System Architecture Document

MAFORI Event Ticketing & Voucher Platform — Technical architecture, data flow & infrastructure

Architecture Overview

Presentation Layer (Client)

Browser & Mobile Web App

Application Layer

Base44 Serverless Functions

Data Layer

Base44 BaaS Entity Store

Integration Layer

External Services & Partner APIs

Architecture Layers

Presentation Layer (Client)

Browser & Mobile Web App

Single-page application rendered in the browser, served as a static build. No server-side rendering — all pages are client-side React components.

Application Layer

Base44 Serverless Functions

Backend logic runs as isolated Deno serverless functions. Each function is an independent HTTP handler — no long-running server process.

Data Layer

Base44 BaaS Entity Store

All persistent data is stored as structured entities in the Base44 managed database with automatic row-level security (RLS).

Integration Layer

External Services & Partner APIs

Third-party services connect through dedicated backend functions or OAuth connectors, never directly from the client.

Ticket Purchase Data Flow

Public User

Visits event landing page

Browser requests /event/:id — client fetches public event data via getPublicEventData function

Client App

Displays event & checkout

React renders event details, ticket selection, and Yoco payment widget

Yoco Gateway

Processes card payment

Payment token created client-side, sent to createYocoCheckout function

Serverless Function

Confirms & records sale

confirmYocoPayment verifies with Yoco, creates Ticket + Payment records, generates QR

PDF Generator

Creates ticket PDF

ticketPdfGenerator renders branded ticket with QR code and voucher overlay

Email Service

Delivers ticket

sendTicketEmail emails PDF to customer via Resend, logs to EmailLog entity

Gate Scanner

Validates entry

Scanner reads QR, checks Ticket status via real-time subscription, marks as scanned

Security Architecture

Row-Level Security (RLS)

Every entity enforces access control at the database level — users can only read/write data they are authorised for.

Role-Based Access Control

Six roles (admin, manager, cashier, scanner, viewer, tester) with distinct permissions enforced on both client and server.

OAuth Authentication

Platform-managed JWT sessions with automatic token refresh. No custom auth backend — eliminates common auth vulnerabilities.

Secret Management

API keys and secrets stored as environment variables on the server, never embedded in client code.

Payment Security

All payment processing handled by PCI-DSS compliant gateways (Yoco, PayFast). No card data touches our servers.

Input Validation

All user input validated on both client and server. Entity schemas enforce data type and constraint validation.

Audit Logging

All user actions, payment events, and integration calls are logged for traceability and compliance.

Iframe Protection

X-Frame-Options: DENY and restrictive CSP headers prevent clickjacking and content injection.

Deployment & Infrastructure

Hosting

Base44 managed cloud (auto-scaled)

Frontend Build

Vite static bundle (CDN-distributed)

Backend Runtime

Deno Deploy serverless (edge)

Database

Base44 managed NoSQL with RLS

File Storage

Base44 cloud storage (public + private)

CDN / Delivery

Global edge network with caching

SSL / TLS

Automatic HTTPS with managed certificates

Mobile Delivery

Responsive PWA (installable, iOS/Android)

Scalability & Reliability

Serverless functions scale to zero when idle and auto-scale under load — no capacity planning required

Database reads are automatically indexed and cached at the entity level

Real-time subscriptions use efficient WebSocket multiplexing (one connection per client)

Offline-first scanner and POS queue operations locally, syncing when connectivity returns

CDN caches all static assets (JS, CSS, images) at edge nodes worldwide

No single point of failure — each serverless function is independently deployed and scaled