Architecture overview

Unforgett follows single source of truth: hono-backend owns rules and data; apps render and call HTTP.

  [ vite-frontend ] [ admin-frontend ] [ unforgett-app ] [ extension ] [ CF worker ]
                              |
                              v
                         index.ts  (CORS + route map)
                              |
                         middleware/
                              |
                          routes/
                         /    |    \
                   validators  services
                              |
                          models/
                              |
                         MongoDB

Request path (one sentence per step)

1. Client builds HTTP request + JSON body.
2. index.ts applies CORS, picks router by URL prefix.
3. Middleware may require login, admin, or internal key.
4. Route validates input (Zod), calls service.
5. Service enforces business rules, reads/writes via models.
6. Route returns JSON DTO to client.

What does NOT belong in frontends

• “Can this user review this card today?” → service + DB
• SRS interval math → scheduler services
• Admin-only mutations → admin routes + middleware
• Notification send rules → notification services

Frontends may hint UX (disable a button) but the server must reject illegal actions.

Related pages

• Layers
• Route map
• Who calls the API
• API rate limiting — policies, admin UI, env vars, 429 behavior