# tsi-coop/tsi-dpdp-cms architecture

> Architecture diagram of the GitHub repository tsi-coop/tsi-dpdp-cms, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/tsi-coop/tsi-dpdp-cms
- Repository: https://github.com/tsi-coop/tsi-dpdp-cms

## Overview

TSI DPDP CMS is a consent-management service for Data Fiduciaries and Consent Managers. Its documented workflow is to configure fiduciaries and apps, author and publish policies from RoPA, capture and verify consent, and handle rights requests, notifications, and compliance enforcement. The graph covers the API framework, principal domain stages, and scheduled purge/webhook capabilities. Several services are represented from the README and source index; their internal calls are not inferred where excerpts do not show them.

Main entry points: [`src/org/tsicoop/dpdpcms/framework/PoolDB.java`](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/PoolDB.java) (Database pool), [`src/org/tsicoop/dpdpcms/framework/InterceptingFilter.java`](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/InterceptingFilter.java) (Request routing), [`src/org/tsicoop/dpdpcms/framework/WebhookDispatcher.java`](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/WebhookDispatcher.java) (Webhook dispatch), [`src/org/tsicoop/dpdpcms/framework/InputProcessor.java`](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/InputProcessor.java) (Input and auth)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_api["API runtime"]
  node_gateway["Request routing"]
  node_input["Input and auth"]
  node_action["Action dispatch<br/>[Action.java]"]
  node_output["Response handling"]
  node_db[("Database pool<br/>[PoolDB.java]")]
  node_encryption["Database encryption<br/>[DbEncryption.java]"]
  node_jwt["Token security<br/>[JWTUtil.java]"]
end

subgraph group_admin["Administration"]
  node_fiduciary["Fiduciary setup<br/>[Fiduciary.java]"]
  node_apps["App registration<br/>[App.java]"]
  node_ropa["RoPA authoring<br/>[Ropa.java]"]
  node_derive["RoPA derivation<br/>[RopaDeriver.java]"]
end

subgraph group_consent["Consent lifecycle"]
  node_policy["Policy lifecycle<br/>[Policy.java]"]
  node_consent_service["Consent operations<br/>[Consent.java]"]
  node_principal_service["Principal records<br/>[Principal.java]"]
  node_wallet["Consent wallet<br/>[Wallet.java]"]
end

subgraph group_rights["Rights and compliance"]
  node_rights_portal["Rights portal<br/>[portal.js]"]
  node_grievance["Grievance handling<br/>[Grievance.java]"]
  node_breach["Breach reporting<br/>[Breach.java]"]
  node_compliance["Compliance workflows<br/>[Compliance.java]"]
  node_audit["Audit records<br/>[Audit.java]"]
  node_legal["Legal evidence<br/>[Legal.java]"]
end

subgraph group_ops["Jobs and delivery"]
  node_jobs["Scheduled jobs<br/>[JobManager.java]"]
  node_ces["Erasure enforcement<br/>[CESService.java]"]
  node_notifications["Notifications<br/>[Notification.java]"]
  node_webhooks["Webhook dispatch"]
end

node_integrator(("Fiduciary / processor"))
node_principal(("Data principal"))
node_external_webhook(("Fiduciary endpoint"))

node_integrator -->|"sends requests"| node_gateway
node_gateway -->|"processes input"| node_input
node_gateway -->|"dispatches actions"| node_action
node_gateway -->|"formats responses"| node_output
node_input -->|"checks client"| node_db
node_input -->|"uses tokens"| node_jwt
node_apps -->|"checks ownership"| node_fiduciary
node_fiduciary -->|"persists setup"| node_db
node_apps -->|"persists apps"| node_db
node_ropa -->|"uses derivation"| node_derive
node_derive -->|"reads and writes"| node_db
node_policy -->|"uses RoPA data"| node_derive
node_policy -->|"persists policies"| node_db
node_consent_service -.->|"records consent"| node_principal_service
node_principal -->|"exercises rights"| node_rights_portal
node_jobs -->|"runs purge"| node_ces
node_jobs -->|"runs compliance"| node_compliance
node_ces -->|"dispatches events"| node_webhooks
node_notifications -->|"dispatches events"| node_webhooks
node_webhooks -->|"posts events"| node_external_webhook
node_webhooks -->|"tracks delivery"| node_db
node_breach -.->|"records activity"| node_audit
node_grievance -.->|"records activity"| node_audit
node_audit -->|"supports evidence"| node_legal

