database-first

Database-first architecture centralizes all business logic and state in PostgreSQL using stored procedures and views as the source of truth, while the frontend remains presentation-only. This enforces separation of concerns: the database handles game logic, state validation, and computations; edge functions manage LLM and embedding integration; the frontend renders UI only.

The RPC pattern exposes database functions as callable endpoints. SECURITY DEFINER functions execute with the privileges of the function owner rather than the caller, enabling secure, centralized authorization logic. Combined with explicit search_path configuration, this prevents SQL injection and enforces consistent permission checks across all database calls.

Enforce database-first discipline by moving all decision logic—confidence scoring, turn determination, candidate filtering, and game state validation—into PostgreSQL stored procedures. The frontend receives only presentation data and UI instructions from the database, eliminating duplicate or conflicting business rules.

Use stored procedures for all business logic that determines application state or behavior: validation rules, computed values, filtering criteria, and state transitions. This approach centralizes rules in PostgreSQL, simplifies testing, and ensures edge functions and frontends cannot bypass or override critical logic.

Database-first architecture reduces attack surface by eliminating logic duplication across frontends and edge services. SECURITY DEFINER functions with explicit search_path prevent privilege escalation and SQL injection. A single source of truth for business rules ensures consistent enforcement and simplifies security audits.

Yes. Database-first architecture explicitly separates the database layer from frontend presentation. Any frontend framework—React, Vue, Svelte—can consume data and UI instructions from PostgreSQL via RPC endpoints, as long as the frontend enforces no business logic and edge functions handle only LLM or embedding tasks.