Decor.Pro — Runtime Architecture

Decor.Pro — Runtime Architecture An architecture diagram generated by Archify. Office Staff · desktop browser · Architecture component Office Staff desktop browser Factory Floor · tablet PWA · Architecture component Factory Floor tablet PWA Customer · emailed quote link · Architecture component Customer emailed quote link Session Gate · middleware.ts · HMAC cookie · Vercel — decor-hub deployment Session Gate middleware.ts · HMAC cookie App Router Pages · async server components · Vercel — decor-hub deployment App Router Pages async server components Server Actions · all writes · revalidatePath · Vercel — decor-hub deployment Server Actions all writes · revalidatePath Prisma Postgres · 40 models · usage-billed · Architecture component Prisma Postgres 40 models · usage-billed Domain Libraries · pricing · CAD · cut sheets · Vercel — decor-hub deployment Domain Libraries pricing · CAD · cut sheets Vercel Blob · customer files · Architecture component Vercel Blob customer files Microsoft Graph · SharePoint · read-only · Architecture component Microsoft Graph SharePoint · read-only Anthropic API · AI overview · fail-soft · Architecture component Anthropic API AI overview · fail-soft Stripe · MYOB · seams, not connected · Architecture component Stripe · MYOB seams, not connected HTTPS signed cookie PIN sign-in /q/<token> · no login server action call Prisma write Prisma read price + draw preview authoritative recompute file upload GET only overview returns null Vercel — decor-hub deployment Legend Frontend Backend Database Cloud Security External

How a request works

  • • Every page is force-dynamic — no static cache, every view hits the database
  • • Server components read Prisma directly; there is no API layer
  • • Writes are server actions that call revalidatePath when they finish

Access control

  • • Cookies are HMAC-signed, httpOnly, 12-hour expiry
  • • The middleware gate covers the hub but excludes /floor, which has its own PIN
  • • /q/<token> is the only page outside the gate — a 32-character unguessable token

Edges to watch

  • • Stripe and MYOB are seams that return null until credentials land
  • • The AI overview fails soft — a dead model never blocks a job
  • • Live boards poll every 5s, the main driver of usage-billed DB operations