carlos / todomvc-bakeoff Public

Download this file

1	# 🤖 AGENTS.md: todo-nim
2
3	The bakeoff's TodoMVC, written in Nim, deployed to Carloku as `todo-nim`
4	on account `bfj` (`https://todo-nim.bfj.oncarlos.com`).
5
6	## The one rule
7
8	**The page works with JavaScript off.** Every action is a plain HTML form
9	that posts and gets a 303 back. JavaScript only makes the same requests
10	without a page load and swaps in the HTML the server renders. If a change
11	needs JavaScript to function, it's the wrong change.
12
13	## Tenancy
14
15	- **One instance for the whole app.** Every visitor shares one process
16	and one SQLite file.
17	- **Each visitor's list is kept separately by an anonymous cookie.** The
18	first visit gets a random 128-bit value in an `HttpOnly; SameSite=Lax`
19	cookie (`Secure` on Carloku). Every query is scoped to that list, and an
20	id from someone else's list answers 404. A cookie the app doesn't
21	recognise gets a fresh, empty list.
22	- **No sign-in.** Losing the cookie means losing the list.
23	- **Trust class C.** Todo titles are stored as plain text in SQLite, not
24	encrypted. That's a deliberate choice: the data is low-value, has no
25	owner identity attached, and a todo list doesn't justify key handling.
26
27	## Working here
28
29	- Source is in `src/`. `make test` runs the unit tests, `make build` the
30	local binary; the README has the rest.
31	- The CSS is `shared/base.css` and `shared/index.css`, embedded at compile
32	time and served byte for byte. Don't copy or edit them here.
33	- Migrations only add. Append a new entry to `migrations` in
34	`src/store.nim`; never edit or remove one that has shipped.
35	- Bind `127.0.0.1` only. Scratch goes in `$TMPDIR`.
36