Architecture

Auva is not a single application. It's a distributed ecosystem of interconnected services, each purpose-built for its domain, unified by a shared authentication layer and a consistent design language.

High-Level Overview

┌─────────────────────────────────────────────────┐
│                 Auva Ecosystem                   │
│                                                  │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐       │
│  │ Auva Go  │  │Auva Mail │  │Auva Notes│       │
│  │go.auva.dev│ │auva.email│  │notes.*   │       │
│  └────┬─────┘  └────┬─────┘  └────┬─────┘       │
│       │              │              │             │
│       └──────────────┼──────────────┘             │
│                      │                            │
│              ┌───────▼──────────────────┐         │
│              │     Auva Auth API       │         │
│              │   auth.auva.dev         │         │
│              │  JWT + Refresh Tokens   │         │
│              │  OAuth / SSO Provider   │         │
│              └─────────────────────────┘         │
│                                                  │
│              ┌─────────────────────────┐         │
│              │   Auva Account Hub     │         │
│              │     auva.dev           │         │
│              │  User profiles, settings│         │
│              └─────────────────────────┘         │
└─────────────────────────────────────────────────┘

Core Principles

Unified Authentication

Every service in the Auva ecosystem authenticates through Auva Auth (auth.auva.dev). A single account unlocks access to all products. The auth system uses:

• JWT Access Tokens: Short-lived (15 min), carried in Authorization: Bearer headers
• HTTP-Only Refresh Tokens: Long-lived, stored as secure cookies
• Cross-Origin Session Sharing: All *.auva.dev subdomains share session state

Domain Isolation

Each product runs on its own subdomain with its own deployment pipeline:

| Auth API | auth.auva.dev | Node.js, Express, MongoDB | | Docs | docs.auva.dev | Next.js, MDX |

Shared Design Language

All products follow the same design system:

• Typography: DM Sans (body), Fraunces (display), Source Serif 4 (editorial)
• Color Palette: Slate backgrounds (#f8fafc), blue accents (#2563eb)
• Components: Consistent border treatments, glassmorphism effects, micro-animations

Data Flow

Authentication Flow

User → auva.dev/login
  → POST /auth/login (auth.auva.dev)
  → Returns: { accessToken, user }
  → Sets: httpOnly refresh cookie
  → Redirect to dashboard or product

Cross-Product Navigation

When a user navigates between products (e.g., from auva.dev to go.auva.dev):

1. The target app checks for an existing refresh token cookie
2. If found, it calls POST /auth/refresh to get a fresh access token
3. The user is seamlessly authenticated without re-entering credentials
4. If no cookie exists, the user sees a "Sign in" link redirecting to auva.dev/login

Technology Stack