Architecture

API Handler
QVSR uses Firebase Functions to handle the API, it is a NodeJS + Express serverless application. The orange endpoints require the user to be authenticated and to have a valid, non-expired token. While the blue boxes do not require the user to be authenticated.
Diagram:
