User & Team Management
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The User & Team Management system in SecondLayer provides a robust framework for handling identities, access control, and collaborative structures within a Ukrainian legal tech platform. It facilitates multi-provider authentication, hierarchical access levels, and role-based permissions necessary for managing legal matters, billable time, and sensitive case documents.
The system is designed around an MCP (Model Context Protocol) architecture that supports various transport layers, including standard stdio, HTTP REST endpoints, and Server-Sent Events (SSE). This ensures that user and team data are consistently available across the web frontend, specialized MCP servers (such as RADA or OpenReyestr), and distributed AI clients.
Sources: CLAUDE.md:1-50, lexwebapp/COMPLETE_REFACTORING_SUMMARY.md:1-20
Authentication and Security
The project employs a "Dual-Auth" strategy to accommodate both web users and automated API clients. This system validates credentials through either JSON Web Tokens (JWT) or static API keys.
Dual Authentication Flow
The middleware layer intercepts requests to verify identity before granting access to protected routes or MCP tools.
The authentication logic supports Google OAuth for user-facing applications and uses SECONDARY_LAYER_KEYS for cross-service communication.
Sources: mcp_backend/src/middleware/dual-auth.ts, CLAUDE.md:120-140
User Billing and Roles
User management is tightly integrated with the billing system. Each user within a team or firm is assigned specific billing rates that determine the financial value of their billable hours on various matters.
User Billing Model
The following table describes the data structure for managing individual user financial profiles.
| Field | Type | Description |
|---|---|---|
user_id | UUID | Primary identifier for the user. |
hourly_rate_usd | DECIMAL | The billable rate assigned to the user. |
effective_from | TIMESTAMP | The date when a specific rate begins applying. |
created_at | TIMESTAMP | Audit timestamp for record creation. |
Sources: mcp_backend/src/migrations/037_add_time_billing.sql:20-40, IMPLEMENTATION_PHASES.md:25-50
Matter Access and Team Collaboration
Team management is functionally expressed through "Matters." Matters act as the primary container for collaborative legal work, where team members are assigned roles and access levels to specific cases.
Access Hierarchy
Access is governed by a set of permissions that differentiate between internal team members and external clients.
A specific "Client Portal" (Phase 4) provides restricted, magic-link-based access for external parties to view their specific matters and invoices without full system access.
Sources: IMPLEMENTATION_PHASES.md:140-180, mcp_backend/src/migrations/037_add_time_billing.sql:5-15
Frontend State Management
User and team states are managed on the frontend using Zustand and React Query. This ensures that user sessions, preferences, and permissions are persisted across page refreshes and optimized for performance.
Core UI Stores
- authStore: Manages current user session, tokens, and profile data.
- uiStore: Persists user preferences and layout settings.
- settingsStore: Handles user-specific configurations.
Sources: lexwebapp/COMPLETE_REFACTORING_SUMMARY.md:60-80, CLAUDE.md:100-115
Conclusion
The User & