Requirements

Functional Requirements:

Create a web service for URL shortening. With the means of creating account, authentication via external authority, creating and saving short URLs from long URLs, changing the permissions and editing user profile. External registered and unregistered users should be able to follow the shortened URLs via HTTP redirects.

Detailed requirements

Authentication: via external authority (e.g. OIDC)

Authorization: an authenticated user can be owner of short URL, can have permissions to follow short URLs, has permissions to edit/delete/create own short URLs.

Web Interfaces:

control interface for authenticated user
authentication flow to/from external authority
web redirect when resolving short URLs.

Transactions:

The service is not critical, it does not need to have data integrity constraints

Compliance:

No requirements at all

Data retention:

User account is considered inactive when this user does not authenticate. 6 months of inactivity trigger the sending of warning email if the email address can be retrieved from authentication authority or outright specified in user profile. 1 month of inactivity after sending the warning email trigger user account deletion. When inactive account is deleted all short URLs associated with this account are removed.

Data constraints:

We can use UUID or any other unambiguous ID to identify user account. Long URL is arbitrary string in W3C standard URL encoding, no longer than 2048 characters. Short URL is systemwide unique.

Non-Functional Requirements:

Performance – speed and responsiveness

The main flow of shortened URL redirect should have latency < 100 ms, <10 is recommended.

The expected normal load numbers are:

10k RPS create
100k RPS recall
100M unique daily users
1 year maximum data retention for inactive accounts
1 G total users
100 URLs/user for standard tier, can be expanded for higher tiers
Long URL is no longer than 2048 bytes
an URL can be shared with no more than 100 user accounts or with everyone including unauthenticated users
expected user base growth is x10 over several years
Security – protection against unauthorized access

Account data is accessible only by authenticated user. If short URL has "anonymous" permission flag set, it is accessible by anyone, authenticated or not. If short URL has "anonymous" permission flag cleared, it is accessible only by authenticated users it is explicitly shared with.

Usability – ease of use

There are no hard requirements for usability when creating or editing shortened URL. But resolving shortened URL to long form should be extremely usable and seamless is all possible scenarios.

Reliability – system stability and availability

The system should have basic protection from infrastructure outages, e.g. have the servers spread over several regions, use highly-available storage, etc. Having DoS protection is highly advised

Scalability – ability to handle growth

The normal load is expected to grow very slowly: x10 over 3 years, but the system should expect and handle normally short bursts of request rate.

Maintainability – ease of updates and fixes

The system should be able to have zero-downtime updates and fixes. It does not need to be able to preserve existing sessions and maintains strict consistency during the updates. It should not spuriously lose the stored data on updates, but it can forget the temporary data of active sessions while a change is ongoing

Portability – ability to run in different environments

The system does not need to be portable, it can be vendor-locked to infrastructure provider. It must conform to WWW standards in terms of internationalization, portability, error tolerance.

Availability

The system should tolerate limited infrastructure outages without stopping the service, such as unavailable datacenter in one region.

Desired uptime is 99.999%. Desired RPO is 1 day for a limited user set, 2 min for the entire userbase. Desired RTO is below 1 minute.

Submissions

Displaying Solutions with Scores Ranging from 1 to 10