# t5de-api

Go definitions shared by T5DE's proxy, hub and catalogs (see README.md, docs/pack.md). Part of T5DE; the proxy is
`t5de-proxy` (git.t5de.dev/t5de/t5de-proxy) and the design is in `t5de-hub`'s `docs/design.md`, both usually
checked out beside this one.

## Rules

- Never commit IMVU's code or files: no decompiled source, no product files from IMVU (not even as test data).
  Test fixtures are synthetic, built in the tests. Our own declarations of IMVU's formats are fine.
- Test with a throwaway IMVU account, never a real one.
- Commits: author "dhkatz <dev@t5de.dev>"; never the user's real name or email.
- Dependencies: the standard library, and bluemonday for `safehtml` (with its own dependencies). Ask before adding
  others.
- Descriptions are shown in the client's Gecko pages, which have chrome privileges: `safehtml` is an allowlist,
  never a blocklist. Every bypass found gets a test.

## Notes

- `gofmt`, `go vet ./...` and `go test ./...` must pass (CI checks them). `go test ./cfl -fuzz FuzzRead` fuzzes
  the CFL reader.