Download this file
| 1 | # đŸ¤– AGENTS.md: todo-rust |
| 2 | |
| 3 | The one rule: **the page works with JavaScript off.** Every action is a |
| 4 | plain HTML form POST answered with a 303. JavaScript only makes the same |
| 5 | requests without a page load; it never adds behaviour the server lacks. |
| 6 | |
| 7 | ## Tenancy |
| 8 | |
| 9 | - **One instance for the whole app** (`todo-rust.bfj.oncarlos.com`, one |
| 10 | SQLite file). |
| 11 | - **Each visitor's list is kept separately by an anonymous cookie** |
| 12 | (`todo_list`: 128 random bits, hex, `HttpOnly; SameSite=Lax; Path=/`, |
| 13 | `Secure` over https). Every query is scoped to the list that cookie |
| 14 | names; an id from another list answers 404. |
| 15 | - **No sign-in.** Losing the cookie loses the list. |
| 16 | - **Trust class C.** Todo text is stored as plain text in SQLite. That is |
| 17 | a deliberate choice for a demo app with anonymous lists, written down |
| 18 | here so nobody mistakes it for an oversight. |
| 19 | |
| 20 | ## Working here |
| 21 | |
| 22 | - Work only in `apps/rust/`. `BRIEF.md` and `CONTRACT.md` at the repo |
| 23 | root are binding. |
| 24 | - Servers bind `127.0.0.1` only. Scratch goes in `mktemp -d -p "$TMPDIR"`. |
| 25 | - Migrations only add (`src/db.rs`, keyed by `PRAGMA user_version`). |
| 26 | - Commits end with a `Co-Authored-By:` trailer naming the model. |
| 27 | |
amadan