Underwriting Runtime Architecture

Underwriting Runtime Architecture An architecture diagram generated by Archify. React Frontend · underwritting_web · Running today React Frontend underwritting_web Postman / pytest / Notebook · API-only test & demo clients · Running today Postman / pytest / Notebook API-only test & demo clients CORS + Rate Limit · public + admin routes alike · Running today › FastAPI app (underwritting_api) CORS + Rate Limit public + admin routes alike Routers · products.py, quotes.py, admin.py · Running today › FastAPI app (underwritting_api) Routers products.py, quotes.py, admin.py asyncpg Pool · db.py, search_path=myins · Running today › FastAPI app (underwritting_api) asyncpg Pool db.py, search_path=myins Neon Postgres · uw_app role, direct/unpooled · Running today Neon Postgres uw_app role, direct/unpooled Postgres 16 (docker) · SQL test suite only, isolated · SQL test suite — separate from live traffic Postgres 16 (docker) SQL test suite only, isolated Vercel · React frontend — deployed · Production hosting Vercel React frontend — deployed Render · FastAPI — deployed · Production hosting Render FastAPI — deployed HTTPS HTTP asyncpg SQL over TLS HTTPS direct, unpooled deployed to Running today FastAPI app (underwritting_api) SQL test suite — separate from live traffic Production hosting Legend Frontend Backend Database Cloud Security External

Request path

  • • Every request — public or admin — passes CORS then rate-limit middleware before reaching a router
  • • GET /health round-trips Postgres directly, not just process liveness

Rate limiting

  • • slowapi, in-memory storage, keyed by X-Forwarded-For (not raw socket IP)
  • • 60/min default; POST /quotes 10/min, /answers 30/min, /evaluate 20/min; all four admin routes 20/min

Quote-ownership token

  • • X-Quote-Token required on /answers and /evaluate
  • • A wrong token and an unknown quote_id return the identical 404 — no oracle

Admin key

  • • Single static X-Admin-Key, checked with secrets.compare_digest (not !=)
  • • Gates catalog writes and the rules-read endpoint — a rule's conditions are the answer key

Production status

  • • Full stack deployed: Vercel to Render to Neon, all real
  • • Render's ALLOWED_ORIGINS includes the exact Vercel origin, no trailing slash