Add vibecodex FastAPI production architecture cursorrules#272
Open
yerdaulet-damir wants to merge 3 commits intoPatrickJS:mainfrom
Open
Add vibecodex FastAPI production architecture cursorrules#272yerdaulet-damir wants to merge 3 commits intoPatrickJS:mainfrom
yerdaulet-damir wants to merge 3 commits intoPatrickJS:mainfrom
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📝 WalkthroughWalkthroughAdds a new Cursor ruleset for a production FastAPI architecture plus a README, and updates the repository README to reference the new "vibecodex FastAPI Production" ruleset (layered model, provider patterns, file-size/LOC policies). Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.gh.lumenfield.work/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
rules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules (2)
130-135: Make the contextvars logging example “copy/paste correct”.The example uses
contextvars.ContextVar[...]but doesn’t showimport contextvars. Also, consider adding a short snippet showing how to read these vars inside the logger call (or explicitly instruct Cursor to include structured fields), so implementations are consistent and not ad-hoc.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@rules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules` around lines 130 - 135, The snippet defining provider_var and user_id_var is missing the import for contextvars and doesn't show how to read those vars when logging; add "import contextvars" at the top and update examples (or instructions to Cursor) to read contextvars via provider_var.get() and user_id_var.get() when emitting logs (or explicitly instruct Cursor to include those as structured fields) so the sample using provider_var and user_id_var is copy/paste runnable and consistently produces structured context in logs.
136-140: Single-writer rule is correct but overly specific to one file path.Hard-coding “
repo.hold()may only be called fromservices/credits/user.py” is brittle if the project reorganizes modules. Consider expressing the constraint in terms of call origin (e.g., “only services layer may call repo.hold; no routers/providers/admin services; enforce via code-review lint/testing”) rather than a single path.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@rules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules` around lines 136 - 140, The rule currently hard-codes the module path "services/credits/user.py" for the Single-Writer Principle; change it to require that only the service layer is allowed to call repo.hold() (e.g., "Only service-layer modules may call repo.hold(); routers, providers, and admin services must not call repo.hold()"), remove the specific file path, and add guidance to enforce this via code-review checks, linting or unit/integration tests that assert call-origin (referencing the symbol repo.hold() and the "Single-Writer Principle" rule name).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@README.md`:
- Line 151: The new list item "vibecodex FastAPI Production" in the "Backend and
Full-Stack" section is out of alphabetical order; relocate the line "-
[vibecodex FastAPI
Production](./rules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules)
- Production architecture rules: Router→Service→Repository, ACL, bulkhead
isolation, single-writer principle" so it appears in the correct alphabetical
position among the other bullets in the "Backend and Full-Stack" list (compare
surrounding entries like the "Python" bullets) to restore alphabetical ordering.
In `@rules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules`:
- Around line 19-27: The router's charge handler passes the idempotency value as
key=req.idempotency_key which mismatches the expected idempotency_key parameter
described in Rule 3; update the call in the charge function to pass the
idempotency value with the correct name (e.g.,
idempotency_key=req.idempotency_key) or rename the ChargeRequest/service
parameter consistently so svc.charge(user_id=user_id, amount=req.amount,
idempotency_key=req.idempotency_key) matches the expected signature; ensure
ChargeRequest and svc.charge use the exact same identifier idempotency_key.
---
Nitpick comments:
In `@rules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules`:
- Around line 130-135: The snippet defining provider_var and user_id_var is
missing the import for contextvars and doesn't show how to read those vars when
logging; add "import contextvars" at the top and update examples (or
instructions to Cursor) to read contextvars via provider_var.get() and
user_id_var.get() when emitting logs (or explicitly instruct Cursor to include
those as structured fields) so the sample using provider_var and user_id_var is
copy/paste runnable and consistently produces structured context in logs.
- Around line 136-140: The rule currently hard-codes the module path
"services/credits/user.py" for the Single-Writer Principle; change it to require
that only the service layer is allowed to call repo.hold() (e.g., "Only
service-layer modules may call repo.hold(); routers, providers, and admin
services must not call repo.hold()"), remove the specific file path, and add
guidance to enforce this via code-review checks, linting or unit/integration
tests that assert call-origin (referencing the symbol repo.hold() and the
"Single-Writer Principle" rule name).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: cb9c7f00-4c43-49f8-b0df-52cc30606796
📒 Files selected for processing (3)
README.mdrules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrulesrules/vibecodex-fastapi-production-cursorrules-prompt-file/README.md
| - [Python (Django Best Practices)](./rules/python-django-best-practices-cursorrules-prompt-fi/.cursorrules) - Cursor rules for Python Django development with best practices. | ||
| - [Python (FastAPI Best Practices)](./rules/python-fastapi-best-practices-cursorrules-prompt-f/.cursorrules) - Cursor rules for Python FastAPI development with best practices. | ||
| - [Python (FastAPI Scalable API)](./rules/python-fastapi-scalable-api-cursorrules-prompt-fil/.cursorrules) - Cursor rules for Python FastAPI development with scalable API integration. | ||
| - [vibecodex FastAPI Production](./rules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules) - Production architecture rules: Router→Service→Repository, ACL, bulkhead isolation, single-writer principle |
Contributor
There was a problem hiding this comment.
