Can we have a sample with allowed hosts, cors, auth, input validation, open api docs, request logging with true IP addresses, XSRF/CSRF attack protection and so on?
The 2000s called and want their "Pet Store" back!
It is pretty much industry standard within the C# and Java community to provide Open API docs. It also displays the flaws of the API designs at an early stage. Stops one from going live with something embarrassingly bad as the Hashicorp API:s for instance.
It's really easy to think you've got it all figured out when it's just running on your local machine or a private network or to quote Mike Tyson "Everyone has a plan until they get punched in the mouth."
This experience has reinforced for me how critical getting CI/CD is to the process of taking something from a sketch pad to something that no only ships but other people can work on. Not saying that has to be a huge production, but it's just as crucial as how to post a form or connect to a data source. Looking at you JS bros that think they can cobble together an ORM that won't be a massive chore.
Also keep in mind that 99% of this seems[1] to have been made by 1 guy (Sean Walker), I think in his free time.
[0]: https://github.com/swlkr/janetdocs
[1]: https://github.com/joy-framework/joy/graphs/contributors
More pages are here: https://github.com/joy-framework/joy/tree/master/docs#readme
PS: I did a very minor contribution to Joy once, so minor that I actually forgot about it :) I don't use Joy myself at the moment as I'm using my own framework, but the Joy docs + source code helped me out a lot in figuring out how to do authentication, csrf, etc!