Domain relationships

Domain relationships An architecture diagram generated by Archify. User · Cognito identity · Architecture component User Cognito identity Workspace · The tenant boundary · Architecture component · everything belongs to one Workspace The tenant boundary everything belongs to one Membership · user + role · Architecture component Membership user + role FarmAgent · One machine · Architecture component FarmAgent One machine FarmNode · Device grouping · Architecture component FarmNode Device grouping Device · Owned or rented · Architecture component · 3 state axes Device Owned or rented 3 state axes SocialAccount · credentialSecretId only · Architecture component SocialAccount credentialSecretId only MediaAsset · s3Key, never bytes · Architecture component MediaAsset s3Key, never bytes Post · Intent to publish · Architecture component · text in the database Post Intent to publish text in the database DeviceJob · One instruction · Architecture component · references only DeviceJob One instruction references only JobEvent · What actually happened · Architecture component JobEvent What actually happened belongs to many grants a role in owns groups devices into reports holds the session for is published to references becomes one job per occurrence runs on every step Legend Frontend Backend Database Cloud Security External

Four concepts, kept apart

  • • Post — the business intention to publish
  • • DeviceJob — one instruction for one device
  • • JobEvent — the ordered record of what happened
  • • Collapsing them would make each one wrong

References, never contents

  • • A Post carries mediaAssetIds; a MediaAsset carries an s3Key
  • • A SocialAccount carries credentialSecretId, never a password
  • • A DeviceJob carries a text snapshot and ids — nothing more

One tenant boundary

  • • Every record carries its workspaceId
  • • Every query is scoped by it before anything else happens
  • • Membership is proven server-side on every single request