What a split app serves the apps it left: contracts, batch lookups and its event feed, each
call proven by a principal token signed with the keys every app of the deployment shares.
Answered as {items, page, size, has_next, sort, filter, query, controls, errors}, what a Table
links from; errors holds each filter whose value its field refuses, with its message’s key
and arguments, so a client area shows it in the viewer’s language.
A row of a package’s ROUTES table, named <crate>.<area>.<handler> once mounted;
mount is the route function adding it. sofie routes reads the tables without
compiling, so every row stays a call with literal arguments.
A path parameter naming a field filters too, so a child is listed only under its own parent.
Q reads the query’s other parameters, as crate::Query does; () reads none.
A GET’s query string read as Q, an Input checked as a body is: a refused value is a 422
with its field errors, a key Q has no field for a 400 unless it is a tracking key. Query
alone reads keys by name.
Encrypts small values with the app’s keys, each for one purpose: a value sealed for
one purpose never opens for another, and none opens without the keys.
A file received with the request, already in the app’s Storage. Only the framework makes
one, from a multipart/form-data body; a JSON body cannot name a stored file.
Implemented by a private type of each package whose job is signing principals in, such as
sofie-identity’s: it alone mints the SignInRight that Session::sign_in takes. Code that
implements it for a type of its own can sign anyone in, so only such a package should.
An aggregate is its own principal, owning its records; a marker such as sofie-identity’s
Permitted names the aggregate that signs in under another access.
As sofie gen writes them: the source language first, then each module’s
lang/<language>.toml files; enums by their enum.<name>.<variant> names, so badges
and selects show their variants translated.
With development, each template is read and parsed again whenever it or one of the module
components ((name, path)) is edited; otherwise its compiled program is loaded. A screen
keyed under another module than the one listing it replaces that module’s own.