Rating and review system in LLD - System Design Exercise

Design: Rating and Review System

Design covers backend services, database schema, and API flow for rating and review management. Frontend UI and payment integration are out of scope.

Functional Requirements

FR1: Users can submit ratings and text reviews for products or services.

FR2: Each product or service can have multiple reviews from different users.

FR3: Users can update or delete their own reviews.

FR4: Display average rating and total number of reviews per product.

FR5: Support pagination and sorting of reviews (e.g., newest, highest rating).

FR6: Prevent users from submitting multiple reviews for the same product.

FR7: Allow moderation to flag or remove inappropriate reviews.

Non-Functional Requirements

NFR1: Handle up to 1 million products and 10 million users.

NFR2: Support 100,000 concurrent review submissions and reads.

NFR3: API response time p99 under 300ms for reading reviews.

NFR4: System availability of 99.9% uptime.

NFR5: Data consistency for user reviews and ratings.

Think Before You Design

Questions to Ask

❓ Question 1

❓ Question 2

❓ Question 3

❓ Question 4

❓ Question 5

❓ Question 6

Key Components

API Gateway or Load Balancer

Authentication and Authorization Service

Review Management Service

Database (Relational or NoSQL)

Cache Layer for frequently accessed data

Moderation Service

Message Queue for asynchronous tasks (e.g., notifications, moderation)

Search or Indexing Service for sorting and filtering

Design Patterns

CQRS (Command Query Responsibility Segregation) for separating read and write workloads

Eventual consistency for updating average ratings asynchronously

Rate limiting to prevent spam reviews

Soft delete for reviews to support moderation

Pagination and cursor-based navigation for review lists

Reference Architecture

          +---------------------+
          |   API Gateway / LB  |
          +----------+----------+
                     |
          +----------v----------+
          | Authentication Svc  |
          +----------+----------+
                     |
          +----------v----------+          +------------------+
          | Review Management   |<-------->| Moderation Svc   |
          | Service             |          +------------------+
          +----------+----------+
                     |
          +----------v----------+          +------------------+
          | Database (SQL)       |          | Message Queue    |
          +----------+----------+          +------------------+
                     |
          +----------v----------+
          | Cache (Redis/Memcached) |
          +---------------------+
                     |
          +----------v----------+
          | Search / Indexing   |
          +---------------------+

Components

API Gateway / Load Balancer

Nginx / AWS ALB

Route incoming requests and balance load across services

Authentication Service

OAuth 2.0 / JWT

Verify user identity and permissions

Review Management Service

RESTful API in Node.js / Python

Handle review creation, update, deletion, and retrieval

Database

PostgreSQL

Store reviews, ratings, users, and product data with strong consistency

Cache

Redis

Cache popular product reviews and average ratings for fast reads

Moderation Service

Microservice with admin UI

Flag, review, and remove inappropriate content

Message Queue

RabbitMQ / Kafka

Handle asynchronous tasks like notifications and updating aggregates

Search / Indexing Service

Elasticsearch

Support sorting, filtering, and full-text search on reviews

Request Flow

1. User sends request to submit or update a review via API Gateway.

2. Request is authenticated by Authentication Service.

3. Review Management Service validates and writes review data to the database.

4. Review data is published to Message Queue for asynchronous processing.

5. Cache is updated or invalidated for the affected product's reviews and average rating.

6. Moderation Service consumes flagged reviews from Message Queue for review.

7. User requests to read reviews are served from Cache or Search Service for fast response.

8. Search Service indexes reviews for sorting and filtering queries.

Database Schema

Entities: - User(user_id PK, username, email, ...) - Product(product_id PK, name, description, ...) - Review(review_id PK, user_id FK, product_id FK, rating INT, review_text TEXT, created_at TIMESTAMP, updated_at TIMESTAMP, is_deleted BOOLEAN, is_flagged BOOLEAN) Relationships: - User 1:N Review (one user can write many reviews) - Product 1:N Review (one product can have many reviews) Constraints: - Unique(user_id, product_id) to prevent multiple reviews by same user on one product - Index on product_id and created_at for sorting and pagination - Index on is_flagged for moderation queries

Scaling Discussion

Bottlenecks

Database write contention when many users submit reviews simultaneously.

Cache invalidation delays causing stale average ratings.

Search service indexing lag for new or updated reviews.

Moderation service overload with high volume of flagged content.

API Gateway becoming a single point of failure under heavy load.

Solutions

Use database sharding or partitioning by product_id to distribute write load.

Implement asynchronous batch updates for average ratings with eventual consistency.

Use near real-time indexing with incremental updates in the search service.

Scale moderation service horizontally and use automated filters to reduce manual load.

Deploy multiple API Gateway instances with health checks and auto-scaling.

Interview Tips

Time: Spend 10 minutes clarifying requirements and constraints, 20 minutes designing architecture and data model, 10 minutes discussing scaling and trade-offs, 5 minutes summarizing.

Clarify user roles and review lifecycle including moderation.

Explain choice of relational database for consistency and uniqueness constraints.

Discuss caching strategy to meet latency requirements.

Describe asynchronous processing for scalability and eventual consistency.

Highlight how to handle high read and write loads separately.

Mention security and abuse prevention like authentication and rate limiting.