Skip to main content

API Ownership

The NestJS API in apps/api is the source of truth for business logic, authorization, database writes, and Prisma schema ownership.

Ownership Rules​

  • apps/api/prisma/schema.prisma is the canonical Prisma schema.
  • apps/web may call the NestJS API directly or expose thin BFF/proxy routes for browser/mobile ergonomics.
  • Next.js route handlers should not introduce new business rules that are not also enforced by NestJS.
  • Direct Prisma access from apps/web is legacy and should be removed incrementally as routes move behind the NestJS API.
  • Admin authorization is role-based: admin and moderator. Email-based admin bypasses are not allowed.

Migration Direction​

When touching a Next.js API route, first decide whether it is:

  1. A thin BFF route that forwards to NestJS and adapts the response shape.
  2. Business logic that should be moved into an apps/api/src/modules/* service.

Prefer option 2 for writes, auth-sensitive reads, quota logic, AI usage tracking, and anything that touches user data.

Prisma Workflow​

Run Prisma commands from apps/api when changing schema. The web app scripts point to ../api/prisma/schema.prisma so generated clients use the same schema definition.