Security Fixes

AI_PROJECT_GUIDE.md

@@ -4,7 +4,12 @@
 Vehicle management platform using Modified Feature Capsules. Each feature in backend/src/features/[name]/ is 100% self-contained with API, domain, data, migrations, external integrations, tests, and docs. Single directory load gives complete context. No shared business logic, only pure utilities in shared-minimal/.
 
 ## Architecture Philosophy
-Each feature is a complete, self-contained capsule. Load ONE directory for 100% context. Evaluate every feature if it should be in it's own Docker container. This is a microservices based archiecture where production will be run on k8s. 
+- Each feature is a complete, self-contained capsule. 
+- Load ONE directory for 100% context. 
+- Evaluate every feature if it should be in it's own Docker container. 
+- This is a microservices based archiecture where production will be run on k8s.
+- This is a production only application architecture.
+- Always assume this application is going into production when you are done. All security and linting should pass.  
 
 ## Navigation & Quick Tasks
 
@@ -36,25 +41,26 @@ cd backend/src/features/[feature-name]/
 # Creates complete capsule structure with all subdirectories
 ```
 
-### Running Feature Migrations
+### Running Migrations
 ```bash
-# Single feature
-npm run migrate:feature [feature-name]
-
-# All features (respects dependencies)
+# All features (in dependency order)
 npm run migrate:all
+
+# From project root using Docker
+make migrate
 ```
+Note: Single-feature migration is not implemented yet. Run the full migration set.
 
 ### Testing Strategy
 ```bash
-# Test single feature (complete isolation)
+# Run all tests (from project root)
+make test
+
+# In backend container shell
+make shell-backend
+npm test                 # all tests
 npm test -- features/[feature-name]
-
-# Test feature integration
 npm test -- features/[feature-name]/tests/integration
-
-# Test everything
-npm test
 ```
 
 ### Docker Development Workflow
@@ -128,10 +134,14 @@ features/[name]/
 
 ## Development Environment
 All development happens in Docker containers:
-- **Development**: Dockerfile.dev with npm install during container build
-- **Testing**: make test runs tests in container
-- **Rebuilding**: make rebuild for code changes
-- **Package changes**: Container rebuild required
+- **Development**: `make dev` builds and runs the stack
+- **Testing**: `make test` runs backend tests in the container
+- **Rebuilding**: `make rebuild` for code/dependency changes
+- **Package changes**: Rebuild backend/frontend containers as needed
+
+## Authentication (Current State)
+- Backend uses a Fastify auth plugin that injects a mock user in development/test.
+- JWT validation via Auth0 is planned; production configuration will enforce it.
 
 ## External Services
 - **PostgreSQL**: Primary database (port 5432)
@@ -152,4 +162,4 @@ Features must be migrated in dependency order:
 1. **vehicles** (base feature)
 2. **fuel-logs** (depends on vehicles)
 3. **maintenance** (depends on vehicles)
-4. **stations** (independent)
+4. **stations** (independent)