Architectural Patterns and Anti-Patterns Questions

Frontend (UI)

• Core responsibilities: UX, input validation, rendering, client-side routing, offline/optimistic updates.
• Exposed interfaces: REST/GraphQL client calls, WebSocket events, public assets.
• Separation: Keep business rules out of UI; use a thin client pattern. Provide mocked API contracts (OpenAPI/GraphQL schema) for frontend tests and CI.

API Gateway

• Responsibilities: Routing, authentication/authorization gateway, rate-limiting, TLS termination, request validation, logging.
• Interfaces: Stable public endpoints, JWT/OAuth token validation hooks, circuit-breaker/health endpoints.
• Separation: Enforce auth and validation here so backend services trust sanitized requests. Use policy-as-code for security rules.

Application Layer (Microservices)

• Responsibilities: Orchestrate requests, session/context handling, caching, API adapters.
• Interfaces: Internal RPC/REST contracts, message queue topics, health and metrics endpoints.
• Separation: Keep services stateless where possible; use versioned APIs and contract tests for deployment safety.

Business Logic Layer

• Responsibilities: Domain rules, workflows, transactions, domain events.
• Interfaces: Well-defined service interfaces (SDKs or gRPC), domain events on pub/sub channels.
• Separation: Encapsulate domain logic in services/libraries with unit tests; avoid infra concerns here.

Persistence Layer

• Responsibilities: Data modeling, transactions, backup/restore, indexing, encryption-at-rest.
• Interfaces: Data access APIs/ORM, query repositories, migration scripts.
• Separation: Use repository pattern and DB proxy/service; enforce least-privilege DB accounts and automated migration pipelines.

Testing, Deployment & Security Boundaries

• Use contract tests (PACT/OpenAPI), unit tests per layer, and end-to-end tests in staging.
• CI/CD: Independent pipelines per layer with blue/green or canary deployments.
• Security: Zero-trust between layers, mutual TLS, RBAC for services, secrets via vault, network segmentation (VPCs/subnets, NSGs), and observability (tracing, logs, metrics) for audits and incident response.