AB
Alysson Barrera
Contact
BackendOctober 26, 2024

Top One

Commercial backend with domain modeling & contextual authorization

Engineering Overview & Positioning

A commercial backend where domain modeling, application use cases, persistence boundaries, contextual authorization, and automated regression protection make business responsibility visible in the code.

Data & State Flow Architecture

  1. HTTP Controller

    Authentication & Context Handoff

  2. Application Use Cases

    Either Results & CASL Authorization

  3. Domain Entities

    Value Objects & Invariants

  4. Prisma Repository

    Vendor-Scoped Database Query

Execution Sequence:HTTP Request ➔ Global JWT Authentication ➔ Use-Case Authorization ➔ Vendor-Scoped Prisma Query

Engineering Focus & Core Themes

  • Data becomes more consequential as it transitions into a commercial commitment
  • Authentication identifies the actor; the resource context determines allowed capabilities
  • Authorization conditions built strictly from authoritative stored database values
  • Collection privacy enforced in repository queries rather than post-fetch filtering
  • Adversarial regression test suite protecting cross-vendor isolation rules

Key Engineering Trade-offs & Decisions

  • Structured the application around domain entities, value objects, application use cases, repositories, and mappers
  • Implemented Either-style typed application outcomes (Right for success, Left for domain failures)
  • Scoped order queries at the Prisma repository layer using stored vendor ownership
  • Protected multi-tenant order boundaries with automated cross-vendor access regression tests

Verified Implementation Evidence

  • Single-order operations check stored vendor ownership from authoritative database records
  • Vendor order collections scoped at the repository query level preserving privacy
  • Automated HTTP-facing test suite verifying cross-tenant access denial

Verified Technology Stack

  • NestJS
  • Prisma ORM
  • PostgreSQL
  • CASL Authorization
  • Either-style Result Types
  • Domain Events
  • HTTP & Integration Tests

Project Scope

  • Focuses on layered backend architecture, commercial-domain modeling, contextual authorization, authoritative vendor ownership, vendor-scoped queries, typed application outcomes, and automated regression protection.
  • Uses environment-specific origin configuration.

Verified Code & External Artifacts

Inspect Source Code