Skip to content

Commit a402db8

Browse files
yash-pouranikyash-pouranik
committed
updated the architecture diagram
1 parent 253237d commit a402db8

1 file changed

Lines changed: 103 additions & 50 deletions

File tree

‎ARCHITECTURE_DIAGRAM.md‎

Lines changed: 103 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -15,38 +15,55 @@ graph TB
1515
COMPS["Components\nNavbar / Modals / Tables / Charts"]
1616
end
1717
18-
subgraph Backend["⚙️ Backend — Express.js\nRender / Railway"]
19-
APP["app.js\nEntry Point"]
18+
subgraph DashboardAPI["🔐 Dashboard API — Express.js\nadmin.urbackend.com\nPort: 1234"]
19+
DASH_APP["app.js\nDashboard Entry Point"]
2020
21-
subgraph Middleware["🛡️ Middleware"]
21+
subgraph DashMiddleware["🛡️ Dashboard Middleware"]
2222
RL_DASH["dashboardLimiter\n1000 req / 15 min"]
23-
RL_API["apiLimiter\n(limiter)"]
24-
CORS_ADMIN["adminCorsOptions\nWhitelist CORS"]
23+
CORS_ADMIN["Strict CORS\nWhitelist: Frontend URL only"]
2524
AUTH_MW["authMiddleware\nJWT (Developer)"]
26-
API_MW["verifyApiKey\nHashed API Key + Redis Cache"]
2725
VERIFY_EMAIL["verifyEmail\nOwner isVerified check"]
28-
LOGGER["logger\nAPI usage logger"]
2926
end
3027
31-
subgraph Routes["📡 Routes"]
28+
subgraph DashRoutes["📡 Dashboard Routes"]
3229
R_AUTH["/api/auth"]
3330
R_PROJ["/api/projects"]
31+
R_RELEASES["/api/releases"]
32+
end
33+
34+
subgraph DashControllers["🧩 Dashboard Controllers"]
35+
C_AUTH["auth.controller\nregister / login\nchange-password / delete\nsendOtp / verifyOtp"]
36+
C_PROJ["project.controller\ncreateProject / updateProject\ncreateCollection / deleteCollection\ngetData / insertData / editRow\ndeleteRow / uploadFile / listFiles\ndeleteFile / analytics\nupdateExternalConfig"]
37+
end
38+
end
39+
40+
subgraph PublicAPI["🌍 Public API — Express.js\napi.urbackend.com\nPort: 1235"]
41+
PUBLIC_APP["app.js\nPublic Entry Point"]
42+
43+
subgraph PublicMiddleware["🛡️ Public API Middleware"]
44+
RL_API["apiLimiter\n(limiter)"]
45+
CORS_PUBLIC["Open CORS\nProject-based validation"]
46+
API_MW["verifyApiKey\nHashed API Key + Redis Cache"]
47+
LOGGER["logger\nAPI usage logger"]
48+
end
49+
50+
subgraph PublicRoutes["📡 Public Routes"]
3451
R_DATA["/api/data"]
3552
R_UAUTH["/api/userAuth"]
3653
R_STORE["/api/storage"]
3754
R_SCHEMA["/api/schemas"]
3855
end
3956
40-
subgraph Controllers["🧩 Controllers"]
41-
C_AUTH["auth.controller\nregister / login\nchange-password / delete\nsendOtp / verifyOtp"]
42-
