dmvcframework-minimal-api

DMVCFramework — Minimal API

Routes are anonymous methods registered on a route group, not methods of a controller class. Same engine, same serializer, same ActiveRecord as the controller-based API — only the routing layer differs.

Everything below is copied from sources/MVCFramework.MinimalAPI.pas, sources/MVCFramework.Filters.pas and the samples. Do not invent names — the DSL does not follow ASP.NET spelling (there is no MapGroup, no app.Use, no OkResponse).

When in doubt about an API — verify it, never guess

Never invent an identifier or answer from memory. If you need a signature this skill does not cover, ask the user for the path to their DelphiMVCFramework checkout and read sources/ (and the matching samples/ project); failing that, read the official repository — sources · samples. If you still cannot verify it, say so. Where a skill and a sample disagree, the sample wins.

---

Delphi Language Target

Delphi 11 Alexandria or later — inline var declarations and for var loops are fine, and this skill's examples use them. Do not use Delphi 13 Florence-only syntax (NameOf, inline if expressions). For the language and the RTL themselves — version gating, lifetime, strings, generics, threading — load the delphi skill.

When to use

• New service where a controller class per resource adds no value
• Route-level filters/composition (auth per group, versioned prefixes)
• Web app with lambda handlers rendering TemplatePro views (.AsWeb)

Use the controller-based API (skill dmvcframework) when you want class-level inheritance, OnBeforeAction hooks, or the classic middleware chain as the primary mechanism.

---

REQUIRED REFERENCE — dmvcframework-security. Any endpoint that accepts input from a client (body, query string, header, cookie, upload, URL) must follow it: access control and IDOR, mass assignment, SQL injection, XSS, CSRF, path traversal, uploads, security headers, JWT, secrets. Invoke it whenever you write or review such an endpoint — not only when the user says "security".