# ARCHI Platform Architecture

## Principle

**Every tenant is an independent data and security boundary.**

Visitor on `mukhsin.archi.com` sees only Mukhsin's public data.
Visitor on `juma.archi.com` sees only Juma's public data.
No default-tenant fallback. Unknown host → controlled 404.

## High-level flow

```
Browser → DNS/Cloudflare → Next.js Proxy → Host classification
  → platform | app | admin | tenant rewrite
  → TenantResolver (trusted) → TenantContext
  → Services (always tenant-scoped) → PostgreSQL / Storage / Cache
```

## Route surfaces

| Host | Surface | App path |
|------|---------|----------|
| `archi.com` | Platform discovery | `/` |
| `app.archi.com` | Studio dashboard | `/dashboard` |
| `admin.archi.com` | Platform admin | `/admin` |
| `{slug}.archi.com` | Tenant website | `/site` |
| custom domain | Tenant website (verified only) | `/site` |

## Core modules

- `src/core/tenant` — hostname classify + resolve + context
- `src/core/authorization` — RBAC / ownership
- `src/core/db` — Drizzle schema + client
- `src/core/cache` — tenant-aware keys
- `src/core/storage` — tenant-prefixed object keys
- `src/services/*` — business logic (not in React components)

## Security non-negotiables

1. Never trust client `tenant_id`
2. Never cache without tenant identity in key
3. Never mix storage namespaces across tenants
4. Never fall back to another tenant on miss
5. Server-side authorization for every mutating action

## Local multi-tenant simulation

Use `http://mukhsin.localhost:3000` after seeding tenant `mukhsin`.
Wildcard localhost resolution works on most modern OS/browsers.