Security and script localisation

[wppoland]

Just as a suggestion for admin-scripts.php:
1/ ensure the file cannot be accessed directly outside WP
2/ wp_localize_script to pass important dynamic data and JS to use the WP AJAX URL and securely verify requests with a nonce.

<?php

namespace TodoApp;

if (!defined('ABSPATH')) {
    exit;
}

add_action('admin_enqueue_scripts', __NAMESPACE__ . '\\scripts');

function scripts() {
    $screen = get_current_screen();

    if ($screen->id !== 'toplevel_page_todoapp') {
        return;
    }

    $admin_deps = require TODOAPP_PLUGIN_DIR_PATH . '/build/index.asset.php';

    wp_enqueue_script(
        'todoapp',
        TODOAPP_PLUGIN_DIR_URL . 'build/index.js',
        $admin_deps['dependencies'],
        $admin_deps['version'],
        true
    );

    wp_localize_script('todoapp', 'todoAppData', [
        'ajax_url' => admin_url('admin-ajax.php'),
        'nonce'    => wp_create_nonce('todoapp_nonce'),
    ]);
}

Czuwaj!