system-prompts-and-models-o.../salesflow-saas/.claude/commands/review-pr.md
Claude 83210b9d12
feat: Add founder strategy, Claude Code control plane, SaaS launch readiness
Founder Strategy & GTM (from prompts #1, #10):
- niche-brief.md: Saudi real estate primary, healthcare secondary
- icp-brief.md: Full ICP with Arabic objection handling
- content-map.md: 20 content ideas, SEO keywords, weekly schedule
- outreach-map.md: WhatsApp/Email cold outreach with Arabic templates
- launch-plan.md: 14-day sprint + 30-day plan with revenue targets
- interview-template.md: 15 Arabic customer discovery questions

Claude Code Control Plane (from prompt #2):
- .claude/settings.json: Permissions and preferences
- .claude/commands/: 5 custom commands (review-pr, release-prep, security-check, generate-tests, architecture-review)
- .claude/hooks/: pre-commit.sh (secrets check), pre-push.sh (tests)

SaaS Launch Readiness (from prompt #4):
- saas-readiness-audit.md: Full audit with gap analysis
- deployment-checklist.md: Deploy + rollback procedures
- launch-checklist.md: 100+ launch day checklist items
- feature_flags.py: Redis-backed feature flags with per-tenant control

https://claude.ai/code/session_01LsnvBa7HwF5hs99VZbgLGj
2026-04-11 08:09:50 +00:00

76 lines
2.6 KiB
Markdown

# /review-pr — Pull Request Review for Dealix
Review the current PR branch against main. Perform a thorough multi-dimensional review.
## Steps
### 1. Identify Changes
```bash
git diff main...HEAD --stat
git diff main...HEAD --name-only
```
List all changed files grouped by area (backend, frontend, migrations, tests, config).
### 2. Code Quality
For each changed Python file:
- Check function length (flag any >40 lines)
- Check cyclomatic complexity (flag deeply nested logic)
- Verify type hints on all public function signatures
- Ensure docstrings on public classes and methods
- Verify consistent error handling (no bare `except:`)
- Check for `print()` statements that should be `logger.info()`
For each changed TypeScript/TSX file:
- Check component size (flag >200 lines)
- Verify prop types are defined
- Check for `any` type usage (should be avoided)
- Ensure error boundaries on async data fetching
### 3. Security Review
- No hardcoded secrets, API keys, or passwords
- SQL queries use parameterized statements (no f-string SQL)
- API endpoints have proper authentication decorators
- Tenant isolation: all DB queries filter by `tenant_id`
- File uploads validate content type and size
- No `eval()`, `exec()`, or `pickle.loads()` on user input
- JWT tokens validated on all protected routes
- CORS configuration is restrictive (not `*`)
### 4. PDPL Compliance
- Any new message-sending endpoint checks consent via `ConsentManager`
- Personal data access is audit-logged
- Data deletion endpoints exist for any new PII fields
- Consent purpose is specified for new data collection points
- No PII in log statements
### 5. Arabic String Validation
- All user-facing strings have Arabic translations
- Arabic text renders RTL correctly in frontend components
- Date/time formatting uses `Asia/Riyadh` timezone
- Currency displays as SAR with proper Arabic formatting
- Phone numbers accept Saudi format (+966)
### 6. Test Coverage
```bash
pytest --co -q # List collected tests
```
- Every new API endpoint has at least one test
- Every new service method has unit tests
- Edge cases covered (empty input, invalid tenant, expired token)
- Async tests use `pytest-asyncio`
### 7. Database & Migrations
- New models include `tenant_id` column
- Alembic migration is reversible (has `downgrade()`)
- No destructive migrations on production data
- Indexes exist on frequently queried columns
- Foreign keys have proper cascade rules
### 8. Summary
Produce a structured review with:
- **Approve / Request Changes / Needs Discussion**
- Critical issues (must fix before merge)
- Warnings (should fix, not blocking)
- Suggestions (nice to have)
- Questions for the author