slhx agent
34 lines
2.2 KiB
Markdown
34 lines
2.2 KiB
Markdown
# hemx SaaS tutorial app
|
|
|
|
This is the compile-tested v1 production-shaped tutorial app. It intentionally uses an equivalent local persistence adapter and provider recipes as the supported v1 production boundary: auth/session, CSRF, SQLx persistence, deploy, metrics, flags, offline behavior, and islands are explicit app integrations, not hemx core services. Read the walkthrough in `../../docs/tutorial-saas.md`. req: examples/001 req: auth/001
|
|
|
|
What it proves:
|
|
|
|
- typed form/newtype inputs for project creation
|
|
- auth/session context passed through normal Rust state
|
|
- CSRF-safe mutation checked before persistence
|
|
- local atomic-file persistence adapter with rollback and process-restart proof instead of a vendored SQL/auth provider
|
|
- a bounded `POST /projects` reference boundary requiring the current bearer session, exact origin, CSRF token, and matching generated build fingerprint when supplied
|
|
- `/health/live`, dependency-aware `/health/ready`, and aggregate `/metrics` endpoints with secret-free structured diagnostics
|
|
- generated form, slot, keyed row, page-swap, and live-status commands
|
|
- page shell with plain CSS and one explicit metrics island script
|
|
- compile-time surface generation plus interaction tests
|
|
|
|
For provider-explicit boundaries, see `../../docs/recipes/sqlx-persistence.md`, `../../docs/recipes/auth-session-csrf.md`, `../../docs/recipes/observability-flags.md`, `../../docs/recipes/deploy-versioning.md`, and `../../docs/recipes/pwa-offline.md`.
|
|
|
|
What it deliberately keeps out of the tutorial crate:
|
|
|
|
- a vendored SQL/auth/metrics/flags/deploy provider dependency
|
|
- provider credentials, external services, migrations, or browser automation
|
|
- billing, account administration, or other SaaS platform scope
|
|
|
|
Database encryption, backups, retention, incident policy, and identity-provider compliance remain host responsibilities; hemx does not claim them as framework controls. Those production concerns belong in app adapters and recipes so the tutorial remains runnable in CI without external side effects. req: security/009
|
|
|
|
Run:
|
|
|
|
```sh
|
|
HEMX_SAAS_STORE=/tmp/hemx-saas-projects.tsv cargo run -p hemx-saas-example
|
|
cargo test -p hemx-saas-example --test production_reference
|
|
cargo test -p hemx-saas-example
|
|
```
|