# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
# CodeRabbit configuration for mtc. Pharmacy Starter
# Docs: https://docs.coderabbit.ai/getting-started/yaml-configuration

language: en-GB
early_access: false

tone_instructions: >
  Laravel 11 + legacy PHP hybrid pharmacy platform. Be direct and concise.
  Flag healthcare/PII/security risks first. Prefer pragmatic fixes over
  rewrites — respect both Laravel and legacy patterns.

reviews:
  profile: assertive
  request_changes_workflow: false
  high_level_summary: true
  poem: false
  review_status: true
  collapse_walkthrough: true
  sequence_diagrams: true
  changed_files_summary: true
  abort_on_close: true

  # Exclude generated, vendored, and binary paths from review
  path_filters:
    - "!vendor/**"
    - "!node_modules/**"
    - "!public/build/**"
    - "!public/js/**"
    - "!public/css/**"
    - "!public/vendor/**"
    - "!bootstrap/cache/**"
    - "!storage/**"
    - "!uploads/**"
    - "!uploads_seeder/**"
    - "!uploads_old/**"
    - "!epos_images/**"
    - "!.playwright-mcp/**"
    - "!.phpunit.cache/**"
    - "!**/*.min.js"
    - "!**/*.min.css"
    - "!**/*.map"
    - "!composer.lock"
    - "!package-lock.json"
    - "!mix-manifest.json"
    - "!**/*.lock"

  # Project-specific guidance, mapped by path glob
  path_instructions:
    - path: "**/*.php"
      instructions: |
        PHP 8.4 / Laravel 11 codebase with a parallel legacy core.
        - Use PSR curly brace syntax: `if () { } else { }`, `foreach () { }`.
          NEVER use the alternative colon syntax (`if():` / `endif;` / `endforeach;`).
        - Legacy code in core/, shop/, cms/ uses snake_case functions and direct PDO is allowed.
        - New code under app/ uses Laravel conventions: camelCase methods, Eloquent, service providers.
        - Namespaces follow PSR-4 in composer.json (App\, Mtc\Core\, Mtc\Shop\, Mtc\Cms\,
          Mtc\Modules\, Mtc\Plugins\, MtcPharmacy\*).
        - Healthcare data (prescriptions, patient details, qualifying answers) is sensitive —
          flag any logging, plain-text storage, or external transmission of PII/PHI.
        - Flag SQL injection risks in raw PDO/DB::raw usage, missing CSRF tokens, and
          unsanitised user input rendered without escaping.

    - path: "**/*.twig"
      instructions: |
        Templates use Twig 3, NOT Laravel Blade.
        - Template filenames are snake_case.
        - When rendering `|raw` Twig content (e.g. from TinyMCE), wrap in `<div>`, not `<p>`.
        - Use `/sites/default/{{ variable }}` for asset paths — do NOT use Laravel's `asset()` helper.
        - Auto-escaping should remain enabled; flag any `|raw` on user-controlled input.
        - Template resolution order: sites/{SITE}/templates → sites/default/templates →
          modules/*/templates and plugins/*/templates → shop/templates → cms/templates → core/templates.

    - path: "**/*.{js,vue}"
      instructions: |
        Vue 2 + jQuery + Vuex frontend bundled by Vite 4.
        - NEVER use `var` — always `let` or `const`.
        - Do NOT introduce new jQuery usage; the project is migrating away from it.
          Prefer Vue components or vanilla JS for new work.
        - Path aliases available: `@site`, `@core`, `@components`, `@plugins`, `@shop`, `@site_scripts`.
        - Flag XSS risks: avoid `v-html` on user input, avoid `innerHTML` with untrusted content.
          `innerHTML` with server-rendered Twig HTML fragments (e.g. AJAX browse page swaps) is
          an accepted pattern — the HTML is trusted first-party output, not user input.

    - path: "**/*.less"
      instructions: |
        LESS filenames are snake_case.
        - `variables.less`, `core/css/mixins.less`, and `@site/css/base/mixins.less` are
          auto-prepended by Vite — do NOT manually `@import` them.
        - Brand variables live in `sites/default/css/variables.less`.

    - path: "database/migrations/**"
      instructions: |
        - Migrations should be reversible — flag missing `down()` implementations.
        - Flag destructive operations (dropColumn, dropTable) without explicit justification.
        - Index foreign keys; flag missing indexes on lookup columns.
        - For healthcare-sensitive columns, prefer encrypted storage (see sagalbot/encryptable).

    - path: "plugins/**"
      instructions: |
        Plugins are auto-discovered via loader.php / hooks.php and PascalCase directory names.
        - Payment gateway plugins (Realex, Judopay, EvoPay, RyftPay, Worldpay) handle card
          data — flag any logging of PAN/CVV, weak TLS, or hard-coded credentials.
        - Pharmacy-specific plugins (Prescriptions, QualifyingAnswers, Clinic, Bundles)
          handle PHI — flag any unencrypted storage or transmission.

    - path: "modules/**"
      instructions: |
        Two module types coexist:
        - Legacy modules: loader.php + hooks.php + templates/ (WordPress-style HooksAdapter).
        - Laravel modules: registered as ServiceProviders in config/app.php (e.g. Members).
        Match the existing pattern of the module being modified — do not mix styles.

    - path: "config/**"
      instructions: |
        Flag any hard-coded secrets, API keys, or production URLs. All secrets must come
        from environment variables via `env()` / `config()` — never inline.

    - path: ".env*"
      instructions: |
        Flag any committed real secrets. Only `.env.example` should be tracked, and it
        must contain placeholder values only.

    - path: "tests/**"
      instructions: |
        PHPUnit 10 with a non-standard bootstrap via `core/includes/header.inc.php`.
        - Feature tests may hit the legacy bootstrap — don't suggest pure Laravel TestCase
          conversions without checking the existing pattern.

    - path: "**/*.{yml,yaml}"
      instructions: |
        Validate YAML syntax and indentation. Flag hard-coded credentials in
        docker-compose.yml or any CI config.

  auto_review:
    enabled: true
    auto_incremental_review: true
    drafts: false
    # Bitbucket branching model from git_workflow_internal.md
    base_branches:
      - "master"
      - "release/.*"
    ignore_title_keywords:
      - "WIP"
      - "DO NOT MERGE"
      - "[skip review]"
      - "[skip ci]"
    labels: []

  # Tooling — enable static analysers relevant to this stack
  tools:
    phpstan:
      enabled: true
      level: "5"
    phpmd:
      enabled: false
    eslint:
      enabled: true
    biome:
      enabled: false
    yamllint:
      enabled: true
    markdownlint:
      enabled: true
    shellcheck:
      enabled: true
    hadolint:
      enabled: true
    gitleaks:
      enabled: true
    semgrep:
      enabled: true
    checkov:
      enabled: false
    languagetool:
      enabled: true
      level: default

chat:
  auto_reply: true

knowledge_base:
  opt_out: false
  learnings:
    scope: auto
  issues:
    scope: auto
  pull_requests:
    scope: auto

code_generation:
  docstrings:
    language: en-GB
