Living System Diagram

System Architecture

A layered, end-to-end map of how the platform actually runs — from the browser through Vercel's edge, identity and multi-factor authentication, the guarded API layer, Neon persistence, and private Blob storage. Full-resolution originals stay in a private store that is never web-accessible; only downscaled renditions are served through an edge-cached media proxy. Pick a walkthrough to watch a request travel the stack step by step.

At a glance

Data-plane flowIdentity, MFA & private readsCloud originals stay on the photographer's own drive; only low-res renditions reach the public surfaces.

Step through a request

Operator opens /studio

The console loads and requests a protected route.

1/8

Presentation

Clients

Server-rendered React 19 surfaces — a public gallery and the authenticated operator console.

Public Gallery

Read-only SSR viewer

Studio Console

Operator dashboard

Vercel Edge Network

Edge & Delivery

TLS, CDN, firewall and the auth guard all run at the edge before a request reaches any function.

TLS Termination

Auto-provisioned SSL

Global CDN

Anycast edge cache

Firewall + DDoS

Managed rules

Middleware Guard

Session check at edge

Identity & Access

Authentication & MFA

Two sign-in paths. Multi-factor authentication is delegated to Microsoft Entra ID — the app never handles second factors itself.

Studio Session

HMAC cookie · 12h · constant-time

Microsoft Entra ID

MFA enforced

OAuth 2.0 authorization code + CSRF state

Email Allowlist

Authorization gate

Vercel Functions

API Layer

Next.js Route Handlers. Every route shares one guard: session check, per-IP rate limit, Zod validation, timeout + retry, and a leak-proof error envelope.

Agent APIs

curator · editor · copywriter · hashtags · scheduler

Publish API

Instagram · tighter rate limit

State API

versioned snapshot · optimistic lock

Cloud Sync + Webhook

OneDrive & Google Drive · delta sync · change notifications

Cron Maintenance

token & subscription renewal

Vercel Blob

Media Storage

Two origins for originals. Direct uploads live in a private Blob store (403 to the public internet). Cloud-synced originals never persist on our side — they stay in the photographer's OneDrive/Google Drive. Either way, only downscaled renditions are exposed, through an edge-cached media proxy.

Private Blob Store

Private

Uploaded originals + renditions · not web-accessible

Cloud Original (on provider)

Never stored

Stays in OneDrive / Google Drive · staged then deleted

Derived Renditions

jimp · web 1600px · thumb 600px · IG 1080px

Cached Media Proxy

/api/media · edge-cached · low-res only

Persistence

Data Layer

Neon Postgres via Drizzle over a shared pool. Writes are serialized with a Postgres advisory lock.

Studio State

JSONB · version column · advisory lock

Cloud Accounts

encrypted OneDrive + Google refresh tokens

Sync Subscriptions

OneDrive & Drive webhook lifecycle + delta cursors

Third-party Systems

External Services

All outbound calls go through a shared client with timeouts and bounded retries; non-idempotent calls never retry.

Microsoft Graph

OneDrive ingestion + webhooks

Google Drive API

Drive ingestion + change watch

Vercel AI Gateway

reads staged bytes inline · Gemini 2.5 Flash

Instagram Graph

media container → publish

Meta Platform

Graph API owner

Legend

Data-plane flow Identity / security Dimmed = not in this path