Architecture
Overview

Architecture Overview

lk-wiz is a serverless application on AWS, deployed to two isolated accounts (dev and prod) in eu-central-1.

Components

  • S3 + CloudFront serve the statically exported Next.js 14 frontend. CloudFront uses Origin Access Control (OAC) to read the private S3 origin and terminates a custom domain with an ACM certificate.
  • API Gateway (HTTP) handles all REST traffic. Routes are split across handler Lambdas by domain (ideas, posts, genai, workspaces, prompts, examples, actions, admin, quick capture), fronted by a shared Lambda Authorizer that validates Cognito JWTs.
  • API Gateway (WebSocket) handles real-time collaboration. Routes: $connect (auth + join), $disconnect (leave), and $default (document updates, awareness, and heartbeats).
  • DynamoDB main table is a single-table design (pk/sk + GSI1 + GSI2) holding users, workspaces, members, ideas, posts, versions, prompts, examples, actions, publishing slots, Yjs documents, quick-capture tokens, and workspace settings.
  • DynamoDB connections table tracks active WebSocket connections with a TTL for automatic cleanup.
  • Bedrock (eu.anthropic.claude-sonnet-4-6, per customer_specs.yaml) powers post generation, canvas iteration, and auto-proofreading. Generation is buffered, not streamed — API Gateway's HTTP API doesn't support Lambda response streaming, so each call returns a single JSON payload once Bedrock finishes.
  • Cognito provides Google social login and email/password auth, with three Lambda triggers: pre-signup, post-confirmation, and pre-token-generation.
  • Slack SDK delivers all notifications (registrations, approvals, reviews, reminders, actions) as bot-token DMs; there is no per-workspace webhook override.
  • SES backs only Cognito's own built-in emails (e.g. email verification) — it does not send workspace-invitation emails; invite_member only writes a pending-invite record.
  • EventBridge runs a single daily cron (06:00 CET) for auto-scheduling, reminders, and missed-schedule detection.
  • CloudWatch + AppSignals provide logging, user-focused custom metrics (the lkwiz namespace), and distributed tracing via the ADOT Lambda layer.
  • Secrets Manager stores the Slack bot token, Google OAuth credentials, and reCAPTCHA Enterprise config, all encrypted with KMS.
  • AWS Backup runs automated backups twice daily of DynamoDB tables and S3 buckets to a KMS-encrypted vault (30-day retention), complementing DynamoDB PITR.
  • KMS encrypts DynamoDB, S3, CloudWatch Logs, Secrets Manager, and the backup vault at rest.

Request flow (REST)

Browser → CloudFront → API Gateway (HTTP) → Lambda Authorizer (JWT)
        → domain handler Lambda → DynamoDB / Bedrock / S3

Request flow (real-time)

Browser (Yjs) ⇄ API Gateway (WebSocket) → Collab Lambda
              → DynamoDB (connections + Yjs doc state)

See Authentication, GenAI Generation, and Real-Time Collaboration for the details of each flow.

MCP Server & Agent ToolsAuthentication