set up a gateway on the first floor.

                   /*  */
User -> Gateway -> getCartProductInfos -> { 
                                            cartService,
                                            productService
                <-        <- }

just doing this means that the outside world will not be aware of cartService and productService , but only know that there is a getCartProductInfos interface. Those services are known only within the system.

the advantage is that you can do a permission verification at the gateway entry ( getCartProductInfos ), which can be considered secure later (if you need secondary / additional verification, you can do it again at the service, with a high degree of flexibility). In addition, when the service is split later, as long as the external interface of the gateway remains unchanged, the front end (including WEB and mobile, if any) does not need to be changed. That is, no matter how much the things behind the gateway are iteratively upgraded, it is insensitive to the front system. The downside of
is that there is one more layer of things. I personally feel that unless we simply do something of the nature of Demo to practice, we should set up a gateway, and the subsequent expansion will be very easy and convenient.