Architecture

Architecture

Module	Role
main.rs	CLI: serve, invite, recover, backup, verify, restore, revoke-sessions, compact, openapi
config.rs	Environment configuration, public origin, trusted proxies
routes.rs	Router, meta/health, auth routes, OpenAPI assembly
auth.rs	Accounts, Argon2id, sessions, invitations, attempt limits, recovery
campaigns.rs, campaign_routes.rs	Campaigns, invitations, members, roles
content.rs, content_routes.rs, payload.rs	Items, visibility, revisions, receipts, change log, /sync
attachments.rs	Image uploads and downloads with checksums
vtt.rs, uvtt.rs	Table scenes, original map assets, grid/movement, templates and filtered live snapshots
combat.rs	Explicit initiative/turns, conditions, owner-only vitals and audience-filtered logs
events.rs	Content-free change notifications (SSE)
lifecycle.rs	Deletion of campaigns, own content and accounts
backup.rs	Backup, verification, restore
db.rs	Database opening, safe paths, migrations 001–012
error.rs	Error type; responses without internals

Request flow: proxy → origin/forwarded-header checks → bearer session → membership and role check → database work on a blocking thread in one transaction → JSON response.

Database: SQLite in WAL mode with full durability; the server identifies its archive with an application ID and refuses foreign or newer databases. Every write that changes visibility also appends to the change log read by /sync.