amal66 turns Mike's backend into guarded domain modules

The fork reorganises a sprawling backend without changing what its 222 existing endpoints do.

infrastructureworkflow

amal66 has broken the backend into 16 domain-focused areas, separating the web-facing request handling from the business logic and database work behind it. The aim is less glamorous than a new feature, but useful: changes to chat, documents, projects and workflows should be easier to locate, review and test without disturbing unrelated parts of the product.

More importantly, the new boundaries are checked automatically. The test suite now rejects database queries in the web layer and blocks prohibited shortcuts between domains, while expanded tests cover the newly separated logic. That makes the reorganisation a maintained operating rule, rather than a diagram that fades once the next contributor is in a hurry.

For legal-tech teams extending Mike, this is a meaningful reduction in the risk and cost of future backend change.

So what Technical leaders considering Mike as a base product should care because a safer-to-change backend makes customisation and long-term maintenance more credible.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

1 commit from amal66/mike, oldest first. Source extracted verbatim from the harvested git log.

SHA Subject Author Date

bfb2466e refactor(chapter-10): split routes into modules with validation and access guards Amal 2026-05-24 ↗ GitHub

SHA	Subject	Author	Date
`bfb2466e`	refactor(chapter-10): split routes into modules with validation and access guards	Amal	2026-05-24	↗ GitHub
commit body Chapter: 10 - API boundaries. Plain-English map: Introduce a module layer for API routes, validate incoming request shapes with Zod, and add authorization checks around tabular document access. Why it matters: Large route files make it hard to see where trust boundaries are. Validation and access checks need to sit at the boundary before data reaches deeper code. Principle: Validate inputs and authorize data access close to the edge of the system. Precedent borrowed: Upstream PR #155 and the fork report's strongest security signal: multiple forks independently patched CWE-639 style tabular-document access bugs. Upstream base: willchen96/mike@d39f580. Original local commit: f913869.

commit body

Chapter: 10 - API boundaries.

Plain-English map:
Introduce a module layer for API routes, validate incoming request shapes with
Zod, and add authorization checks around tabular document access.

Why it matters:
Large route files make it hard to see where trust boundaries are. Validation
and access checks need to sit at the boundary before data reaches deeper code.

Principle:
Validate inputs and authorize data access close to the edge of the system.

Precedent borrowed:
Upstream PR #155 and the fork report's strongest security signal: multiple
forks independently patched CWE-639 style tabular-document access bugs.

Upstream base: willchen96/mike@d39f580.
Original local commit: f913869.

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-1383.md from inside the repo you want the changes in.

⬇ Download capture-thread-1383.md