Module concerns 

Common concerns for frontend routes

Structs

EntryDownload

A file download served with a Content-Disposition filename derived from the document’s entry name (e.g. 0811.0417.zip) instead of the opaque task id in the URL — so corpus curators get an informative filename (UX request 2026-06-16). Wraps a NamedFile and adds the header.

LiveReportLimiter

Bounds how many expensive live (?all=true) report aggregations run at once so a burst can’t saturate the frontend connection pool and 503 other requests (KNOWN_ISSUES P-2, owner-chosen mitigation). A permit is acquired before a pooled connection is checked out, and the (N+1)th expensive request waits asynchronously (no worker thread or DB connection held) rather than being rejected — it changes no result and rejects nothing, pure blast-radius isolation (DESIGN_PRINCIPLES #6). Cheap rollup-backed and paged reports never take a permit.

Constants

MAX_CONCURRENT_LIVE_REPORTS

Default cap on concurrent expensive live (?all=true) report aggregations (KNOWN_ISSUES P-2). Each such request holds a pooled connection for its whole multi-second run, so without a bound a burst can exhaust the pool (default 32) and 503 every other request. Four lets a small flurry through while leaving the bulk of the pool for cheap rollup-backed traffic.

UNKNOWN

Placeholder word for unknown filters/fields

Functions

entry_download

GET twin of entry_fetch for plain downloadable links (browser-native <a download>), used by the run-diff “Task severity changes” table to offer each entry’s source archive without the jQuery/AJAX entry-submit downloader. Reuses serve_entry; same 404-not-500 discipline on an unknown task or a missing/unreadable archive.

entry_fetch

Downloads a converted document’s result archive (streamed, so a large archive never loads into memory). 404 when the task is unknown or the archive is missing/unreadable on /data — a hostile or unmounted filesystem yields a clean 404, never a panic or a 500.

pause_all

Human pause all conversions — block every in-progress task fleet-wide so the dispatcher stops leasing new work everywhere. Cookie-gated; redirects to /admin. Agent twin: POST /api/conversions/pause.

pause_run

Human pause run — block every in-progress task of a (corpus, service) so the dispatcher stops. Cookie-gated; a plain form POST that redirects back to the report so the admin sees the new state (401 without a session). The agent twin is POST /api/reports/<c>/<s>/pause.

preview_entry

The per-article preview screen: renders a shell whose converted-document asset is fetched client-side from the download URL. 404 on an unknown corpus / service / document.

rerun_category

Human rerun — scoped to a severity/category.

rerun_corpus

Human rerun — whole (corpus, service). Cookie-gated; the rerun modal XHRs a JSON {description}.

rerun_get_redirect

A stray GET to a rerun URL — which is a POST-only mutation (the rerun modal issues a cookie-gated XHR POST) — used to dead-end at a confusing 404: e.g. a copied/bookmarked form action, or a stale tab navigated directly. Redirect it to the matching report page, where the rerun control lives, instead. 303 See Other, so the browser switches to a GET. The trailing <scope..> captures the optional severity[/category[/what]] segments and matches zero segments too, so the bare /rerun/<c>/<s> (rerun-all) is covered by this single route — a separate 2-segment route would collide with it and abort Rocket at ignite.

rerun_severity

Human rerun — scoped to a severity.

rerun_what

Human rerun — scoped to a severity/category/what.

resume_all

Human resume all conversions — return every Blocked task fleet-wide to TODO. Cookie-gated; redirects to /admin. Agent twin: POST /api/conversions/resume.

resume_run

Human resume run — return every Blocked task of a (corpus, service) to TODO. Cookie-gated; form POST that redirects back to the report. The agent twin is POST /api/reports/<c>/<s>/resume.

routes

The document-serving + human rerun/save-snapshot route set, migrated out of bin/frontend.rs onto the pooled, testable library surface.

savetasks

Human save-snapshot: freezes the current per-task statuses into historical_tasks. Cookie-gated (401 without a session); 404 on an unknown corpus/service.

serve_entry

Provide a downloadable file for an entry, looking the task up over the caller-supplied (pooled) connection (the borrow ends before the file open). The download is named from the report’s “Entry” name + the served file’s real extension (not the opaque task id): <document>.<ext> for the import source archive, <document>_<service>.<ext> for a result archive.

serve_entry_preview

Serves an entry as a Template instance to be preview via a client-side asset renderer, over the caller-supplied (pooled) connection.

serve_pause_resume

Pause (pause = true) or resume a whole (corpus, service) run, over the caller-supplied (pooled) connection, attributed to the authenticated owner. Pause blocks every in-progress task (status >= 0 → Blocked) so the dispatcher stops leasing them; resume returns every Blocked task to TODO so the dispatcher picks them up again — the inverse pair. 404 on an unknown corpus/service, 500 if the status update fails; on success returns the number of tasks affected. Shared by the human POST /{pause,resume}/<c>/<s> (cookie) and the agent POST /api/reports/<c>/<s>/{pause,resume} (token) — one core, identical effect.

serve_pause_resume_all

Pause or resume all conversions globally — the dashboard’s “Pause/Resume all conversions”. The global twin of serve_pause_resume: across every (corpus, service), pause blocks every in-progress task and resume returns every Blocked task to TODO. Returns the number of tasks moved. Audited by the fairing; fully reversible (the inverse action restores TODO).

serve_report

Prepare a configurable report for a <corpus,server> pair, reading over the caller-supplied (pooled) connection — no per-request fresh Backend::default(). 404 on unknown corpus/service.

serve_rerun

Rerun a filtered subset of tasks for a <corpus,service> pair, over the caller-supplied (pooled) connection, attributed to the already-authenticated owner (the signed-in admin — the route gates on the crate::frontend::actor::AdminSession cookie, so there is no token here). 404 on an unknown corpus/service, 500 if the rerun marking fails.

serve_savetasks

Save the historical tasks of a corpus run, for reference, for a <corpus,service> pair. Auth is the signed-in crate::frontend::actor::AdminSession cookie (gated at the route). 404 on an unknown corpus/service.