Skip to content
Qirava lowercase logo

Quill docs

Secure DMS app boundary

Quill can render apps hosted by DMS workers, but frontend islands are not a secret boundary. Secrets belong in DMS governance/KMS/worker context. Island props are public page data and must never receive KMS values, signing secrets, DEKs, tenant seeds, or cross-tenant information.

Safe data flow#

DMS worker request
  ├─ L1/L2/L3 auth + planner checks
  ├─ planned KMS lookup for scoped worker env/secrets
  ├─ server render builds public HTML
  └─ island sidecar props contain ONLY public/client-safe state

Browser island
  ├─ reads sidecar props
  ├─ wires events in place
  └─ calls APIs again when it needs protected data
Server worker may see scoped secrets; browser islands may not
DataAllowed in workerAllowed in island props
public labels/theme stateyesyes
current user's display nameyes, after authyes, if intended for the page
API key / HMAC secretyes, scoped server-side onlynever
KMS DEK / master seedplanned KMS internals onlynever
another tenant's dataonly if L3 grants it (normally no)never

Pattern#

  1. Authenticate in the worker before-chain.
  2. Authorize reads/writes through the planner.
  3. Resolve any worker secret through the KMS boundary (planned).
  4. Render only public or user-intended state into HTML/sidecar props.
  5. For later protected actions, have the island call an authenticated worker route again.