System Architecture & Flow

Request & Mutation Lifecycle

When an employee initiates an action (such as submitting a leave request or generating a contractor invoice), the mutation travels through a 4-stage pipeline:

1. Client Form Submission: Validated client-side with React Hook Form and Zod for immediate touch-target feedback.

2. Edge Authentication: Middleware verifies the Supabase session cookie, refreshing tokens if expired.

3. Server Action Execution: Runs server-side in isolated Node/Edge runtime, verifies CSRF and company tenancy, and executes parameterized SQL.

4. Audit Bus Emission: Emits an immutable row to activity_events triggering asynchronous webhooks and push notifications.

Server Actions & Mutation Validation Gate

Every user interaction that mutates state adheres to defensive validation patterns. Incoming requests are sanitized and filtered against strict domain boundary rules before execution.

The table below details how Sferafy validates, authorizes, and enforces integrity across primary business mutations without exposing client-side execution vectors:

CQRS & Activity Events Bus

To maintain a transparent audit log and enable real-time integrations (Slack, Google Calendar, Webhooks), Sferafy utilizes an append-only event bus.

All organization activities are indexed and processed with sub-millisecond response latency, ensuring executives and compliance officers always have an up-to-the-minute operational timeline.

Edge Middleware & Session Refresh

The edge middleware (src/middleware.ts) intercepts every incoming HTTP request to validate authentication cookies, attach security headers, and prevent unauthorized access to sensitive company routes.