Compact joins, public UUIDs
Daptin keeps integer keys inside the database and exposes indexed UUIDv7 references to clients. Relationships stay compact without making sequential row IDs part of your public API.
Engineering
How Daptin handles data integrity, access, and operations.
Daptin is shaped by twelve years of backend engineering experience. Your application starts with working decisions for identity, data integrity, access, concurrency, resource control, and operations—not a pile of endpoints to harden later.
- Safer data
- Bounded resources
- Operable runtime
01
Data integrity
Relationships checked before write
A related record must exist, and the caller must be allowed to refer to it. Invalid or unauthorized links are rejected before they become stored data.
Database changes move together
Core record changes share a transaction, so related rows, permissions, and database-side history normally commit together or roll back together.
Constraints created from the model
Daptin generates database structures for indexed fields, unique values, composite keys, timestamps, and join-table uniqueness. Verify the physical DDL after import because the latest release can log and continue after some schema errors.
02
Request protection
Values stay values
Daptin parameterizes ordinary query values and validates supported sorting and aggregation inputs, keeping request data separate from SQL structure.
Access follows the data
Guest, user, owner, group, action, and relationship permissions are evaluated centrally. Permission-changing writes also invalidate the relevant authorization caches.
Traffic is bounded early
URL rate limits and active-request limits run before application handlers. Cluster members share rate counters through Olric and retain a local fallback.
Database pressure is controlled
Open and idle connections are capped, reused, and aged. One traffic burst does not create an unlimited number of database connections.
03
Identity and sessions
Passwords are hashed with bcrypt. Changing a password advances the account's authentication version and invalidates earlier session caches, so old tokens do not simply remain valid after a credential change.
OAuth provider flows validate registered redirects and scopes, make authorization codes single-use, support PKCE, and rotate refresh tokens. Connected credentials remain associated with the user and provider that owns them.
Read the authentication model →04
Delivery and operations
File delivery and caching
ETags avoid retransmitting unchanged assets. Compression uses representation-specific cache identities, while large files can stream instead of filling process memory.
Mail queues and retries
Daptin stores outgoing mail before a worker sends it. Failed attempts time out and return to the queue with backoff. A message may be sent more than once, but it is not lost when the process restarts.
Contained file paths
FTP paths are normalized and checked against their configured root, including resolved symlinks, before the server trusts them.
Runtime visibility
Process liveness, web activity, database-pool state, host resources, and application statistics are available to the people operating the server.