The app inside

What happens inside the web app and the API: layers, sessions, caches, bookings and limits.

Part of the path: read these pages in order.

1. The layers of the API

   Why does a procedure never touch SQL, and where does the business logic live?

2. Sign-up, log-in and sessions

   Why does MiniTickets use server-side sessions instead of tokens in the browser?

3. Roles in the app

   How does the API decide that only an admin may create an event?

4. Errors

   How does a failure deep in the API become a message the user can understand?

5. The caching layers

   Which caches sit between a user and Postgres, and how does each one get cleared?

6. Bookings and row locks

   How do two people never get the last seat at the same moment?

7. Idempotency

   What happens when a user double-clicks Book or the network sends the request twice?

8. Search and pagination

   Why page with a cursor instead of OFFSET, and how does search-as-you-type stay cheap?

9. Rate limits and the sale-day gate

   How does MiniTickets survive a sale day without overselling or falling over?

10. Security headers

    What do the security headers protect against, and how do you check them?