---
name: audit-route
description: |
  Audit dynamic routing architecture against the DB-driven pattern.
  Use this skill when:
  - Verifying routing is fully database-driven (no hardcoded routes)
  - Checking the 5 mandatory elements (componentRegistry, ProtectedRoute, DynamicRouter, useRouteConfig, API)
  - Validating route/permission alignment
  - Detecting anti-patterns (static routes, hardcoded permissions, non-lazy imports)
argument-hint: "[--strict] [--scope=frontend|backend|all]"
model: sonnet
allowed-tools: "Read, Grep, Glob, Bash, Agent, ToolSearch"
entry_point: steps/step-00-init.md
---

<objective>
Audit the dynamic routing implementation against the SmartStack DB-driven routing pattern. The architecture requires that navigation and permissions are **entirely driven by the database** — the React frontend must contain **zero hardcoded routes**.

The audit validates 5 mandatory elements:
1. **componentRegistry** — static mapping `string -> lazy(component)`, only allowed static file
2. **ProtectedRoute** — front-end guard that validates permissions from the API (defense in depth)
3. **DynamicRouter** — rendering engine that generates `<Route>` from API config
4. **useRouteConfig** — hook that fetches route config + permissions from the API at mount
5. **Navigation API** — endpoint returning routes **already filtered** by JWT/session

For each element: inventory, conformity check, causal analysis of deviations, and migration plan.
</objective>

<quick_start>

```bash
/audit-route                     # Full audit (frontend + backend)
/audit-route --scope=frontend    # Frontend only (React routing)
/audit-route --scope=backend     # Backend only (API + navigation)
/audit-route --strict            # Fail on any partial conformity (treat warnings as errors)
```

</quick_start>

<parameters>

<flags>
| Flag | Description |
|------|-------------|
| `--scope=all` | Audit both frontend and backend (default) |
| `--scope=frontend` | Audit React routing only (elements 1-4) |
| `--scope=backend` | Audit API navigation only (element 5) |
| `--strict` | Treat partial conformity (warning) as non-conformity (error) |
</flags>

</parameters>

<workflow>
1. **Initialize** — Detect project structure, resolve paths, parse flags
2. **MCP Pre-scan** — Call `validate_frontend_routes` and `validate_conventions` for automated baseline
3. **Inventory** — Locate each of the 5 mandatory elements in the codebase
4. **Conformity** — Evaluate each element against the reference pattern, cross-reference with MCP findings
5. **Anti-patterns** — Scan for hardcoded routes, static permissions, non-lazy imports
6. **Report** — Generate structured audit report with causal analysis and migration plan
</workflow>

<state_variables>
| Variable | Type | Description |
|----------|------|-------------|
| `{scope}` | string | frontend, backend, or all |
| `{strict}` | boolean | Treat warnings as errors |
| `{web_root}` | string | Path to web/smartstack-web/src/ |
| `{api_root}` | string | Path to src/SmartStack.Api/ |
| `{elements}` | object[] | Inventory of the 5 mandatory elements |
| `{conformity}` | object[] | Conformity status per element |
| `{anti_patterns}` | object[] | Detected anti-patterns with file:line |
| `{mcp_results}` | object | Results from MCP validate_frontend_routes + validate_conventions |
| `{score}` | string | X/5 conformity score |
</state_variables>

<entry_point>

**FIRST ACTION:** Load `steps/step-00-init.md`

</entry_point>

<step_files>
| Step | File | Purpose |
|------|------|---------|
| 00 | `steps/step-00-init.md` | Parse flags, detect project structure, resolve paths |
| 01 | `steps/step-01-inventory.md` | Locate all 5 mandatory elements in the codebase |
| 02 | `steps/step-02-conformity.md` | Evaluate conformity, causal analysis, anti-pattern scan |
| 03 | `steps/step-03-report.md` | Generate structured audit report with migration plan |
</step_files>

<execution_rules>
- **Read-only** — This skill NEVER modifies code
- **Non-judgmental** — Analyze code, not developers. Distinguish errors from conscious choices
- **Comprehensive** — Check ALL files, not a sample. Grep entire codebase for anti-patterns
- **Evidence-based** — Every finding must reference a specific file:line
- **Causal** — Every deviation must include: what was done instead, why it deviates, probable reason, consequence, and migration path
- **SmartStack-aware** — Respect SmartStack SDK architecture (PageRegistry, DynamicRouter, menu API)
</execution_rules>

<success_criteria>
- All 5 elements inventoried with exact file paths and line numbers
- Each element rated: Conforme / Partiellement conforme / Non conforme / Absent
- Anti-patterns detected across entire codebase (not just routing files)
- Causal analysis for every deviation (5 questions answered)
- Prioritized migration plan (critical > important > nice-to-have)
- Executive summary with X/5 score and 3-line architecture status
</success_criteria>
