The web framework your AI can't get wrong.

local t = require "effortless.types"

return {
  todos = {
    id = t.pk,
    user_id = t.ref "users",
    title = t.text { required = true },
    completed = t.boolean { default = false },
    created_at = t.now,

    indexes = { "user_id", "completed", "created_at" }
  }
}

local auth = require "effortless.auth"
local eql = require "effortless.eql"

function guard(request) return auth.check() end

function get(request)
  return { todos = eql "select todos where .user_id = $auth.id order by created_at desc" }
end

actions = {
  add    = eql.mutate "insert todos { title: $form.title, user_id: $auth.id }",
  toggle = eql.mutate "update todos set { completed: not .completed } where .id = $form.id and .user_id = $auth.id",
  delete = eql.mutate "delete todos where .id = $form.id and .user_id = $auth.id",
}

{{ layout "base" }}
{{ title = "Todos" }}
<div class="max-w:672 mx:auto py:32 px:16">
  <form method="POST" class="flex:between|center gap:8 mb:24">
    {{ csrf_field | raw }}
    <input type="hidden" name="action" value="add">
    <input name="title" value="{{ old.title }}" class="w:full px:16 py:8 b:#d1d5db|1 r:8" placeholder="New todo">
    <button class="px:16 py:8 bg:blue c:white r:8">Add</button>
  </form>
  {{ if errors.title }}<p class="c:#b91c1c f:14 mb:16">{{ errors.title }}</p>{{ /if }}
  {{ for todo in todos }}
    <form method="POST" class="flex:between|center py:8">
      {{ csrf_field | raw }}
      <input type="hidden" name="id" value="{{ todo.id }}">
      <span>{{ todo.title }}</span>
      <span class="flex gap:8">
        <button name="action" value="toggle" class="f:14 c:#4b5563">{{ if todo.completed }}undo{{ else }}done{{ /if }}</button>
        <button name="action" value="delete" class="f:14 c:#b91c1c">delete</button>
      </span>
    </form>
  {{ empty }}
    <p class="c:#6b7280">No todos yet.</p>
  {{ /for }}
</div>