baseline

---
name: item-ownership
message: Only an item's owner or a superuser may read, change, or delete it.
---

## Rules

Every item route that reads, updates, or deletes one item confirms that the current user owns it or is a superuser
before returning or changing it. A missing item returns 404. Listing routes return only the caller's items unless the
caller is a superuser. The check may filter in the query or compare `owner_id` after loading; either way no foreign
item reaches the response or the write.

## Checks

Follow each route in `api/routes/items.py` from the item lookup to the response or commit.

---
name: superuser-routes
message: Declare superuser admission on every route that manages other users.
---

## Rules

Routes that list, create, update, or delete arbitrary users declare `Depends(get_current_active_superuser)` in their
route decorator. Routes under `/users/me` and `/users/signup` act on the caller and do not need it.
`read_user_by_id` lets a user read their own record and requires a superuser for anyone else.

## Checks

Review each route decorator in `api/routes/users.py`.

---
name: email-after-commit
message: Send account emails only after the user row is committed.
---

## Rules

Send an account email only after the user it describes is committed. `crud.create_user` commits before returning,
so an email sent after that call is safe. An email sent before it can announce an account that a failed insert never
created. Validation before the insert, such as the duplicate-email check, sends nothing.

## Checks

In `api/routes/users.py`, confirm every `send_email` call follows the commit of the user it names.