Security Guardian Skill

This skill ensures the application complies with the RuoYi Security Model and general Web Security standards.

🛡️ Core Principles

1. Zero Trust: Never trust frontend input. Validate everything on the server.
2. Permission First: Every Controller method (except public ones) MUST have @PreAuthorize.
3. Data Isolation: Users should only see their own data.

🛠️ Common Workflows

1. Data Scoping (Multi-Tenancy/Isolation)

Context: A user should only see their OWN cart or orders. Pattern:

// Controller
public TableDataInfo list(AgOrder order) {
    // FORCE the query to be filtered by current User ID
    order.setUserId(SecurityUtils.getUserId());