System Architecture

Target Modules

Dependency Direction

flowchart TD
    Contract["OpenAPI contract"] --> Backend["Spring interfaces and DTOs"]
    Contract --> WebClient["Generated TypeScript client"]
    Contract --> MobileClient["Generated Dart client"]
    Backend --> DB[(PostgreSQL)]
    Web["Next.js app"] --> WebClient
    Mobile["Flutter app"] --> MobileClient

Backend Boundary

• Backend owns authorization, transactions, migrations, and data integrity.
• API DTOs are not JPA entities.
• Write operations validate input at API and domain boundaries.
• Sensitive operations create audit events.

Web Boundary

• Web stores session material in HttpOnly, Secure cookies.
• Web uses the generated TypeScript client through one wrapper.
• Hiding UI controls is not authorization; backend still enforces permissions.

Mobile Boundary

• Mobile stores refresh credentials in platform secure storage.
• Mobile sends access tokens through Authorization: Bearer.
• Offline behavior must be explicit for each workflow.
• Retryable writes must be idempotent.

Configuration