Document Upload / Download Architecture
Controlled document flow covering user actions, BFF coordination, authorization checks, metadata persistence, secure file storage, download retrieval, and auditability
📄
Users / Document Actions
USER & FRONTEND INTERACTION
USER
CMS User
Initiates upload or download actions from the application interface
SPA
React SPA
Captures file actions, presents status, and interacts with the BFF
UP
Upload Action
User selects file and submits metadata and content through the UI
DL
Download Action
User requests a stored file or artifact for secure retrieval
The browser never talks directly to storage. All document operations go through controlled backend orchestration and authorization paths.
BFF / DOCUMENT ACCESS COORDINATION
The BFF acts as the controlled entry point for document flows initiated by the UI
BFF
BFF / Orchestration
Receives upload / download requests and coordinates the document-management flow
CTX
Identity Context
Passes user identity and request context to protected backend document operations
VAL
Request Validation
Checks request shape, file intent, metadata completeness, and allowed operation type
RSP
Response Handling
Returns success, error, or file retrieval responses back to the frontend
Document operations are executed only after server-side authorization and document-management logic has been applied.
DOCUMENT MANAGEMENT SERVICE
AUTH
Authorization Check
Applies RBAC / ABAC before allowing upload or download execution
META
Metadata Handling
Creates or looks up file metadata, ownership, type, and reference links
UPLD
Upload Processing
Receives file content, validates document rules, and stores upload outcome
GET
Download Retrieval
Resolves requested file reference and prepares secure file delivery path
LIFE
File Lifecycle Control
Maintains linkage, availability state, and document ownership references
File binary content and document metadata are deliberately separated into different underlying stores.
STORAGE & METADATA BOUNDARIES
DDB
Azure DocumentDB
Stores document metadata, file references, ownership links, workflow associations, and operational application records
ADLS
ADLS Gen2
Stores binary files, uploaded content, generated documents, exports, and downloadable document artifacts
SEP
Separation of Responsibility
Metadata and object storage are separated to keep operational document state distinct from binary file persistence
SECURITY, AUDIT, AND CONTROL
AAD
Azure AD Context
Authenticated identity is used to evaluate document access rights
RBAC
RBAC / ABAC
Policy checks determine whether the user may upload, read, or link the file
AUD
Access Logging
Upload and download events are logged for traceability and operational review
DD
Datadog
Receives observability signals, logs, metrics, and traces from document operations
END-TO-END OUTCOMES
OK
Upload Successful
File stored in ADLS and metadata recorded in DocumentDB
RET
Download Returned
Authorized file retrieval is returned to the frontend
DENY
Unauthorized Blocked
Policy failure prevents direct or unauthorized document access
TRACE
Operation Audited
Upload / download actions remain observable and auditable
User & frontend interaction
BFF coordination
Document management service
Storage & metadata boundaries
Security & audit controls
End-to-end outcomes