
- Java services: `./mvnw -pl services/<svc> test`
- Docker build: `docker build -f services/<svc>/Dockerfile .`
- Kubernetes dry-run: `kubectl apply -k k8s/base/auth-service --dry-run=server`
 
# Definition of done (DoD) for changes
- Tests added/updated.
- Observability: structured logs + trace correlation for new endpoints.
- Rollout plan + rollback command documented in `docs/runbooks/`.
 
# AI collaboration
- For non-trivial changes, start with Plan Mode. Save plans to `.cursor/plans/`.
- Always propose file-by-file diff and verification commands.

---
description: "Auth-service rules: OIDC, token boundary, security invariants"
globs: "services/auth-service-*/**/*"
alwaysApply: false
---
 
# Security invariants
- Never log raw tokens (id_token, access_token, refresh_token).
- Validate issuer/audience per OIDC config.
- Treat upstream OIDC outages as 5xx with retry/backoff; never fail open.
 
# API conventions
- Public endpoints:
  - GET /login, GET /callback, POST /token/exchange, GET /healthz, GET /readyz, GET /metrics
- All responses include `x-request-id` (or trace id) for correlation.
 
# Storage
- Config must be injectable via env vars (no hardcoded secrets).

# Goal
Create a migration plan for refactoring auth-service to OIDC with engineering hardening.
 
# Steps
1) Inspect current auth flow and list entrypoints.
2) Ask up to 3 clarifying questions.
3) Produce a plan with:
   - file paths
   - incremental commits (max 5)
   - verification signals per commit
   - rollout & rollback strategy
4) Save the plan to `docs/design/auth-oidc-migration.md`.

# Run auth-service verification signals
 
- For Node: `pnpm -C services/auth-service-node lint && pnpm -C services/auth-service-node test`
- For Java: `./mvnw -pl services/auth-service-java test`
 
If tests fail:
- Summarize the failure
- Propose a minimal fix
- Re-run the smallest failing test first

{
  "version": 1,
  "hooks": {
    "stop": [
      { "command": "bun run .cursor/hooks/grind.ts" }
    ]
  }
}

{
  "mcpServers": {
    "github": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "ghcr.io/github/github-mcp-server"],
      "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "SECRET" }
    },
    "jira": {
      "command": "npx",
      "args": ["-y", "@acme/jira-mcp-server@latest"],
      "env": { "JIRA_TOKEN": "SECRET,TOO", "JIRA_BASE_URL": "https://jira.example.com" }
    }
  }
}

# repo/Makefile
.PHONY: auth-node auth-java docker-auth-node docker-auth-java
 
auth-node:
	pnpm -C services/auth-service-node lint
	pnpm -C services/auth-service-node test
 
auth-java:
	./mvnw -pl services/auth-service-java test
 
docker-auth-node:
	docker build -f services/auth-service-node/Dockerfile services/auth-service-node
 
docker-auth-java:
	docker build -f services/auth-service-java/Dockerfile services/auth-service-java

name: auth-service CI
 
on:
  pull_request:
    paths:
      - "services/auth-service-*/**"
      - ".cursor/**"
      - ".github/workflows/**"
  push:
    branches: [main]
 
jobs:
  test-node:
    runs-on: ubuntu-latest
    if: ${{ hashFiles('services/auth-service-node/package.json') != '' }}
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v4
        with: { version: 9 }
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "pnpm"
      - run: pnpm -C services/auth-service-node install --frozen-lockfile
      - run: pnpm -C services/auth-service-node lint
      - run: pnpm -C services/auth-service-node test
 
  test-java:
    runs-on: ubuntu-latest
    if: ${{ hashFiles('services/auth-service-java/pom.xml') != '' }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: "temurin"
          java-version: "21"
          cache: "maven"
      - run: ./mvnw -pl services/auth-service-java test
 
  docker-build:
    runs-on: ubuntu-latest
    needs: [test-node, test-java]
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - name: Build auth-service images (no push on PR)
        run: |
          if [ -d services/auth-service-node ]; then
            docker buildx build -f services/auth-service-node/Dockerfile services/auth-service-node --load
          fi
          if [ -d services/auth-service-java ]; then
            docker buildx build -f services/auth-service-java/Dockerfile services/auth-service-java --load
          fi
 
  cursor-review:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'pull_request' }}
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Install Cursor CLI
        run: |
          curl https://cursor.com/install -fsS | bash
          echo "$HOME/.cursor/bin" >> $GITHUB_PATH
      - name: Run Cursor CLI code review
        env:
          CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
        run: |
          agent -p --output-format text "Review this PR. Focus on auth security, OIDC correctness, and rollback safety. Suggest minimal fixes."

# Bugbot review guidelines for auth-service changes
 
## OIDC / OAuth correctness
- Never accept tokens without validating issuer/audience.
- Ensure state/nonce verification exists for auth code flow.
- No token leakage in logs or error responses.
 
## Rollout safety
- Any change to auth endpoints must include:
  - readiness/liveness impact analysis
  - rollback command in docs/runbooks/
  - metrics / alerts touched
 
## DB migrations
- Migrations must be backward compatible for at least one release.
- No long-running locks without online strategy.