click node_gateway "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/InterceptingFilter.java"
click node_input "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/InputProcessor.java"
click node_action "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/Action.java"
click node_output "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/OutputProcessor.java"
click node_db "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/PoolDB.java"
click node_encryption "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/DbEncryption.java"
click node_jwt "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/JWTUtil.java"
click node_fiduciary "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Fiduciary.java"
click node_apps "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/App.java"
click node_ropa "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Ropa.java"
click node_derive "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/util/RopaDeriver.java"
click node_policy "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Policy.java"
click node_consent_service "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Consent.java"
click node_principal_service "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Principal.java"
click node_wallet "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Wallet.java"
click node_rights_portal "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/web/rights/portal.js"
click node_grievance "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Grievance.java"
click node_breach "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Breach.java"
click node_compliance "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Compliance.java"
click node_audit "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Audit.java"
click node_legal "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Legal.java"
click node_jobs "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/job/JobManager.java"
click node_ces "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/ces/CESService.java"
click node_notifications "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Notification.java"
click node_webhooks "https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/WebhookDispatcher.java"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_gateway,node_input,node_action,node_output,node_db,node_encryption,node_jwt toneBlue
class node_fiduciary,node_apps,node_ropa,node_derive toneAmber
class node_policy,node_consent_service,node_principal_service,node_wallet toneMint
class node_rights_portal,node_grievance,node_breach,node_compliance,node_audit,node_legal toneRose
class node_jobs,node_ces,node_notifications,node_webhooks,node_integrator,node_principal,node_external_webhook toneIndigo
```

## Components

### API runtime

- [Request routing](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/InterceptingFilter.java): `src/org/tsicoop/dpdpcms/framework/InterceptingFilter.java`
- [Input and auth](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/InputProcessor.java): `src/org/tsicoop/dpdpcms/framework/InputProcessor.java`
- [Action dispatch](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/Action.java): `src/org/tsicoop/dpdpcms/framework/Action.java`
- [Response handling](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/OutputProcessor.java): `src/org/tsicoop/dpdpcms/framework/OutputProcessor.java`
- [Database pool](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/PoolDB.java): `src/org/tsicoop/dpdpcms/framework/PoolDB.java`
- [Database encryption](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/DbEncryption.java): `src/org/tsicoop/dpdpcms/framework/DbEncryption.java`
- [Token security](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/JWTUtil.java): `src/org/tsicoop/dpdpcms/framework/JWTUtil.java`

### Administration

- [Fiduciary setup](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Fiduciary.java): `src/org/tsicoop/dpdpcms/service/v1/Fiduciary.java`
- [App registration](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/App.java): `src/org/tsicoop/dpdpcms/service/v1/App.java`
- [RoPA authoring](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Ropa.java): `src/org/tsicoop/dpdpcms/service/v1/Ropa.java`
- [RoPA derivation](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/util/RopaDeriver.java): `src/org/tsicoop/dpdpcms/util/RopaDeriver.java`

### Consent lifecycle

- [Policy lifecycle](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Policy.java): `src/org/tsicoop/dpdpcms/service/v1/Policy.java`
