AB
Alysson Barrera
Contact
Full-stackSeptember 26, 2024

Next SaaS RBAC

Multi-tenant full-stack identity, organization & permission architecture

Engineering Overview & Positioning

A multi-tenant full-stack application where authentication, organizations, memberships, role abilities, resource ownership, invitations, projects, billing, and ownership transfer are coordinated across a shared web and API architecture.

Data & State Flow Architecture

  1. Next.js Web App

    Server Actions & UI Context

  2. Fastify API

    OpenAPI Endpoints & Auth Guards

  3. Shared CASL Package

    Unified Permission Definitions

  4. Prisma Tenant DB

    Organizations, Roles & Ownership

Execution Sequence:Client Request ➔ Shared CASL Ability Evaluator ➔ Tenant Membership Check ➔ Tenant-Aware Prisma Query

Engineering Focus & Core Themes

  • Authentication, tenancy, and authorization are distinct, non-interchangeable contexts
  • Roles belong to memberships within organizations, not globally to an isolated user
  • A resource can belong simultaneously to a tenant organization and an individual owner
  • Shared ability language across the web application and Fastify API reduces authorization drift
  • Billing seats represent a separate business responsibility with strict role exclusion

Key Engineering Trade-offs & Decisions

  • Organized monorepo using Turborepo with shared packages for authorization, types, and database schemas
  • Implemented shared CASL permission definitions consumed by both Next.js server actions and Fastify endpoints
  • Structured primary project queries around organization membership and stored ownership context
  • Excluded pure billing roles from seat calculation metrics to prevent inadvertent charges

Verified Implementation Evidence

  • Support for organization invitations, membership roles, and ownership transfer workflows
  • Organization-domain onboarding behavior and project authorization backed by stored owner records
  • Dual authentication via password credentials and GitHub OAuth integration

Verified Technology Stack

  • Turborepo Workspaces
  • Next.js App Router
  • Fastify REST API
  • Prisma ORM
  • Zod & OpenAPI
  • Shared CASL Package
  • Server Actions

Project Scope

  • Focuses on monorepo organization, authentication, organizations and memberships, invitations, project ownership, shared CASL abilities, tenant-aware project queries, billing-role separation, and ownership transfer.

Verified Code & External Artifacts

Inspect Source Code