System Overview

High-level architecture of the Student Information System.

Architecture Diagram

┌─────────────────────────────────────────────────────────────┐
│                        Client                               │
│                 (Browser / Mobile)                          │
└─────────────────────────┬───────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────┐
│                   Vue 3 Frontend                            │
│     ┌─────────┐  ┌─────────┐  ┌─────────┐  ┌─────────┐     │
│     │ Router  │  │ Stores  │  │  Views  │  │Components│     │
│     │(Vue Rtr)│  │(Pinia)  │  │  (.vue) │  │  (.vue) │     │
│     └────┬────┘  └────┬────┘  └────┬────┘  └────┬────┘     │
│          └───────────┬┴───────────┴┬───────────┘           │
│                      │             │                        │
│                      ▼             ▼                        │
│              ┌─────────────────────────┐                   │
│              │    API Services         │                   │
│              │    (Axios + Types)      │                   │
│              └───────────┬─────────────┘                   │
└──────────────────────────┼──────────────────────────────────┘
                           │ HTTP/REST (cookies)
                           ▼
┌─────────────────────────────────────────────────────────────┐
│                    Go Backend (net/http)                    │
│     ┌─────────┐  ┌─────────┐  ┌─────────┐  ┌─────────┐     │
│     │ Router  │  │Handlers │  │Services │  │  Repos  │     │
│     │ (mux)   │  │ (HTTP)  │  │ (Logic) │  │  (DB)   │     │
│     └────┬────┘  └────┬────┘  └────┬────┘  └────┬────┘     │
│          └───────────┬┴───────────┴┬───────────┘           │
│                      │             │                        │
│                      ▼             ▼                        │
│              ┌─────────────────────────┐                   │
│              │   Domain Modules        │                   │
│              │  (19 + lmsintegration)  │                   │
│              └───────────┬─────────────┘                   │
└──────────────────────────┼──────────────────────────────────┘
                           │ SQL (lib/pq)
                           ▼
┌─────────────────────────────────────────────────────────────┐
│                      PostgreSQL                             │
│                    (SIS Database)                           │
└─────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────┐
│                Valkey / Redis (Required)                    │
│              (Server-side session storage)                  │
└─────────────────────────────────────────────────────────────┘

Request Flow

1. User Action - User interacts with Vue component
2. API Call - Component calls API service
3. HTTP Request - Axios sends request with session cookie
4. Middleware - Request passes through middleware chain:
   • CORS
   • Security headers (XSS, clickjacking, content-type)
   • Body limit (1MB)
   • Request timeout (60s)
   • Request ID
   • Real IP extraction
   • Locale detection
   • Logging (structured JSON via slog)
   • Panic recovery
5. Authentication - Session cookie validated via Valkey lookup
6. CSRF Check - CSRF token validated for state-changing requests (POST, PUT, PATCH, DELETE)
7. Handler - HTTP handler parses request, validates input
8. Service - Business logic layer processes the request
9. Repository - Data access layer queries PostgreSQL
10. Response - Data returned through handler as JSON
11. State Update - Pinia store updated if needed
12. UI Update - Vue reactively updates display

Domain-Driven Design

The system is organized by business domain:

Backend Domains (19 total)

internal/domain/
├── academic/       # Courses, degrees, requirements, scheduling, materials
├── audit/          # Degree progress, graduation, transfer credits
├── authentication/ # Session auth, user management, magic links
├── authorization/  # RBAC, permissions, impersonation, dashboard tiles
├── billing/        # Tuition, fees, payments, refund schedules
├── core/           # Lookups, settings, email templates, currencies
├── financialaid/   # FAFSA, awards, cost estimates
├── formbuilder/    # Dynamic forms for applications
├── grading/        # Grades, GPA, transcripts
├── organization/   # Campuses, buildings, departments, colleges
├── people/         # Person records, demographics, photos
├── proxy/          # Parent/guardian delegated access
├── registration/   # Enrollment, holds, waitlists, planning
├── reporting/      # Reports, IPEDS
├── roles/          # Students, teachers, advisors, cohorts
├── testscores/     # SAT, ACT, standardized tests, superscoring
└── workflow/       # Registration workflows, automation rules

Frontend Structure

src/
├── api/           # API services and types (36 services)
├── components/    # Reusable components (67 components)
├── composables/   # Vue composables
├── router/        # Route definitions (147 routes)
├── stores/        # Pinia state stores (10 stores)
├── locales/       # i18n translation files
└── views/         # Page components (147 views, 18 directories)

Key Design Decisions

Go Standard Library HTTP

Uses Go 1.22+ net/http with enhanced routing:

• Pattern matching with path parameters (GET /api/v1/people/{personID})
• Method-based routing built into patterns
• No external router dependency
• Middleware chaining via custom chain utility

Domain Module Pattern

Each domain follows a consistent 6-file structure:

• model.go - Database entity structs
• dto.go - Request/Response DTOs with validation tags
• repository.go - Data access layer
• service.go - Business logic layer
• handler.go - HTTP request handlers
• routes.go - Route registration

Session-Based Authentication

Server-side session management with Valkey/Redis:

• Opaque session IDs stored in sis_session HttpOnly cookie
• Session data stored as JSON in Valkey with configurable TTL (default 4h)
• Sliding window renewal on each request
• Absolute session lifetime cap (default 12h)
• CSRF protection via sis_csrf cookie (readable by JavaScript) and X-CSRF-Token header
• sis_logged_in cookie (not HttpOnly) for JavaScript to check auth state
• Instant session revocation via Valkey key deletion
• Django-compatible password hashing (PBKDF2-SHA256)

Lookup Values

Configurable reference data:

• Stored in individual lookup_* tables (e.g., lookup_program_status)
• ~110 lookup types registered in core/lookup_registry.go
• Avoids hardcoded constants
• Admin-configurable via UI
• Used for statuses, types, categories

PostgreSQL with lib/pq

• Standard database/sql interface with lib/pq driver
• Connection pooling via sql.DB (default 25 max connections)
• Custom QueryBuilder for dynamic SQL construction
• Generic ScanRows[T]() for typed row scanning
• Parameterized queries ($1, $2, ...) for SQL injection prevention
• Context-aware queries with timeouts