Enterprise Architecture Overview

Enterprise Architecture Overview

Version: 1.0 · Owner: Pocket PMO Ltd · Approval status: Approved · Review date: quarterly

Purpose

A concise architectural view of the Pocket PMO platform intended for enterprise IT and security architects.

High-level components

                 +---------------------------------------------+
                 |            Client (browser / PWA)            |
                 |  React 18, Vite 5, Tailwind, Radix, PWA SW   |
                 +----------------+---------------------------- +
                                  |
                                  |  TLS 1.3
                                  v
                 +---------------------------------------------+
                 |  Managed edge functions (Deno on Supabase)  |
                 |  Auth-scoped requests; JWT verified         |
                 |  Server-only secrets (Lovable Cloud vault)  |
                 +----+---------------+--------------+---------+
                      |               |              |
                      |               |              |
                      v               v              v
              +-------+------+  +-----+------+  +----+----------+
              | Managed      |  | AI Gateway |  | Integrations  |
              | Postgres     |  | (Lovable)  |  | MS Graph,     |
              | (Supabase)   |  | Gemini,    |  | Stripe,       |
              | RLS + GRANTs |  | OpenAI     |  | Resend, EL    |
              +--------------+  +------------+  +---------------+

Environments

• Production: pocketpmo.co.uk (with www as primary).
• Preview: Lovable-managed preview deployments per project.

Deployment model

• Frontend deploys on publish (static assets).
• Edge functions and DB migrations deploy immediately when authored via the platform.
• Static hosting includes SPA fallback (no _redirects file required).

Networking & TLS

• TLS 1.3, HSTS by default at hosting layer.
• No customer-facing ingress points bypass the managed load balancer.

Data model summary

• Organisational tenancy (organizations, organization_members).
• Per-user private workspace (Drawing Board) is a distinct scope from any organisation.
• Roles held in user_roles; policy evaluation via has_role SECURITY DEFINER.
• Every business table has RLS enabled and explicit GRANTs.
• Auditability via audit_logs, per-domain change tables, and security_events.

API and integrations

• Public REST API with JWT / OAuth2 PKCE (api_keys, oauth_clients, oauth_tokens).
• Webhooks: outbound HMAC-SHA256 signed; inbound Stripe / Resend verified.
• MCP tools available for automation (supabase/functions/mcp).

Change management

• Peer-reviewed migrations executed through the platform.
• Security scanner reviews RLS coverage and GRANTs per migration.
• Feature flags and staged rollouts where appropriate.

Owner confirmation required

• H-01 region topology.

Document history