Examples on backd

Blog

Mon, 01 Jan 0001 00:00:00 +0000

A small blog. Anyone can read published posts. Signed-in users write posts, keep drafts, and edit, publish, unpublish and delete their own. Each post shows when and by whom it was written, and its category. Clicking an author or a category lists only those posts, and both filters combine.

It shows the everyday use of backd: public and private documents in one collection, ownership, and posts signed with the writer’s own identity, all decided on the server by access rules. Unlike the expenses example, it doesn’t share documents between users, so rules cover everything it needs: it has no known holes, only the limits below. One page, above the post list, does need a server-side function: a count of every published post, and of the caller’s own, neither computable from what a reader may list.

Expenses without functions

Mon, 01 Jan 0001 00:00:00 +0000

A small group-expenses tracker in the style of Tricount or Splitwise. People create a group, invite others by email, record what they paid, and see who owes whom.

Unlike the blog, where each post belongs to its writer, here documents are shared between users, and some of the checks it needs involve more than one document. It is also a lesson in the limits of access rules. Its rules are as strict as rules can be today, and they still leave holes, because some checks need data from another document or logic on the server. Those holes are documented here on purpose: this is deliberately the “before” half of a pair. Expenses with functions is the “after” — the same app, same layout, with holes 1–4 closed by server-side functions, compared side by side with what changed and why. Hole 5 is closed by email verification in both: access here is by email address, so the address has to be the user’s own.

Expenses with functions

Mon, 01 Jan 0001 00:00:00 +0000

The same group-expenses tracker as expenses without functions, with the same layout, the same data model’s spirit, and the same rules where nothing needed to change — but holes 1 through 4 are closed, by five small functions instead of client-trusted copies. Hole 5 (signing up with someone else’s email) is closed too, but by email verification, not by functions: the realm requires a verified address, and rules and functions check user.email_verified.

Read expenses without functions first if you haven’t: this page assumes you know the five holes it documents, and spends its time on what’s different here and why.

Workshop tour

Mon, 01 Jan 0001 00:00:00 +0000

The functions cookbook explains each function of the workshop realm. The workshop tour lets you use them: one page, one panel per feature, and an inspector beside it that shows every call the page makes, so you see what the browser sent and what backd answered.

It is part of the local stack (make example, then https://localhost:8443/example/workshop/). The page is plain JavaScript on backd-js, with no build step, in clients/js/examples/workshop; the realm is examples/config/workshop.