Rules Hub
Coding Rules Library
← Back to all rules
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
backend ruleP1universalStack: sql
authorizationdatabasejoinsquery-design
Resolve access checks with a single LEFT JOIN, not sequential queries
Determine authorization by joining the user to ownership and share tables in one query and checking for nulls, instead of issuing several lookups and combining the results in code.
PR: hegnar-journalist-boost · org-mining-2026-06Created: Jun 17, 2026
Bad example
Old codetypescript
| 1 | const owns = await isOwner(docId, userId); |
| 2 | const shared = await isSharedWith(docId, userId); |
| 3 | if (!owns && !shared) throw new ForbiddenError(); |
Explanation (EN)
Objašnjenje (HR)
Good example
New codetypescript
| 1 | const [row] = await db |
| 2 | .select({ ownerId: doc.ownerId, sharedUserId: shares.userId }) |
| 3 | .from(doc) |
| 4 | .leftJoin(shares, and(eq(shares.docId, doc.id), eq(shares.userId, userId))) |
| 5 | .where(eq(doc.id, docId)); |
| 6 | if (row.ownerId !== userId && row.sharedUserId == null) throw new ForbiddenError(); |
Explanation (EN)
Objašnjenje (HR)