Following a request

What happens between choosing Update on a page and seeing it saved, step by step. A script’s request takes the same path, with a token where the browser has a cookie.

sequenceDiagram
  participant B as Browser
  participant C as caddy
  participant A as app
  participant D as db
  B->>C: PUT /api/pages/{id} (HTTPS)
  C->>A: forwarded, with the address it came from
  A->>A: who is this? (cookie or token)
  A->>A: limits, CSRF header, token scope
  A->>D: may this person edit this page?
  D-->>A: yes
  A->>D: save a new version
  A-->>B: 200, the page as saved
  A--)A: afterwards: notifications, webhooks

1. Caddy takes the HTTPS connection and passes the request to the app, adding the address it came from. The app believes that address only from the private network Caddy is on, and only the entry Caddy adds, so a caller cannot claim to be someone else.

2. Who is asking. A browser sends its session cookie; a script sends an API token as Authorization: Bearer. Either way the app ends up with one person, and from then on treats them the same.

3. Checks that apply to everyone: rate limits on signing in and on anonymous requests; for a browser, the X-Requested-With: Tesria header that other websites cannot send (so they cannot act with your session); for a token, whether it is read-only, and that it is not trying to manage its own account.

4. Permission. Each request then asks the permission service the question it needs: may this person view this space, edit this page, use this right? Anything they may not see answers 404, exactly like something that does not exist. See Who can see what, in the code.

5. The work. A page update checks the version it started from (a mismatch is 409), saves a new, permanent version, and writes the audit log for anything administrative.

6. Afterwards, without holding up the answer: notifications to watchers, emails, and webhook calls to other programs.

The web pages themselves are served by the same app: every address that is not /api or /mcp gets the React application, which then asks the API for what it shows.