Core API Gateway
Relevant source files
The following files were used as context for generating this wiki page:
The Core API Gateway serves as the centralized entry point for all client requests within the TAMV Online ecosystem. It is designed to manage complex traffic patterns, provide a unified interface for disparate microservices, and ensure that all incoming communications are authenticated and correctly routed to their respective internal destinations.
As the backbone of the "most ambitious system created by a single human mind," the gateway facilitates the decoupling of frontend consumers from backend service implementations, allowing for independent scaling and maintenance of individual modules.
Sources: README.md:1-2
Architecture and Traffic Management
The architecture of the Core API Gateway follows a traditional reverse proxy pattern combined with application-level routing logic. It intercepts every request from the frontend or external third-party integrations, processes headers, and forwards the payload to the internal service mesh.
Request Lifecycle
When a request arrives at the gateway, it undergoes a multi-stage validation process before reaching the business logic layer. This ensures that only well-formed and authorized requests consume system resources.
The diagram above illustrates the sequential flow of data from the initial client contact through the various internal validation layers.
Sources: Backend/src/routes/api.routes.js, Backend/src/middleware/auth.middleware.js
Security and Authentication
Security is enforced at the gateway level through a robust middleware layer. This layer validates JSON Web Tokens (JWT) or session identifiers before the request is permitted to proceed to the controller level.
| Component | Function | Description |
|---|---|---|
| Auth Middleware | Validation | Checks for valid Authorization headers and signature integrity. |
| Rate Limiter | Protection | Prevents brute force and Denial of Service (DoS) attacks. |
| CORS Policy | Origin Control | Restricts API access to authorized domains only. |
By centralizing security, the individual microservices do not need to implement redundant authentication logic, reducing the overall attack surface and simplifying the codebase.
Sources: Backend/src/middleware/auth.middleware.js, Backend/src/controllers/gateway.controller.js
API Endpoints and Routing
The gateway exposes a set of standardized endpoints that map to internal functions. The api.routes.js file defines these mappings, acting as the primary manifest for the system's external interface.
Routing Table Example
The following table summarizes the primary categories of routes managed by the gateway:
| Endpoint Path | Method | Internal Destination | Description |
|---|---|---|---|
/v1/auth/* | POST/GET | Authentication Service | Handles login, logout, and token renewal. |
/v1/data/* | GET | Resource Controller | Retrieves system metadata and user records. |
/v1/system/* | ALL | Management Module | Provides health checks and system status. |
The sequence diagram demonstrates the interaction between the client, the gateway, and the underlying services during a standard authentication handshake.
Sources: Backend/src/routes/api.routes.js, Backend/src/controllers/gateway.controller.js, Frontend/src/api/gateway.js
Implementation Details
The gateway's controller logic handles the transformation of requests and responses to ensure compatibility across different versions of the frontend application. It also manages error propagation, ensuring that internal server errors are masked with user-friendly messages while logging the technical details for developers.
Core Controller Structure
The gateway controller typically employs a wrapper pattern to handle asynchronous operations and centralized error catching.
Sources: Backend/src/controllers/gateway.controller.js, Frontend/src/api/gateway.js
Conclusion
The Core API Gateway is the critical nexus of the TAMV Online system. By providing a single point of entry, it enables high-level security enforcement, traffic orchestration, and system-wide monitoring, ensuring the stability and performance of the entire application architecture.