database-first

Name: database-first
Availability: InStock
Author: discountedcookie

Centralize game logic and state in PostgreSQL stored procedures and views.

Updated Oct 26, 2025

Search Tags:#architecture #SQL #RPC #database-first #security-definer

Ready to run

npx skills add https://github.com/discountedcookie/10x-mapmaster --skill database-first

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: database-first
Source: https://github.com/discountedcookie/10x-mapmaster/tree/main/.opencode/skills/database-first
Command: npx skills add https://github.com/discountedcookie/10x-mapmaster --skill database-first

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill codifies the architecture rule that all business logic lives in PostgreSQL, guiding frontend to be presentation-only.

Core Features & Use Cases

Architecture guidance: Frontend vs database responsibilities clearly separated.
RPC & security patterns: Emphasizes SECURITY DEFINER usage and RPC usage.
Anti-patterns: Avoids placing game logic in frontend.

Quick Start

Review the architecture rules and ensure code belongs to database-first paths.

Frequently Asked Questions about database-first

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I structure a PostgreSQL database-first architecture?▼

Database-first architecture centralizes all business logic and state in PostgreSQL using stored procedures and views as the source of truth, while the frontend remains presentation-only. This enforces separation of concerns: the database handles game logic, state validation, and computations; edge functions manage LLM and embedding integration; the frontend renders UI only.

What is the RPC pattern and why use SECURITY DEFINER in PostgreSQL?▼

The RPC pattern exposes database functions as callable endpoints. SECURITY DEFINER functions execute with the privileges of the function owner rather than the caller, enabling secure, centralized authorization logic. Combined with explicit search_path configuration, this prevents SQL injection and enforces consistent permission checks across all database calls.

How do I prevent business logic from leaking into the frontend?▼

Enforce database-first discipline by moving all decision logic—confidence scoring, turn determination, candidate filtering, and game state validation—into PostgreSQL stored procedures. The frontend receives only presentation data and UI instructions from the database, eliminating duplicate or conflicting business rules.

When should I use stored procedures instead of application code?▼

Use stored procedures for all business logic that determines application state or behavior: validation rules, computed values, filtering criteria, and state transitions. This approach centralizes rules in PostgreSQL, simplifies testing, and ensures edge functions and frontends cannot bypass or override critical logic.

What are the security benefits of centralizing logic in the database?▼

Database-first architecture reduces attack surface by eliminating logic duplication across frontends and edge services. SECURITY DEFINER functions with explicit search_path prevent privilege escalation and SQL injection. A single source of truth for business rules ensures consistent enforcement and simplifies security audits.

Can I use database-first architecture with separate frontend frameworks?▼

Yes. Database-first architecture explicitly separates the database layer from frontend presentation. Any frontend framework—React, Vue, Svelte—can consume data and UI instructions from PostgreSQL via RPC endpoints, as long as the frontend enforces no business logic and edge functions handle only LLM or embedding tasks.