Server code

Everything in your app's page — index.html and the scripts and styles it loads — is sent to the browser of every person who opens it, and anyone can read it there. That is how every web page works.

server.js is different. It sits at the top of your app's folder, runs on Rudder.chat's servers, and is never sent to anyone. Only what its functions return leaves the server. Put there whatever is the value of your app or must not be seen or changed by the people using it:

• the app's rules and scoring, and anything a player must not be able to fake;
• answers, solutions and hidden game state;
• prices, formulas and other logic that took you work;
• calls to other services on the internet.

What needs no protecting — drawing the screen, animations, talking to the AI with th.chat.send — stays in the page.

Write a function

server.js is a JavaScript module. Each function the page can call is exported:

// server.js
export async function checkAnswer(args, ctx) {
  const found = await ctx.db.list("$answers", { where: { question: args.question } });
  const right = found.items.length > 0 && found.items[0].value.answer === args.answer;
  if (right) await ctx.db.add("scores", { player: ctx.user.id, points: 10 });
  return { right };
}

Call it from the page

const { right } = await th.server.call("checkAnswer", { question: "q1", answer: "Paris" });

args and what the function returns are JSON. When the function throws, th.server.call rejects with an Error carrying the same message — say why in your message, and the page can show it.

What a function gets

Private data

A collection whose name starts with $ — $answers, $deck, $rules — is read and written only by server.js. The page cannot read it with th.db, even yours.

Records server.js writes in an ordinary collection are read by everyone, as usual, but only server.js (or the app's builders) can change them — the person using the app cannot. Write a leaderboard from server.js after checking the score, and nobody can post a score they did not earn.

Test and live

While you build, your preview runs the server code you are working on, with the app's test data. Once the app is approved and published, people using it run the published server code, with its live data. Publishing reviews server.js with the rest of the app.

Limits

• One file, at most 200 KB. No import of other files and no npm packages: write what you need in the file.
• Per call: 100 ms of computing, 20 requests to the internet, 30 seconds in all; 64 KB sent to it and 1 MB returned.
• Up to 120 calls a minute per person.
• server.js follows the same rules as the rest of the app: it may not send people's data elsewhere, attack or spam other sites, or do work that has nothing to do with the app.