Design Message Export

Problem Scope and Product Goals for Link Export

Message export generation is a distributed workflow where the message send path must remain fast while export enrichment executes asynchronously through safe network boundaries. The design uses canonical Conversation keys, cache-first lookup, isolated fetch workers, metadata extraction, policy-based sanitization, and evented delivery to hydrate clients once export artifacts are ready. Interview-grade answers should connect user experience goals to p95 latency, extraction success rate, cache-hit ratio, and abuse containment policies.

Message export generation introduces a distributed contract problem: clients author structured content, backend policy services validate it, and rendering paths must reproduce identical output across web, mobile, and notification surfaces. This section defines invariants for authoring, persistence, and rendering so interviews stay concrete and implementation-ready.

We enforce deterministic normalization, bounded render budgets, and policy-driven sanitization to block script injection, malformed nesting, and denial-of-service style payloads. We also track a strict compatibility matrix so older clients can safely degrade unsupported blocks into canonical plaintext fallbacks without data loss.

Architecture decisions are expressed with measurable SLO impact, data model implications, and migration paths that keep deployment risk low while teams ship new export primitives rapidly.

Operational details

• Define ownership boundaries between composer, validator, export renderer, and delivery services.
• Capture idempotency for retries and deduplication in event-driven render pipelines.
• Instrument policy rejects and render fallbacks with error taxonomy labels.

Why interviewers care

Message Export interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

The failure that defines the design

The outage to narrate is the synchronous export that dies. An admin requests a year of an org's messages, the service tries to gather it in one request, and it either times out or runs the worker out of memory at gigabytes in — and worse, on retry it starts from zero. Its twin is the bulk exfiltration: someone exports the entire message history with no authorization check and no audit trail. The fix is the spine of the design: an asynchronous export job that streams the dataset page by page, writes the archive in chunks to object storage, and checkpoints progress so a crash resumes rather than restarts, all behind an authorization gate and an audit log. State async-chunked-resumable-export-with-access-control up front, because message export is a long batch job over an unbounded dataset, and the disasters are running it synchronously and running it without a paper trail.