Alphabetical ordering violation in the “Backend and Full-Stack” list.
The new “vibecodex FastAPI Production” entry is inserted between “Python (...)” bullets (around Line 150-154 in the provided snippet). Per the repository guideline, entries within a category should be kept alphabetically ordered, so this item should be moved to its correct position among the “Backend and Full-Stack” rules.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@README.md` at line 151, The new list item "vibecodex FastAPI Production" in
the "Backend and Full-Stack" section is out of alphabetical order; relocate the
line "- [vibecodex FastAPI
Production](./rules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules)
- Production architecture rules: Router→Service→Repository, ACL, bulkhead
isolation, single-writer principle" so it appears in the correct alphabetical
position among the other bullets in the "Backend and Full-Stack" list (compare
surrounding entries like the "Python" bullets) to restore alphabetical ordering.
…import, single-writer generalization, alphabetical order
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
rules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules (1)
146-150: Clarify the single-writer rule’s scope.“Admin services must NOT call
repo.hold()directly” is too absolute and reads as if admin services are excluded from the service layer entirely. If admin workflows also own writes, this wording will force a second code path or an awkward exception.Suggested wording
-Only service-layer modules may call repo.hold(). -Routers, providers, and admin services must NOT call repo.hold() directly. +Only the designated writer service for a domain may call repo.hold(). +Routers and providers must NOT call repo.hold() directly.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@rules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules` around lines 146 - 150, Update the Rule 5 wording to clarify scope: state that "Only service-layer modules may call repo.hold()" and explicitly allow admin services that are implemented as part of the service layer to call repo.hold(), while prohibiting routers, providers, and non-service-layer admin utilities from calling repo.hold() directly; replace the sentence "Admin services must NOT call repo.hold() directly" with a clear exception phrase referencing "admin services implemented in the service layer" and keep the enforcement note (grep "repo\.hold(") unchanged so reviewers can still detect violations.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@rules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules`:
- Around line 11-16: The rule blanket-requires user_id: str =
Depends(get_current_user_id) on every non-/auth/* endpoint which incorrectly
forces authentication on public routes (health checks, webhooks, callbacks);
change the rule so that only protected endpoints explicitly declare the
dependency (e.g., routes that call protected services or are in auth-protected
routers) must include user_id: str = Depends(get_current_user_id), while public
endpoints (health check, webhook, callback) must be exempt—update the guidance
text and examples to reference get_current_user_id and clarify that
business-facing routers/methods that need identity call the dependency, whereas
anonymous endpoints do not.
- Around line 67-71: The LOC ranges "0–400" and "400–600" overlap at 400; change
the lower range to be non‑inclusive of 400 so the policy is unambiguous (e.g.,
replace "0–400" with "0–399" so 400 falls into "400–600" as intended). Update
the table entries containing the strings "0–400" and "400–600" accordingly (look
for the exact range tokens in the | LOC | table row).
- Around line 114-126: Module-level AsyncClient instances FAL_HTTP and
OPENAI_HTTP are never closed, risking connection-pool leaks; add explicit
shutdown cleanup that calls await FAL_HTTP.aclose() and await
OPENAI_HTTP.aclose() during application shutdown. Locate where the FastAPI app
lifecycle is managed (startup/shutdown handlers or the app factory) and register
an async shutdown event (or use a lifespan context) that closes each provider
client; ensure the handler is awaited and idempotent so repeated
shutdowns/reloads don't error.
---
Nitpick comments:
In `@rules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules`:
- Around line 146-150: Update the Rule 5 wording to clarify scope: state that
"Only service-layer modules may call repo.hold()" and explicitly allow admin
services that are implemented as part of the service layer to call repo.hold(),
while prohibiting routers, providers, and non-service-layer admin utilities from
calling repo.hold() directly; replace the sentence "Admin services must NOT call
repo.hold() directly" with a clear exception phrase referencing "admin services
implemented in the service layer" and keep the enforcement note (grep
"repo\.hold(") unchanged so reviewers can still detect violations.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c20446f5-68fe-42d8-9c08-6ec628fe3272
📒 Files selected for processing (2)
README.mdrules/vibecodex-fastapi-production-cursorrules-prompt-file/.cursorrules
✅ Files skipped from review due to trivial changes (1)
- README.md
…-writer, client cleanup
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
vibecodex — FastAPI Production Architecture Rules
🔗 Repo: https://github.com/yerdaulet-damir/vibecodex
What these rules enforce
Production architecture patterns that prevent the most common "works in dev, breaks in prod" failures when AI writes FastAPI code:
GenerateResult | ProviderError, never rawdict. Vendor field names never cross the boundary.httpx.AsyncClientper external provider with explicitLimits. Prevents one slow provider from starving others.WalletRepoProtocol, notSession. Makes testing with fakes trivial.contextvarsthreadsuser_id,provider,request_idthrough async stacksStack
FastAPI 0.111 · SQLAlchemy 2.0 · Pydantic v2 · Python 3.11+
Part of vibecodex — production architecture bible for vibe-coding across FastAPI, Next.js 15, and Go 1.22+.
Summary by CodeRabbit