writeonce/docs/examples/web-app/README.md

web-app — the storefront sample

A small store: Product/Order as @table classes, JSON routes, one auth middleware — built on porch, which it imports through [deps] (iteration 15). This app is iteration 16's acceptance workload: just web-app runs the whole chain — fetch → lock → build → serve → curl matrix → restart persistence → SIGTERM.

Routes

Route	What
GET /products	list (JSON array)
GET /products/:id	one product or 404
POST /products	create from a JSON body (name, price, stock); 400 on malformed JSON; 409 on a duplicate name (@unique)
POST /orders	create (product, qty); FK checked
DELETE /products/:id	409 while orders reference it (FK restrict), 200 after

Every request needs authorization: Bearer <token> (the auth middleware); the token comes from the WA_TOKEN env var.

Run

woc .                       # fetches deps, builds target/web-app
WA_TOKEN=secret WO_DATA=./data ./target/web-app 8080

TLS / HTTP2

This sample runs plaintext behind nginx/caddy — the proxy terminates TLS+ALPN and speaks h2 to browsers while this backend serves HTTP/1.1 keep-alive. The runtime itself can now terminate TLS 1.3 (net.accept_tls, runtime-v2 9, 2026-09-09; see docs/examples/tls-server), so the proxy is a deployment choice here, not a requirement — HTTP/2 is the remaining reason to keep it. Sketch:

server {
  listen 443 ssl;
  http2 on;
  location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
  }
}