C_PROJ["project.controller\ncreateProject / updateProject\ncreateCollection / deleteCollection\ngetData / insertData / editRow\ndeleteRow / uploadFile / listFiles\ndeleteFile / analytics\nupdateExternalConfig"]
57+
subgraph PublicControllers["🧩 Public Controllers"]
4358
C_DATA["data.controller\ninsertData / getAllData\ngetSingleDoc / updateSingleData\ndeleteSingleDoc"]
4459
C_UAUTH["userAuth.controller\nsignup / login / me"]
4560
C_STORE["storage.controller\nuploadFile / deleteFile\ndeleteAllFiles"]
4661
C_SCHEMA["schema.controller\ncheckSchema / createSchema"]
4762
end
63+
end
4864
49-
subgraph Utils["🔧 Utils / Services"]
65+
subgraph SharedCommon["📦 @urbackend/common\nShared Package"]
66+
subgraph Utils["🔧 Shared Utils / Services"]
5067
CONN_MGR["connection.manager\nBYOD DB connections\n(registry cache)"]
5168
INJECT["injectModel\nDynamic Mongoose Model"]
5269
QUERY["queryEngine\nDynamic Query Builder"]
@@ -68,16 +85,20 @@ graph TB
6885
end
6986
7087
DEV -->|"Browser"| Frontend
71-
EXTAPP -->|"x-api-key header"| R_DATA & R_UAUTH & R_STORE & R_SCHEMA
72-
73-
Frontend -->|"JWT Bearer Token"| R_AUTH & R_PROJ
74-
APP --> Routes
75-
R_AUTH --> AUTH_MW --> C_AUTH
76-
R_PROJ --> AUTH_MW --> VERIFY_EMAIL --> C_PROJ
77-
R_DATA --> API_MW --> LOGGER --> C_DATA
78-
R_UAUTH --> API_MW --> LOGGER --> C_UAUTH
79-
R_STORE --> API_MW --> LOGGER --> C_STORE
80-
R_SCHEMA --> API_MW --> LOGGER --> C_SCHEMA
88+
EXTAPP -->|"x-api-key header"| PublicAPI
89+
90+
Frontend -->|"JWT Bearer Token"| DashboardAPI
91+
92+
DASH_APP --> DashRoutes
93+
R_AUTH --> CORS_ADMIN --> AUTH_MW --> C_AUTH
94+
R_PROJ --> CORS_ADMIN --> RL_DASH --> AUTH_MW --> VERIFY_EMAIL --> C_PROJ
95+
R_RELEASES --> CORS_ADMIN --> C_PROJ
96+
97+
PUBLIC_APP --> PublicRoutes
98+
R_DATA --> CORS_PUBLIC --> API_MW --> LOGGER --> C_DATA
99+
R_UAUTH --> CORS_PUBLIC --> API_MW --> LOGGER --> C_UAUTH
100+
R_STORE --> CORS_PUBLIC --> API_MW --> LOGGER --> C_STORE
101+
R_SCHEMA --> CORS_PUBLIC --> API_MW --> LOGGER --> C_SCHEMA
81102
82103
C_AUTH --> MONGO_MAIN
83104
C_PROJ --> CONN_MGR
@@ -86,6 +107,9 @@ graph TB
86107
C_STORE --> STORE_MGR
87108
C_SCHEMA --> CONN_MGR
88109
110+
DashboardAPI -.->|"Uses"| SharedCommon
111+
PublicAPI -.->|"Uses"| SharedCommon
112+
89113
CONN_MGR -->|"isExternal: false"| MONGO_MAIN
90114
CONN_MGR -->|"isExternal: true\n(decrypt config)"| MONGO_EXT
91115
STORE_MGR -->|"isExternal: false"| SUPABASE
@@ -100,16 +124,20 @@ graph TB
100124

