trpc-auditor
Audit tRPC procedures for security, validation, and architectural consistency. Ensures procedures follow the service-layer pattern and have proper Zod input validation. Use when reviewing server-side routers and procedures.
When & Why to Use This Skill
The tRPC Procedure Auditor is a specialized developer tool designed to automate the review of server-side routers. It ensures architectural consistency by enforcing the service-layer pattern, enhances security through authentication audits, and guarantees robust data integrity by verifying strict Zod input validation across all procedures.
Use Cases
- Automated Pull Request Reviews: Automatically scan tRPC router files during the code review process to ensure they adhere to the 'no business logic in routers' rule.
- Security Hardening: Identify procedures that incorrectly use public access instead of protectedProcedure and verify that sensitive data is not exposed in response objects.
- Validation Enforcement: Ensure every API endpoint is strictly validated with Zod schemas to prevent runtime errors and improve API documentation accuracy.
- Legacy Code Refactoring: Audit existing server-side codebases to identify and migrate database queries or external API calls from routers into dedicated service layers.
- Standardizing Error Handling: Verify that procedures use appropriate TRPCError codes and implement proper logging before returning errors to the client.
| name | trpc-auditor |
|---|---|
| description | Audit tRPC procedures for security, validation, and architectural consistency. Ensures procedures follow the service-layer pattern and have proper Zod input validation. Use when reviewing server-side routers and procedures. |
| allowed-tools | Read, Grep, Glob |
tRPC Procedure Auditor
Standards
Security
- ✅ Use
protectedProcedurefor all authenticated routes - ✅ Validate user permissions within the procedure or middleware
- ✅ Ensure sensitive data is not leaked in response objects
Validation
- ✅ Use Zod for strict input validation (
input(z.object({ ... }))) - ✅ Provide meaningful error messages for validation failures
Architecture (The "Service Layer" Rule)
- ❌ NO business logic in routers.
- ✅ Routers should only:
- Validate input (via Zod)
- Check authentication/authorization
- Call a service function from
server/services/ - Return the result
- ✅ All business logic, database queries, and external API calls must live in
server/services/.
Error Handling
- ✅ Use
TRPCErrorwith appropriate codes (NOT_FOUND, UNAUTHORIZED, etc.) - ✅ Log errors before throwing them to the client
Review Checklist
- Service Layer: Is there business logic in this router? If yes, flag it for move to service layer.
- Validation: Is every input strictly validated with Zod?
- Auth: Is the correct procedure type (public vs protected) being used?
- Typing: Are the return types clear and well-defined?
Auto-Invocation Triggers
This Skill should activate when:
- Reviewing files in
server/routers/or files named*-router.ts - User asks to "audit trpc" or "check server procedures"