Middleware Backend playbook — how to build processors and workers

Job: talk to third parties (Paystack, Resend, GuestTraction, S3), then save results on Core Backend. One folder per processor under src/routes/. Enable in config/routes.json.

IDOR: enforce here (JWT vs booking/property) and on Core Backend path settings. The frontend browse key is public — do not rely on Vue.

Do not persist bookings or properties in Mongo. The WIP branch feature/core-booking-platform-endpoints does this — do not follow it.

How to implement a folder

1. Add src/routes/<name>/ (module, controller, service, dto).
2. Register in ROUTE_REGISTRY (src/common/loaders/feature-loader.ts).
3. Toggle in config/routes.json with mountPath.
4. Contract: specs/middleware/v1/openapi.yaml.
5. After a processor succeeds, POST/PUT Core Backend entities with the same guest/owner JWT (or a service key that still cannot impersonate another user).

Playbooks

Page	Kind
Processors and workers	Map of HTTP, webhooks, scheduled jobs
Availability	Sync check (to implement)
Payments	Init + webhook
Refunds	PSP refund
Emails	Guest + owner mail
Google rates / ARI	Push / pull
File manager	Live S3 presign

Frontend calls only the winner URLs on those pages. Internal workers are not frontend routes.

Winner rule

If you add a route that replaces a Core Backend call (example: upload property), frontend playbooks must switch to Middleware Backend. Propose that on /next first.