Flownotes

The core system is split into a Node.js/Express API layer, a React SPA, and a PostgreSQL database. The API exposes REST endpoints for user authentication, mindmap CRUD, and AI generation, all protected by JWT middleware that validates tokens stored in the Authorization header. The frontend communicates exclusively with these endpoints, never touching external AI services directly.

Data ingestion flows through the /api/mindmaps routes: a POST creates a new mindmap record, a GET retrieves a list or single map, and a PUT updates the JSON payload. The AI proxy (/api/ai/generate) accepts a provider field and forwards the request to the chosen backend service (Gemini or Ollama) using the server‑side API key stored in .env. The response, a JSON‑formatted mindmap, is returned to the client for rendering.

Execution begins with the Express router, which delegates to controller functions. Controllers call service modules that encapsulate business logic—e.g., MindmapService handles persistence via Prisma, while AIService orchestrates external calls. Middleware layers perform authentication, error handling, and logging, ensuring a clean separation of concerns.

Security guardrails include JWT authentication, rate limiting per user on AI routes, and environment‑based configuration via Docker and .env files. All secrets (DB URL, JWT secret, AI keys) are injected at container runtime, preventing exposure in the codebase. The deployment stack uses Docker Compose for local development and can be extended to cloud platforms with CI/CD pipelines.