# Auditing Business Logic

> Analyzes authentication flows, authorization rules, middleware logic, and side-effects. Use when extracting business rules, Passport configurations, or mailer logic from an Express application.

- Skill: `googlecloudplatform/auditing-business-logic` (Agent Skill)
- Install (CLI): `npx skillmds@latest add googlecloudplatform/auditing-business-logic`
- Raw SKILL.md: https://api.skillmd.com/api/skills/googlecloudplatform/auditing-business-logic/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: GoogleCloudPlatform (https://skillmd.com/u/googlecloudplatform)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/googlecloudplatform/auditing-business-logic

---


# Auditing Business Logic & Side-Effects

Analyze the implicit "rules" and external behaviors of a legacy application to ensure they are accurately replicated in the modern architecture.

## Objective
Reverse-engineer the application's authentication flows, authorization logic (RBAC/ABAC), and any asynchronous side-effects (Mailers, External APIs, File Storage).

## Instructions for the Audit Subagent

Copy this checklist and track your progress:
```
Task Progress:
- [ ] Step 1: Analyze AuthN & AuthZ Flows
- [ ] Step 2: Map Side-Effects (External APIs, Mailers)
- [ ] Step 3: Analyze Global Middleware
- [ ] Step 4: Draft Modernization Advisory
- [ ] Step 5: Generate Business_Logic_Rules.md
```

### Step 1. Analyze AuthN & AuthZ Flows
- **Authentication (AuthN)**: Locate Passport, session, or JWT configurations (e.g., `config/passport.js`). Document the login strategies (Local, OAuth, etc.) and required fields.
- **Authorization (AuthZ)**: Document the logic used for access control. How does the system verify a user's role or ownership of a **Primary Resource**? (e.g., `requiresRole('admin')` or `isOwner(resource_id)`).

### Step 2. Map Side-Effects
Identify actions that occur outside of the primary request/response cycle:
- **External Services**: Check `package.json` and controllers for Stripe (Payments), Twilio (SMS), SendGrid (Email), etc.
- **Mailers**: Audit the `mailer/` or `services/email/` directory. Does creating a resource trigger an automated notification?
- **File Storage**: Locate file upload configurations (e.g., Multer). Determine where assets are stored (Local Disk vs Cloud Storage).

### Step 3. Analyze Global Middleware
Examine `app.js` or `config/express.js`. Document global middlewares such as `helmet`, `cors`, custom loggers, or `csurf`. Determine which remain relevant for a modern Next.js API.

### Step 4. Provide Modernization Advisory
Flag potential pitfalls for the modern stack (e.g., Next-Auth vs Passport). Recommend modern equivalents for legacy side-effects (e.g., moving from local file storage to S3/Uploadthing).

### Step 5. Generate Business_Logic_Rules.md & Identify Probes
Compile findings into `docs/legacy-audit/Business_Logic_Rules.md`. Additionally, **identify specific logic-parity probes** (e.g., "Attempt to submit a form without the required OAuth session to verify the redirect loop matches legacy"). **Append** these logic-specific test cases to `docs/verification/Verification_Plan.md`.