u/Individual_Suit_3255

Hey everyone,

After standardizing a top-down grouping model (User -> Group -> Role -> Privilege) to escape the three-way junction table mess in single-tenant applications (URBAC), the next logical challenge was scaling that pattern to multi-tenancy.

I wanted to share the architectural pattern I standardized to solve this, along with the boilerplate implementation as MT-URBAC (NestJS, TypeORM, PostgreSQL, and Angular).

The backend architecture:

1- Tenant-Aware Resolution: The application handles both path-based routing (for local development without touching a hosts file) and subdomain-based routing seamlessly.

2- Strict Role Escalation Safeguards: Horizontal privilege escalation is blocked at the guard level. Roles have a numeric level (e.g., Admin = 50, Super Admin = 100), and custom JWT guards intercept requests to ensure lower-level users can't grant higher privileges regardless of permissions.

3- Clean Decorator-Based Protection:

@Post ('create')
@RequirePermissions('user:create')
async createNewUser() { ... }

The repo includes everything packaged up with a database seed script to instantly provision a PostgreSQL database and a Super Admin account so you can test the guards right away.

If you want to adopt this pattern, review the entity structures, or just skip the auth setup on your next build, I open-sourced the repository here:

https://github.com/kasoir/mt-urbac

Curious how others here handle tenant context switching and guard-level role hierarchies in NestJS at scale. Let me know your thoughts!

mt-urbac

Hey everyone,

Following up on my previous single-tenant Unefied RBAC boilerplate (URBAC), I've just released MT-URBAC, a multi-tenant version built specifically for B2B SaaS applications where tenant isolation and dynamic role-based UI rendering are critical.

What makes the Angular setup smooth:

1. Smart Context Directive: Instead of polluting your component TS files with permission checking logic or async pipe subscriptions, UI elements are governed by a custom structural directive (*hasPermission):

<button *hasPermission="'user:delete'" class="p-button-danger">
  Delete User
</button>

2. Zero /etc/hosts Hacks for Local Multi-Tenancy: Testing multi-tenant subdomains locally usually means editing your operating system's hosts file. But in mt-urbac, the routing logic automatically supports path-based multi-tenancy in development (http://localhost:4200/tenant-a/login) and automatically resolves subdomains in production ( http://tenant-a.yourdomain.com ). No local config tweaks required.

3. Fully Decoupled: The frontend and backend run independently. The UI uses Tailwind CSS and OptimusUI, keeping everything lightweight, fully open-source, and MIT-licensed.

The repo includes setup instructions and a NestJS backend with a seed script so you can spin up the full pipeline locally in under two minutes: https://github.com/kasoir/mt-urbac

I'd love to hear feedback on how you all currently manage dynamic permission rendering or multi-tenant switching in your Angular applications!

mt-urbac

Hey everyone,

Edit: I've migrated the boilerplate from PrimeNG to OptimusUI to keep the project completely open-source and free under the MIT license! The Tailwind CSS integration remains just as smooth.

I always found myself rebuilding the exact same login flows, route guards, and permission directives for every enterprise dashboard. To save time on future projects, I put together URBAC, an open-source boilerplate using Angular (with PrimeNG and Tailwind CSS) backed by NestJS.

My favorite part of the frontend is how easy it is to handle UI elements based on user permissions. I built a custom structural directive that reacts to the logged-in user's active group context.

Hiding unauthorized buttons takes one line of HTML:

<button *hasPermission="'user:delete'" class="p-button-danger">
  Delete User
</button>

It's completely decoupled from the backend, so you run them as standard separate projects.

You can check out the repo and the setup instructions here:

https://github.com/kasoir/urbac

If anyone is building a dashboard right now, I hope this saves you some setup time. I'd love any feedback on the PrimeNG/Tailwind integration, or how you all prefer to handle permission-based UI rendering in your own Angular apps!

URBAC