101125
## 2. API Request Flow — External App (API Key)
102126

127+
**Public API Server Flow**
128+
103129
```mermaid
104130
sequenceDiagram
105131
participant App as External App
132+
participant PublicAPI as Public API Server
106133
participant MW as verifyApiKey Middleware
107134
participant Redis as Redis Cache
108135
participant DB as MongoDB (Projects)
109136
participant Ctrl as Controller
110137
participant DataDB as Data DB (Internal / External)
111138
112-
App->>MW: Request with x-api-key header
139+
App->>PublicAPI: Request with x-api-key header
140+
PublicAPI->>MW: Route to middleware
113141
MW->>Redis: Lookup hashed API key
114142
alt Cache hit
115143
Redis-->>MW: Return cached project
@@ -122,7 +150,8 @@ sequenceDiagram
122150
MW->>Ctrl: req.project attached → next()
123151
Ctrl->>DataDB: Query (internal or external via connection.manager)
124152
DataDB-->>Ctrl: Results
125-
Ctrl-->>App: JSON Response
153+
Ctrl-->>PublicAPI: JSON Response
154+
PublicAPI-->>App: JSON Response
126155
```
127156

128157
---
@@ -257,48 +286,72 @@ graph TD
257286

258287
## 6. Security & Rate Limiting
259288

260-
| Layer | Mechanism | Limit / Detail |
261-
|---|---|---|
262-
| Dashboard routes (`/api/auth`, `/api/projects`) | `dashboardLimiter` | 1000 req / 15 min |
263-
| API consumer routes | `limiter` (custom) | Configurable |
264-
| Developer auth | JWT (`authMiddleware`) | Bearer token, signed per dev |
265-
| API consumer auth | `verifyApiKey` | SHA-256 hashed key + Redis cache |
266-
| Email verification gate | `verifyEmail` | `owner.isVerified` must be `true` |
267-
| CORS | `adminCorsOptions` | Whitelist: `urbackend.bitbros.in` only |
268-
| Credential storage | AES-256-GCM encryption | BYOD DB/Storage configs encrypted in MongoDB |
269-
| File uploads | `multer` memory storage | 10 MB per file limit |
289+
| Server | Layer | Mechanism | Limit / Detail |
290+
|---|---|---|---|
291+
| **Dashboard API** | Dashboard routes | `dashboardLimiter` | 1000 req / 15 min |
292+
| **Dashboard API** | Developer auth | JWT (`authMiddleware`) | Bearer token, signed per dev |
293+
| **Dashboard API** | Email verification gate | `verifyEmail` | `owner.isVerified` must be `true` |
294+
| **Dashboard API** | CORS | Strict whitelist | `FRONTEND_URL` only (urbackend.bitbros.in) |
295+
| **Public API** | API consumer routes | `limiter` (custom) | Configurable per project |
296+
| **Public API** | API consumer auth | `verifyApiKey` | SHA-256 hashed key + Redis cache |
297+
| **Public API** | CORS | Open CORS | Project-based, allows any origin |
298+
| **Both** | Credential storage | AES-256-GCM encryption | BYOD DB/Storage configs encrypted in MongoDB |
299+
| **Both** | File uploads | `multer` memory storage | 10 MB per file limit |
300+
| **Both** | Request monitoring | Kiroo SDK | Session replay & error tracking |
270301

271302
---
272303

273304
## 7. Infrastructure Overview
274305

275306
```mermaid
276-
graph LR
277-
subgraph Hosting["Hosting"]
278-
FE["Frontend\nVercel"]
279-
BE["Backend\nRender / Railway"]
307+
graph TB
308+
subgraph Hosting["☁️ Hosting"]
309+
FE["Frontend\nVercel\nurbackend.bitbros.in"]
310+
DASH_BE["Dashboard API Server\nRender / Railway\nadmin.urbackend.com\nPort: 1234"]
311+
PUB_BE["Public API Server\nRender / Railway\napi.urbackend.com\nPort: 1235"]
280312
end
281313
282-
subgraph External["External Services"]
314+
subgraph External["🔌 External Services"]
283315
MONGO["MongoDB Atlas\n(Primary DB)"]
284316
RDS["Upstash Redis\n(API Key Cache)"]
285317
SUP["Supabase\n(File Storage)"]
286318
SMTP["SMTP Server\n(OTP / Emails)"]
287319
end
288320
289-
subgraph BYOD["BYOD (User-owned)"]
321+
subgraph Shared["📦 Shared"]
322+
COMMON["@urbackend/common\nModels, Utils, Services,\nMiddleware, Queues"]
323+
end
324+
325+
subgraph BYOD["🔧 BYOD (User-owned)"]
290326
USER_MONGO["User's MongoDB Atlas"]
291327
USER_SUP["User's Supabase"]
292328
end
293329
294-
FE -->|"HTTPS REST"| BE
295-
ExternalApp["External App"]
296-
FE -->|"HTTPS REST"| BE
297-
ExternalApp -->|"x-api-key"| BE
298-
BE --> MONGO
299-
BE --> RDS
300-
BE --> SUP
301-
BE --> SMTP
302-
BE -.->|"Optional BYOD"| USER_MONGO
303-
BE -.->|"Optional BYOD"| USER_SUP
330+
ExternalApp["External App\n(API Consumer)"]
331+
DevUser["Developer\n(Dashboard User)"]
332+
333+
DevUser -->|"HTTPS REST"| FE
334+
FE -->|"JWT Auth"| DASH_BE
335+
ExternalApp -->|"x-api-key"| PUB_BE
336+
337+
DASH_BE --> MONGO
338+
DASH_BE --> RDS
339+
DASH_BE --> SMTP
340+
DASH_BE -.->|"Imports"| COMMON
341+
342+
PUB_BE --> MONGO
343+
PUB_BE --> RDS
344+
PUB_BE --> SUP
345+
PUB_BE -.->|"Imports"| COMMON
346+
PUB_BE -.->|"Optional BYOD"| USER_MONGO
347+
PUB_BE -.->|"Optional BYOD"| USER_SUP
304348
```
349+
350+
### Deployment Strategy
351+
352+
- **Dashboard API**: Handles developer/admin operations (auth, project management, releases)
353+
- **Public API**: Handles external app requests (data CRUD, user auth, storage, schemas)
354+
- **Shared Package**: `@urbackend/common` contains all shared code (models, utils, services)
355+
- **Independent Scaling**: Each server can scale independently based on traffic
356+
- **Fault Isolation**: If one server fails, the other continues to operate
357+
- **Different Domains**: Separate domains for clear separation of concerns

0 commit comments

Comments
 (0)