- Core app entrypoint lives in
app.py; configuration is centralized inconfig.py. - HTTP handlers are grouped in
routes/(auth, admin, API, opt-out) and business logic inservices/. - Data access helpers sit in
models/andutils/database.py; shared utilities (censoring, rate limits, Discord) live inutils/. - Templates reside in
templates/with static assets instatic/; docs for integrations are underdocs/. - Tests belong in
tests/(test_*.py). Keep new scripts alongside existing tools (e.g.,generate_opt_out_links.py,import_users.py) in the repo root.
- Install deps:
pip install -r requirements.txt(recommend a venv). - Run the app locally:
python app.py(reads.envor environment variables; defaults to dev mode). - Containerized run:
docker-compose up --buildto start the web app (and Discord bot if enabled) on port 3000. - Lint/format: no enforced tool in repo; if adding one, document it in this file and CI.
- Tests:
python -m pytestfrom the repo root.
- Follow Python PEP 8 (4-space indentation, snake_case for functions/modules, PascalCase for classes).
- Keep route handlers thin; put validation/business rules in
services/ormodels/. - Prefer explicit imports and type hints for new code; keep docstrings concise and action-oriented.
- Avoid committing secrets; load configuration from
.env(copy from.env.example) or environment variables.
- Use
pytest; place new tests undertests/mirroring module names (tests/test_auth.pystyle). - Cover happy path and failure cases for new routes/services; mock external calls (Google, Discord, PostHog) rather than hitting live APIs.
- When adding DB changes, include a lightweight fixture or helper to set up/tear down temp tables if needed.
- Commit history favors short, present-tense summaries (e.g.,
use workos for auth). Keep messages imperative and under ~72 characters. - For PRs, include: goal/summary, key changes, how to run/verify (
python app.py,python -m pytest), and any schema or .env updates. - Add screenshots or curl examples for UI/API changes; link related issues/tickets where applicable.
- Set
SECRET_KEYand OAuth/Discord tokens via environment variables; never commit secrets orusers.db. - Production expects
PROD=TRUEand HTTPS; review CSP and rate-limit settings inapp.pywhen exposing new endpoints.