Package bff is the backend-for-frontend for the Model Bank apps.

It is the only server the thin clients talk to. It owns sessions and login, and turns banking data into screen-ready trees (package screen). Apart from health, the public login screen and login itself, every endpoint requires a session; the customer identity always comes from the session, never from the request.

The banking core is reached through the core package's CustomerQueries and Authenticator contracts (ADR-0002).

Package staff is the staff web of the Model Bank: the login (story 1.7.1), the pages a member of staff reads the bank through (accounting, products, customers, payments, treasury, reports, about and the documentation), the role the signed-in user holds and the PII authorisation that gate what they see, the layout every page is rendered in, and the simulation console when there is one (ADR-0002 stage 6, stories 1.6.3 and 1.6.4).

It reads the bank through core.StaffQueries, acts on it through core.Commands, checks logins through core.Users and drives the simulation through Console, and knows nothing else of it. The BFF mounts it beside the customer routes (bff.Config.Staff) and its sessions are kept in the BFF's store.

requireLogin serves the open paths as they are and every other with the session the request's cookie names, or sends the browser to the login page with the page it wanted to come back to. An HTMX request that has lost its session is told to load the login page whole.

errorBody is every error as a JSON client gets it: a stable code to switch on, what to tell the customer, and the screen to show with it when there is one (the login screen with its notice).

loginResponse is what a JSON client gets for a login: the session token to send back as a bearer, when the session ends whatever happens (it also ends after fifteen idle minutes), and the home screen, so the client has nothing more to fetch.

screenBody is a screen on its own, as the logout answers a JSON client.

EventRecord is one event on the bank's record (ADR-0011): something that happened at an instant, raised by someone, whose cascade is pending or done.

Leg is one side of a movement: the account and the balance it was left with, signed as the ledger holds it.

Movement is one ledger movement as written (ADR-0008): a signed amount from one account to another, the to account's balance rising by it and the from account's falling, with the balance each is left with, in the bank's view.

Action is what happens when the user taps a component. Exactly one of the fields is set.

Component is one element of a screen body. Type selects the component and which of the other fields are meaningful; unused fields are omitted from JSON.

Field is one input in a form.

Icon names a glyph. Clients map icons to their icon set.

Nav is the bottom tab bar.

Pair is a label/value line inside a hero or details component.

Screen is one app view.

Tab is one entry in the bottom tab bar.

Tone selects a colour treatment. Clients map tones to their theme.

AboutOwed is core.Owed as another program reads it.

AboutPosition is the bank's position: what the dashboard leads with.

AboutRestart is one row of the restart record, newest first, read with the row before it (see Restart).

AboutRoute is one route's figures since the process started, as internal/routestats keeps them: the count, the latency (last, p50 and p95 of the latest requests, the maximum ever), the most in flight at once and the rate over the last minute.

AboutSettings are the console settings.

AboutSim is the run as it is now, with the two rates a performance run reads: customers added per second (the live rate while a batch add runs, else the last batch's) and account days per 12h at the pass's measured whole-day rate, with the last day it is made of.

AboutStatus is the demo's state as another program reads it, at /about.json: the version and schema this process runs, the console settings, the run's position and the restart record. gobank-deploy's upgrade drill reads it before and after each redeploy to compare the position and read the downtime off the newest restart row.

AboutTable is one table's share of the database: its size on disk with indexes and TOAST, and its rows as PostgreSQL estimates them (as of the last ANALYZE; a count would scan the biggest tables).

SchemaVersion is the version a component's tables are at.

RFC 3339