DrawmaticAI Architecture

graph TD
    subgraph User["User Layer"]
        Browser["Browser
Draw.io embed iframe + custom PNG export"]
    end

    subgraph Security["Security Layer"]
        RateLimit["Rate Limiter
sliding window 60s per IP
fixed for proxy IP handling"]
        SecHeaders["Security Headers
HSTS + Permissions-Policy + XSS"]
        TrustedURL["Trusted Base URL
X-Forwarded-Host vs ALLOWED_HOSTS"]
        CSWSHGuard["CSWSH Guard
Origin header validation"]
        CSRF["CSRF Double-Submit
cookie on all state-changing endpoints"]
        XMLGuard["XML Size Guard
2MB cap + XML validation on WS updates"]
    end

    subgraph Drawmatic["DrawmaticAI - FastAPI on port 7000"]
        FastAPI["FastAPI Server"]
        Auth["Google OAuth + JWT
OAuth state cookie CSRF guard"]
        SessionSecret[(".session secret file
owner-only perms, signs session cookies")]
        JWTSecret[("secret file
owner-only perms, signs app-level JWTs")]
        AI["AI Agent
the AI agent module + XML reference.py
XXE-safe parsing + prompt-injection sanitization"]
        BestOfN["Best-of-N generation
fresh diagrams: multiple attempts, scored
iterative edits: single pass on current XML"]
        Store["PersistentDiagramStore"]
        UpdateLocks["Per-diagram Async Locks
concurrency control"]
        Presence["Presence Tracker
active users per diagram"]
        Tenant["Tenant Store
multi-tenancy"]
        AuditMW["Audit Middleware
wraps every request
bounded LIMIT/OFFSET queries"]
    end

    subgraph DrawioEmbed["Draw.io Embed (embed.diagrams.net)"]
        ShapeLibs["~23 shape libraries loaded at launch
general, network, uml, er, bpmn, azure, gcp2,
cisco, rack, archimate, dfd, eip, ibm..."]
        AWSVersioned["Versioned AWS libraries
aws4 (current) / aws3d (3D) / aws3 (legacy)
fallback message if exact match unavailable"]
        NetLib["Network library auto-selected
for AWS/Azure networking prompts
(subnet, VPN, firewall, NSG, load balancer...)"]
        DarkParam["&ui=dark param
toggled with OwnLifeOS theme switch"]
        PngExport["App-level PNG export button
postMessage export action
(not draw.io's built-in dialog - filename control)"]
    end

    subgraph Intelligence["Local Intelligence"]
        Ollama["Ollama
user-selectable model on the LAN
default gemma4:e4b-mlx-bf16"]
    end

    subgraph Data["Data Layer"]
        SQLite[("SQLite
diagrams + versions + tenants")]
        Audit[("Audit Log
SQLite by default, PostgreSQL optional
cross-app aggregator")]
    end

    subgraph Infra["Infrastructure"]
        CF["Cloudflare Tunnel"]
        Docker["Docker Compose"]
    end

    Browser -->|HTTPS| CF
    CF -->|HTTP| Docker
    Docker --> FastAPI
    FastAPI --> RateLimit
    RateLimit --> Auth
    Auth --> SessionSecret
    Auth --> JWTSecret
    Auth --> Tenant
    Tenant --> SQLite
    FastAPI --> SecHeaders
    FastAPI --> TrustedURL
    FastAPI --> CSRF
    CSRF --> AuditMW
    AuditMW --> Audit
    Browser -->|prompt| FastAPI
    FastAPI --> AI
    AI --> BestOfN
    BestOfN -->|generate xml| Ollama
    AI -->|save| Store
    Store --> SQLite
    Browser -->|loads| DrawioEmbed
    DrawioEmbed --> ShapeLibs
    ShapeLibs --> AWSVersioned
    AI -.->|library hint| NetLib
    DrawioEmbed --> DarkParam
    DrawioEmbed --> PngExport
    FastAPI -->|WebSocket upgrade| CSWSHGuard
    CSWSHGuard --> XMLGuard
    XMLGuard --> UpdateLocks
    UpdateLocks --> Store
    UpdateLocks --> Presence
    Presence -->|broadcast active users| Browser
    FastAPI -->|WebSocket update and cursor| Browser

    classDef user fill:#1a1a2e,stroke:#e85555,stroke-width:2px,color:#fff
    classDef app fill:#16213e,stroke:#e8a020,stroke-width:2px,color:#e0e0e0
    classDef sec fill:#1a1420,stroke:#c880ff,stroke-width:2px,color:#e0e0e0
    classDef data fill:#16213e,stroke:#64b5f6,stroke-width:2px,color:#e0e0e0
    classDef llm fill:#16213e,stroke:#3ecf6e,stroke-width:2px,color:#e0e0e0
    classDef audit fill:#16213e,stroke:#ff6b9d,stroke-width:2px,color:#e0e0e0
    classDef infra fill:#0f0f0f,stroke:#8888a8,stroke-width:1px,color:#8888a8
    classDef persist fill:#0f1020,stroke:#64b5f6,stroke-width:1px,color:#8888a8
    classDef drawio fill:#1a2a1a,stroke:#3ecf6e,stroke-width:2px,color:#e0e0e0

    class Browser user
    class FastAPI,Auth,AI,BestOfN,Store,Tenant,AuditMW,UpdateLocks,Presence app
    class RateLimit,SecHeaders,TrustedURL,CSWSHGuard,CSRF,XMLGuard sec
    class SQLite data
    class Ollama llm
    class Audit audit
    class CF,Docker infra
    class SessionSecret,JWTSecret persist
    class ShapeLibs,AWSVersioned,NetLib,DarkParam,PngExport drawio