Backend Architect

GraphQL Considerations

• Use batching and DataLoader to prevent N+1
• Implement query complexity limits
• Document schema; prefer explicit over generic resolvers

API Documentation

Include: request/response formats, auth requirements, error payloads, rate limits, examples.

Database Architecture Decision Framework

Schema Design

1. Normalize for data integrity; denormalize only for read hotspots
2. Index strategy: Cover frequent queries; avoid over-indexing writes
3. Primary keys: Prefer UUIDs for distributed systems; auto-increment for single-DB
4. Soft delete: Use deleted_at when audit trail matters

Technology Choice

Migration Strategy

• Version-controlled migrations; never edit applied migrations
• Backward-compatible schema changes (add columns nullable first)
• Test rollback procedures

Server-Side Architecture Patterns

Layered Design

Controller/Resolver → Service (business logic) → Repository (data access)

• Stateless services for horizontal scaling
• Failover and circuit breakers for external calls
• Retry with exponential backoff; idempotency where possible

Caching Layers

Background Jobs

• Use job queues (Bull, Celery, etc.) for non-blocking work
• Idempotent job handlers
• Dead-letter handling and alerting

Security Checklist

• Auth: OAuth 2.0, JWT, or SAML; short-lived tokens; refresh token rotation
• Input validation: Whitelist; sanitize; parameterized queries (no raw SQL concatenation)
• XSS/CSRF: Proper headers; CORS; SameSite cookies
• Encryption: TLS in transit; encrypt PII at rest
• Secrets: Never in code; use env vars or secrets manager
• Compliance: GDPR (right to delete, data portability), CCPA, HIPAA as applicable

Scalability & Performance

Horizontal Scaling

• Stateless services; shared-nothing where possible
• Session in Redis/DB, not local memory
• Load balancer + health checks

Database Performance

• Connection pooling
• Read replicas for read-heavy workloads
• Query profiling; avoid N+1
• Appropriate indexes; avoid full table scans

Observability

• Structured logging (JSON); correlation IDs
• Metrics: latency (p50, p95, p99), error rate, throughput
• Distributed tracing for microservices
• Alerts on SLO breaches

Operational Excellence

CI/CD

• Automated tests (unit, integration, e2e)
• Security scanning (SAST, dependency checks)
• Blue-green or canary deployments
• Rollback procedure documented and tested

Zero-Downtime Deployments

• Health checks before traffic
• Graceful shutdown (drain connections)
• Feature flags for risky changes

Infrastructure as Code

• Terraform, CloudFormation, or Pulumi
• Separate envs: dev, staging, production

Integration Patterns

Code Quality Standards

• SOLID; single responsibility per module
• Unit tests for business logic; integration tests for API/DB
• Clear error handling; never swallow exceptions
• Structured logging with context
• Dependency injection for testability

Additional Resources

For detailed patterns and examples, see reference.md.