# curityio/kafka-zero-trust architecture

> Architecture diagram of the GitHub repository curityio/kafka-zero-trust, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/curityio/kafka-zero-trust
- Repository: https://github.com/curityio/kafka-zero-trust

## Overview

Kafka Zero Trust is a demonstration of secure asynchronous messaging between an Orders API and an Invoices API. A user authenticates in the console client, submits an order through the gateway, and the Orders API prices and records it before exchanging the user token for a reduced-privilege, long-lived token bound to the event and transaction. It publishes the event to Kafka; the Invoices API validates the token before calculating and recording an invoice. The README documents this end-to-end behavior; some internal route and consumer wiring is not shown in the sampled source.

Main entry points: [`orders-api/src/logic/ordersService.ts`](https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/logic/ordersService.ts) (Order service), [`invoices-api/src/logic/invoicingService.ts`](https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/logic/invoicingService.ts) (Invoicing service), [`console-client/src/index.ts`](https://github.com/curityio/kafka-zero-trust/blob/main/console-client/src/index.ts) (Console client), [`invoices-api/src/infrastructure/messageBroker.ts`](https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/infrastructure/messageBroker.ts) (Kafka consumer)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_client["Client access"]
  node_console["Console client<br/>[index.ts]"]
  node_oauth_client["OAuth login<br/>[oauthClient.ts]"]
  node_api_client["Order request<br/>[apiClient.ts]"]
  node_gateway["API gateway<br/>[kong-template.yml]"]
end

subgraph group_orders["Order processing"]
  node_orders_http["Orders HTTP API<br/>[httpServer.ts]"]
  node_orders_service["Order service<br/>[ordersService.ts]"]
  node_price_calc["Price calculator<br/>[priceCalculator.ts]"]
  node_order_transaction["Order transaction"]
end

subgraph group_messaging["Secure messaging"]
  node_order_auth["Token exchange<br/>[authorizer.ts]"]
  node_order_event["Order event"]
  node_orders_broker["Kafka producer<br/>[messageBroker.ts]"]
  node_invoice_broker["Kafka consumer<br/>[messageBroker.ts]"]
  node_invoice_auth["Token validation<br/>[authorizer.ts]"]
end

subgraph group_invoices["Invoice processing"]
  node_invoice_http["Invoices HTTP API<br/>[httpServer.ts]"]
  node_invoice_service["Invoicing service"]
  node_amount_calc["Amount calculator"]
  node_invoice["Invoice<br/>[invoice.ts]"]
end

node_user(("User"))
node_identity["Identity server"]
node_kafka["Kafka"]

node_user -->|"starts"| node_console
node_console -->|"logs in"| node_oauth_client
node_oauth_client -->|"gets token"| node_identity
node_console -->|"submits order"| node_api_client
node_api_client -->|"sends request"| node_gateway
node_gateway -->|"routes request"| node_orders_http
node_orders_http -->|"creates order"| node_orders_service
node_orders_service -->|"calculates prices"| node_price_calc
node_orders_service -->|"records transaction"| node_order_transaction
node_orders_service -->|"exchanges token"| node_order_auth
node_order_auth -->|"exchanges token"| node_identity
node_orders_service -->|"builds event"| node_order_event
node_orders_service -->|"publishes event"| node_orders_broker
node_orders_broker -->|"sends message"| node_kafka
node_kafka -->|"delivers message"| node_invoice_broker
node_invoice_broker -->|"validates token"| node_invoice_auth
node_invoice_auth -->|"checks token"| node_identity
node_invoice_broker -->|"processes event"| node_invoice_service
node_invoice_http -.->|"handles request"| node_invoice_service
node_invoice_service -->|"calculates amount"| node_amount_calc
node_invoice_service -->|"records invoice"| node_invoice

