Need help to solidify my understanding of hexagonal / ports and adapters architecture

Question

I'm trying to make sense of Hexagonal architecture and want to know if I am understanding this correctly.

• You have a application layer where your business logic exists.
• You have a port layer which is just interfaces used by the application layer that your adapter layer must adhere to.
• You have an adapter layer which connects both incoming and outgoing communication to your application layer.
  • On the driving side an adapter might be logic to wire up REST, gRPC, CLI, etc. to your application layer.
  • On the driven side it would be to allow your application layer to communication with databases, other services, etc.

I have a few questions:

• Is this understanding correct?
• Where do input validation and authorization belong here? Is it in a driving adapter or the application layer?

Answer 1

Is this understanding correct?

Well, mostly :D In case of ports it is also a differentiation between driver and driven ports (not just on the adapter layer).

I personally do like the way how the cardo ai is depicting this architecture

Where do input validation and authorization belong here? Is it in a driving adapter or the application layer?

Well it depends. If you have multiple adapters that are using the same driver port then validation and AuthZ should be placed inside the application (or core) layer. If there is one-to-one relationship between driver ports and adapters then validation could be placed inside the adapter.