All the layers in one request
A raw HTTP request arrives. Your gateway parses it (networks), checks its signature, freshness and nonce (security), decrypts the AES-GCM body (security), runs the formula in a WebAssembly sandbox (wasm), and answers with a proper HTTP response — with the right status code for every way it can go wrong.
The order of checks
A gateway should reject bad requests as early and as cheaply as possible, and never do expensive or risky work for unauthenticated callers. Parse the HTTP first. Verify the signature, freshness and nonce next — cheap, and it stops strangers. Only then decrypt, and only after decryption succeeds, parse the JSON and run the sandboxed formula.
- Parse → 400 if malformed.
- Signature, timestamp, nonce → 401 if they fail.
- Decrypt → 400 if the ciphertext is invalid.
- Run the formula → 422 if it doesn't compile or traps.
- Success → 200 with the result.
Verifying before decrypting means attackers can't make you burn CPU on decryption, and can't probe your decryption with forged messages.