NoCode Platform — MVC Layers

NoCode Platform — MVC Layers An architecture diagram generated by Archify. API Client · REST + JSON · Architecture component API Client REST + JSON Admin Console · browser session · Architecture component Admin Console browser session Yoda authorize · token → Account · Play Framework 3 / Scala 3 monolith › Entry gate: filters + authorize Yoda authorize token → Account Play Filters · CSRF · CSP · hosts · Play Framework 3 / Scala 3 monolith › Entry gate: filters + authorize · conf/csrf.conf Play Filters CSRF · CSP · hosts conf/csrf.conf REST Controller · one endpoint · *Form · Play Framework 3 / Scala 3 monolith · app/conf/<area> REST Controller one endpoint · *Form app/conf/<area> Web Controller · views/*.scala.html · Play Framework 3 / Scala 3 monolith Web Controller views/*.scala.html Service · optional @Cached · Play Framework 3 / Scala 3 monolith Service optional @Cached Facade · owns the transaction · Play Framework 3 / Scala 3 monolith · PolicyGuard gate Facade owns the transaction PolicyGuard gate Jdbc → ORM · SQL + row parse · Play Framework 3 / Scala 3 monolith Jdbc → ORM SQL + row parse PostgreSQL · access · config · app · Architecture component PostgreSQL access · config · app HTTPS · JSON filtered request validated *Form Entity SQL Account · org/app scope form POST CSRF-checked same Facade as the API cached / reusable read Play Framework 3 / Scala 3 monolith Entry gate: filters + authorize Legend Frontend Backend Database Security External

Two front doors

  • • REST API: one endpoint per controller under app/<area>
  • • Admin console rendered by Web Controllers over views/*.scala.html
  • • Both call the same Facade: one behavior, two doors

Layer contract

  • • Controller: parse the colocated *Form, delegate, return okJson
  • • Facade: exec(form), one pool.withTransaction, maps Entity to *Model
  • • Service: optional, reusable or @Cached reads only
  • • Jdbc extends *ORM: SQL and row parse — no Proxy or Processor layer

Security

  • • Play filters: CSRF, CSP, allowed hosts, CORS
  • • authorize resolves the Account; org/app scope never comes from the body
  • • config.policy gates rows, fields and values inside the Facade