SynkronyXr© Platform - Architecture and Identity Design

1. Purpose

This document defines the end-to-end architecture and identity model for the SynkronyXr platform, with Event Route Optimiser (ERO) as the first product line implementation.

2. Platform Architecture

SynkronyXr is built as an offline-first, edge-accelerated platform with a governed Azure system of record.

flowchart TD
  A[Astro PWA Clients\nERO, LBM, Future Apps] -->|OAuth2/OIDC + PKCE| B[Cloudflare Edge Workers]
  B --> C[D1 SQLite\nOffline/Edge Data]
  B --> D[Azure Workload APIs]
  D --> E[Azure Product Subscriptions\nsub-sknx-ero-* / sub-sknx-lbm-*]
  D --> F[Microsoft Entra External ID\nCIAM Tenants]

3. Identity Model: Sign in with SynkronyXr

Identity is federated and centralized for consistent user experience across product lines.

flowchart LR
  U[End User] --> X[Sign in with SynkronyXr]
  X --> C[Central SynkronyXr Cloud Identity\nEntra External ID]
  C --> G[Google]
  C --> A[Apple]
  C --> F[Facebook]
  C --> M[Microsoft]
  C --> E[Email OTP / Password]
  X --> P1[ERO App]
  X --> P2[LBM App]
  X --> P3[Future Product Apps]

3.1 Environment Isolation

Production and non-production are isolated at both workload and CIAM tenant boundaries.

Environment	Workload Subscription	CIAM Tenant Purpose
development	sub-sknx-ero-nonproduction	Dev identity validation
test	sub-sknx-ero-nonproduction	Integration and pre-release validation
production	sub-sknx-ero-production	Live customer authentication

4. CAF Landing Zone Topology

Tenant Root Group
└── synkronyx
  ├── synkronyx-platform
  ├── synkronyx-shared-services
  └── synkronyx-landingzones
    ├── synkronyx-ero
    │   ├── sub-sknx-ero-nonproduction
    │   └── sub-sknx-ero-production
    └── synkronyx-lbm
      ├── sub-sknx-lbm-nonproduction
      └── sub-sknx-lbm-production

5. IaC Deployment Model (Two-Stage)

The deployment pipeline follows two explicit Bicep stages.

1. Tenant deployment via infra/main.bicep. This stage creates and/or aligns management groups and subscription vending outputs.

2. Identity deployment via infra/identity.bicep. This stage deploys platform identity resources scoped to the platform subscription and wires product subscription references.

6. Security and Operational Controls

• OAuth 2.0 / OIDC with PKCE for public clients.
• JWT validation at Cloudflare edge before API access.
• Environment-level separation for blast-radius control.
• Tags for cost allocation by product and environment.

7. Brand and UX Baseline

• Brand mark: SynkronyXr.
• Primary typeface: Plus Jakarta Sans.
• Design direction: high-contrast, data-forward, mobile-first interfaces.

8. Implementation References

• infra/main.bicep
• infra/identity.bicep
• infra/modules/landing-zone.bicep
• infra/modules/identity.bicep
• scripts/deploy-landingzone.ps1