The Big Pivot: Node.js Architecture

Why Node.js?

The decision to pivot wasn’t about Node.js being “better” than Laravel. It was about choosing
the right tool for our specific requirements. Here’s why Node.js won:

The New Architecture

Dual Database Pattern

The most important architectural decision was separating data into two databases:

┌─────────────────────┐    ┌─────────────────────┐
│   timos_platform    │    │    timos_vault      │
├─────────────────────┤    ├─────────────────────┤
│ • users             │    │ • daily_entries     │
│ • auth_sessions     │    │ • feels_entries     │
│ • oauth_accounts    │    │ • pillars           │
│ • subscriptions     │    │ • weekly_recaps     │
│ • user_deks         │    │ • morning_habits    │
│ • audit_logs        │    │ ALL ENCRYPTED       │
└─────────────────────┘    └─────────────────────┘

Project Structure

api/
├── src/
│   ├── index.ts           # Express entry point
│   ├── middleware/
│   │   ├── auth.ts        # JWT verification
│   │   ├── rateLimit.ts   # Rate limiting
│   │   └── csrf.ts        # CSRF protection
│   ├── services/
│   │   ├── auth.ts        # Signup, login, MFA
│   │   ├── oauth.ts       # Microsoft, Google, Apple
│   │   ├── encryption.ts  # MEK/DEK management
│   │   ├── pillars.ts     # Pillar CRUD
│   │   ├── dailyEntries.ts
│   │   ├── feelsEntries.ts
│   │   └── ...
│   ├── routes/
│   │   ├── auth.ts
│   │   ├── pillars.ts
│   │   └── ...
│   └── prisma/
│       ├── platform.prisma
│       └── vault.prisma
└── package.json

Building in 5.5 Hours

Here’s how we structured the sprint:

The Express Setup

Our Express configuration prioritizes security from the start:

// api/src/index.ts
import express from 'express';
import helmet from 'helmet';
import cors from 'cors';
import rateLimit from 'express-rate-limit';

const app = express();

// Security headers
app.use(helmet());

// CORS for frontend
app.use(cors({
  origin: process.env.FRONTEND_URL,
  credentials: true,
}));

// Rate limiting
app.use(rateLimit({
  windowMs: 60 * 1000, // 1 minute
  max: 100, // 100 requests per minute
}));

// Body parsing with size limit
app.use(express.json({ limit: '1mb' }));

// Routes
app.use('/api/auth', authRoutes);
app.use('/api/pillars', authenticateToken, pillarRoutes);
app.use('/api/entries', authenticateToken, entryRoutes);
// ...

app.listen(8000);

Prisma Configuration

Running two Prisma clients requires some setup:

// Platform schema (platform.prisma)
generator client {
  provider = "prisma-client-js"
  output   = "../node_modules/.prisma/platform"
}

datasource db {
  provider = "mysql"
  url      = env("DATABASE_URL")
}

// Vault schema (vault.prisma)
generator client {
  provider = "prisma-client-js"
  output   = "../node_modules/.prisma/vault"
}

datasource db {
  provider = "mysql"
  url      = env("VAULT_DATABASE_URL")
}

// Using both clients
import { PrismaClient as PlatformClient } from '.prisma/platform';
import { PrismaClient as VaultClient } from '.prisma/vault';

export const platformDb = new PlatformClient();
export const vaultDb = new VaultClient();

What Made This Possible

Rebuilding an entire backend in 5.5 hours sounds impossible. Here’s what made it work:

1. Clear Requirements: Sessions 1-2 taught us exactly what we needed.
   No exploratory design work – we knew the data model, the auth flow, the API shape.
2. AI Pair Programming: Claude Code generated boilerplate, caught type errors,
   and suggested patterns. We focused on architecture decisions.
3. TypeScript + Prisma: Type safety meant fewer bugs. Prisma’s schema
   language made database design declarative.
4. No Perfectionism: We built the minimum viable backend. Polish would come later.
   Working code beats perfect code.

What’s Next

With the architecture in place, the next post dives deep into the encryption layer – the whole reason
we made this pivot. We’ll cover:

• Envelope encryption (MEK/DEK) implementation
• Per-user key generation
• Crypto-shredding capability
• Performance considerations