- [Consent operations](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Consent.java): `src/org/tsicoop/dpdpcms/service/v1/Consent.java`
- [Principal records](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Principal.java): `src/org/tsicoop/dpdpcms/service/v1/Principal.java`
- [Consent wallet](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Wallet.java): `src/org/tsicoop/dpdpcms/service/v1/Wallet.java`

### Rights and compliance

- [Rights portal](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/web/rights/portal.js): `web/rights/portal.js`
- [Grievance handling](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Grievance.java): `src/org/tsicoop/dpdpcms/service/v1/Grievance.java`
- [Breach reporting](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Breach.java): `src/org/tsicoop/dpdpcms/service/v1/Breach.java`
- [Compliance workflows](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Compliance.java): `src/org/tsicoop/dpdpcms/service/v1/Compliance.java`
- [Audit records](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Audit.java): `src/org/tsicoop/dpdpcms/service/v1/Audit.java`
- [Legal evidence](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Legal.java): `src/org/tsicoop/dpdpcms/service/v1/Legal.java`

### Jobs and delivery

- [Scheduled jobs](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/job/JobManager.java): `src/org/tsicoop/dpdpcms/job/JobManager.java`
- [Erasure enforcement](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/ces/CESService.java): `src/org/tsicoop/dpdpcms/ces/CESService.java`
- [Notifications](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/service/v1/Notification.java): `src/org/tsicoop/dpdpcms/service/v1/Notification.java`
- [Webhook dispatch](https://github.com/tsi-coop/tsi-dpdp-cms/blob/main/src/org/tsicoop/dpdpcms/framework/WebhookDispatcher.java): `src/org/tsicoop/dpdpcms/framework/WebhookDispatcher.java`

### Other components

- **Fiduciary / processor**
- **Data principal**
- **Fiduciary endpoint**

## Connections

- Fiduciary / processor → Request routing: sends requests (evidence: `README.md`)
- Request routing → Input and auth: processes input (evidence: `src/org/tsicoop/dpdpcms/framework/InterceptingFilter.java`)
- Request routing → Action dispatch: dispatches actions (evidence: `src/org/tsicoop/dpdpcms/framework/InterceptingFilter.java`)
- Request routing → Response handling: formats responses (evidence: `src/org/tsicoop/dpdpcms/framework/InterceptingFilter.java`)
- Input and auth → Database pool: checks client (evidence: `src/org/tsicoop/dpdpcms/framework/InputProcessor.java`)
- Input and auth → Token security: uses tokens (evidence: `src/org/tsicoop/dpdpcms/framework/InterceptingFilter.java`)
- App registration → Fiduciary setup: checks ownership (evidence: `src/org/tsicoop/dpdpcms/service/v1/App.java`)
- Fiduciary setup → Database pool: persists setup (evidence: `src/org/tsicoop/dpdpcms/service/v1/Fiduciary.java`)
- App registration → Database pool: persists apps (evidence: `src/org/tsicoop/dpdpcms/service/v1/App.java`)
- RoPA authoring → RoPA derivation: uses derivation (evidence: `src/org/tsicoop/dpdpcms/service/v1/Ropa.java`)
- RoPA derivation → Database pool: reads and writes (evidence: `src/org/tsicoop/dpdpcms/util/RopaDeriver.java`)
- Policy lifecycle → RoPA derivation: uses RoPA data (evidence: `src/org/tsicoop/dpdpcms/service/v1/Policy.java`)
- Policy lifecycle → Database pool: persists policies (evidence: `src/org/tsicoop/dpdpcms/service/v1/Policy.java`)
- Consent operations → Principal records: records consent
- Data principal → Rights portal: exercises rights (evidence: `README.md`)
- Scheduled jobs → Erasure enforcement: runs purge (evidence: `src/org/tsicoop/dpdpcms/job/JobManager.java`)
- Scheduled jobs → Compliance workflows: runs compliance (evidence: `src/org/tsicoop/dpdpcms/job/JobManager.java`)
- Erasure enforcement → Webhook dispatch: dispatches events (evidence: `src/org/tsicoop/dpdpcms/ces/CESService.java`)
- Notifications → Webhook dispatch: dispatches events (evidence: `src/org/tsicoop/dpdpcms/service/v1/Notification.java`)
- Webhook dispatch → Fiduciary endpoint: posts events (evidence: `src/org/tsicoop/dpdpcms/framework/WebhookDispatcher.java`)
- Webhook dispatch → Database pool: tracks delivery (evidence: `src/org/tsicoop/dpdpcms/framework/WebhookDispatcher.java`)
- Breach reporting → Audit records: records activity
- Grievance handling → Audit records: records activity
- Audit records → Legal evidence: supports evidence (evidence: `README.md`)