Files

T

slhx agent 6f58453aae feat(saas): enforce strict response policy

req: security/006

req: operations/006

req: operations/008

2026-07-14 00:59:06 +02:00

src

feat(saas): enforce strict response policy

2026-07-14 00:59:06 +02:00

templates

feat(axum): expose hashed runtime asset path

2026-06-05 18:27:38 +02:00

tests

feat(saas): enforce strict response policy

2026-07-14 00:59:06 +02:00

build.rs

feat(examples): add saas tutorial skeleton

2026-06-05 09:15:57 +02:00

Cargo.toml

feat(axum): support axum 0.8 applications

2026-07-13 09:26:32 +02:00

README.md

feat(saas): enforce strict response policy

2026-07-14 00:59:06 +02:00

README.md

hemx SaaS tutorial app

This is the compile-tested v1 production-shaped tutorial app. It intentionally uses an equivalent local persistence adapter and provider recipes as the supported v1 production boundary: auth/session, CSRF, SQLx persistence, deploy, metrics, flags, offline behavior, and islands are explicit app integrations, not hemx core services. Read the walkthrough in ../../docs/tutorial-saas.md. req: examples/001 req: auth/001

What it proves:

typed form/newtype inputs for project creation
auth/session context passed through normal Rust state
CSRF-safe mutation checked before persistence
local atomic-file persistence adapter with rollback and process-restart proof instead of a vendored SQL/auth provider
a bounded POST /projects reference boundary requiring the current bearer session, exact origin, CSRF token, and matching generated build fingerprint when supplied
/health/live, dependency-aware /health/ready, and aggregate /metrics endpoints with secret-free structured diagnostics
generated form, slot, keyed row, page-swap, and live-status commands
page shell with plain CSS and one explicit metrics island script
compile-time surface generation plus interaction tests

For provider-explicit boundaries, see ../../docs/recipes/sqlx-persistence.md, ../../docs/recipes/auth-session-csrf.md, ../../docs/recipes/observability-flags.md, ../../docs/recipes/deploy-versioning.md, and ../../docs/recipes/pwa-offline.md.

What it deliberately keeps out of the tutorial crate:

a vendored SQL/auth/metrics/flags/deploy provider dependency
provider credentials, external services, migrations, or browser automation
billing, account administration, or other SaaS platform scope

Database encryption, backups, retention, incident policy, and identity-provider compliance remain host responsibilities; hemx does not claim them as framework controls. Those production concerns belong in app adapters and recipes so the tutorial remains runnable in CI without external side effects. req: security/009

Run:

HEMX_SAAS_STORE=/tmp/hemx-saas-projects.tsv cargo run -p hemx-saas-example
cargo test -p hemx-saas-example --test production_reference
cargo test -p hemx-saas-example