API and development #

Monorepo #

backend/ contains Symfony, controllers, domain, entities and repositories. frontend/ contains React, Lazy Pages, Axios and TanStack Query.

REST authentication #

POST /api/auth/login issues a session-related 15-minute JWT. The rotating refresh is an HttpOnly cookie. Private endpoints require ROLE_VIEWER; the entries add their business role.

Create an endpoint or page #

Validate on the server side, resolve the current organization, find each relationship in this tenant and add RBAC, auditing and testing. On the React side, add a page under frontend/src/pages, lazy import, route and rights-conditioned navigation.

make test
make lint
docker compose exec backend php bin/console doctrine:schema:validate

Any persisted changes require a reversible Doctrine migration.

Backend organization #

Controllers adapt HTTP, Application orchestrates use cases, Domain carries reusable rules, Entity keeps persistent invariants and Repository filters data. Avoid placing a critical rule only in React.

Essential tests #

Add a nominal case, a role refusal, a resource from another tenant and a business validation. For a relationship, test each foreign identifier. On the frontend side, test loading, mutation, error and responsive.

Migration Doctrine #

Generate and replay the migration, make it compatible with existing data, plan for recovery and rollback when possible. Validate schematic and test on a representative copy before production.

Contribution #

A pull request must remain focused, explain security/tenant impact, include testing and documentation, then satisfy make test and make lint. Do not commit .env, JWT keys, or real data.