Add code comments about field keys

[matthew-white]

At one point, app users were called "field keys". We've since updated the UI to talk about app users instead, and we've also updated the API (e.g., the …/field-keys endpoint is now the …/app-users endpoint). However, it didn't seem as useful to change the code. That means that app users are still called field keys in the code (in both Backend and Frontend). Mostly I think that's OK, but it also has the potential to lead to confusion (as @alxndrsn has pointed out). This issue is to add code comments to Backend and Frontend to clarify that "field keys" refer to app users. For example, a comment could be added to the FieldKey frame in Backend.

[alxndrsn]

It looks like there are two things currently being referred to as "field keys" in the code:

1. the FieldKey frame - which might be renamed as AppUser, and
2. the request.fieldKey property, which seems to be a session bearer token

Is this correct? Would 2 be accurately described as e.g. an "app user token"?

[matthew-white]

Would 2 be accurately described as e.g. an "app user token"?

That sounds pretty close. You can see request.fieldKey being added in fieldKeyParser() in lib/http/middleware.js. The only thing I'd add to your description is that we use the same mechanism for public links. Public links specify the session token using the st query parameter, which fieldKeyParser() also puts in request.fieldKey. For public links, fieldKeyParser() also rewrites request.originalUrl to a /v1/key URL, which is what we use for app users. So in total, I would say that request.fieldKey is "any session token specified in the URL" or "any session token that uses the same auth mechanism as app users."

the FieldKey frame - which might be renamed as AppUser

Unless it's overly confusing, I think we should just add code comments, not rename "field keys" to "app users" in the code. There are just too many references to "field keys". We're also getting close to starting on a redesign of how users work, including app users. I don't think we should try to rename things until after we complete that redesign, since a lot is about to change anyway.