Core–Kernel–Shell Architecture, Rust API & Postgres RLS Tenancy
Technical reference covering Next.js 16 proxy authentication, Rust/Axum endpoints, PostgREST JWT switching, and demo session isolation.
Inspect Live Audit Logs in Demo
Launches an isolated session straight into /audit.
1. Stack Overview
Browser traffic terminates at the Next.js 16 App Router (`frontend-platform`), which stores `deku_at` / `deku_rt` inside `httpOnly` cookies and proxies API requests via `/api/backend/*` to the Rust/Axum server (`backend-platform`). Rust executes statutory math, GST validations, and encryption before forwarding requests to PostgREST and PostgreSQL 16.
2. Multi-Tenant & Public Demo Isolation
Every company row is scoped by `organisation_id` and guarded by PostgreSQL RLS helpers (`is_org_member`, `has_role`). Public Learn Demo sessions issue short-lived, demo-scoped tokens bound exclusively to ephemeral template-cloned organisations so anonymous visitors can never read each other's sessions or reach production tenants.