click node_console "https://github.com/curityio/kafka-zero-trust/blob/main/console-client/src/index.ts"
click node_oauth_client "https://github.com/curityio/kafka-zero-trust/blob/main/console-client/src/oauthClient.ts"
click node_api_client "https://github.com/curityio/kafka-zero-trust/blob/main/console-client/src/apiClient.ts"
click node_gateway "https://github.com/curityio/kafka-zero-trust/blob/main/api-gateway/kong-template.yml"
click node_orders_http "https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/infrastructure/httpServer.ts"
click node_orders_service "https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/logic/ordersService.ts"
click node_price_calc "https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/logic/priceCalculator.ts"
click node_order_transaction "https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/logic/orderTransaction.ts"
click node_order_auth "https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/infrastructure/authorizer.ts"
click node_order_event "https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/logic/orderCreatedEvent.ts"
click node_orders_broker "https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/infrastructure/messageBroker.ts"
click node_invoice_broker "https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/infrastructure/messageBroker.ts"
click node_invoice_auth "https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/infrastructure/authorizer.ts"
click node_invoice_http "https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/infrastructure/httpServer.ts"
click node_invoice_service "https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/logic/invoicingService.ts"
click node_amount_calc "https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/logic/invoiceCalculator.ts"
click node_invoice "https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/logic/invoice.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_console,node_oauth_client,node_api_client,node_gateway,node_user toneBlue
class node_orders_http,node_orders_service,node_price_calc,node_order_transaction toneAmber
class node_order_auth,node_order_event,node_orders_broker,node_invoice_broker,node_invoice_auth,node_identity toneMint
class node_invoice_http,node_invoice_service,node_amount_calc,node_invoice toneRose
class node_kafka toneIndigo
```

## Components

### Client access

- [Console client](https://github.com/curityio/kafka-zero-trust/blob/main/console-client/src/index.ts): `console-client/src/index.ts`
- [OAuth login](https://github.com/curityio/kafka-zero-trust/blob/main/console-client/src/oauthClient.ts): `console-client/src/oauthClient.ts`
- [Order request](https://github.com/curityio/kafka-zero-trust/blob/main/console-client/src/apiClient.ts): `console-client/src/apiClient.ts`
- [API gateway](https://github.com/curityio/kafka-zero-trust/blob/main/api-gateway/kong-template.yml): `api-gateway/kong-template.yml`

### Order processing

- [Orders HTTP API](https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/infrastructure/httpServer.ts): `orders-api/src/infrastructure/httpServer.ts`
- [Order service](https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/logic/ordersService.ts): `orders-api/src/logic/ordersService.ts`
- [Price calculator](https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/logic/priceCalculator.ts): `orders-api/src/logic/priceCalculator.ts`
- [Order transaction](https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/logic/orderTransaction.ts): `orders-api/src/logic/orderTransaction.ts`

### Secure messaging

- [Token exchange](https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/infrastructure/authorizer.ts): `orders-api/src/infrastructure/authorizer.ts`
- [Order event](https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/logic/orderCreatedEvent.ts): `orders-api/src/logic/orderCreatedEvent.ts`
- [Kafka producer](https://github.com/curityio/kafka-zero-trust/blob/main/orders-api/src/infrastructure/messageBroker.ts): `orders-api/src/infrastructure/messageBroker.ts`
- [Kafka consumer](https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/infrastructure/messageBroker.ts): `invoices-api/src/infrastructure/messageBroker.ts`
- [Token validation](https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/infrastructure/authorizer.ts): `invoices-api/src/infrastructure/authorizer.ts`

### Invoice processing

- [Invoices HTTP API](https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/infrastructure/httpServer.ts): `invoices-api/src/infrastructure/httpServer.ts`
- [Invoicing service](https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/logic/invoicingService.ts): `invoices-api/src/logic/invoicingService.ts`
- [Amount calculator](https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/logic/invoiceCalculator.ts): `invoices-api/src/logic/invoiceCalculator.ts`
- [Invoice](https://github.com/curityio/kafka-zero-trust/blob/main/invoices-api/src/logic/invoice.ts): `invoices-api/src/logic/invoice.ts`

### Other components

- **User**
- **Identity server**
- **Kafka**

## Connections

- User → Console client: starts
- Console client → OAuth login: logs in
- OAuth login → Identity server: gets token
- Console client → Order request: submits order
- Order request → API gateway: sends request
- API gateway → Orders HTTP API: routes request
- Orders HTTP API → Order service: creates order
- Order service → Price calculator: calculates prices
- Order service → Order transaction: records transaction
- Order service → Token exchange: exchanges token
- Token exchange → Identity server: exchanges token
- Order service → Order event: builds event
- Order service → Kafka producer: publishes event
- Kafka producer → Kafka: sends message
- Kafka → Kafka consumer: delivers message
- Kafka consumer → Token validation: validates token
- Token validation → Identity server: checks token
- Kafka consumer → Invoicing service: processes event
- Invoices HTTP API → Invoicing service: handles request
- Invoicing service → Amount calculator: calculates amount
- Invoicing service → Invoice: records invoice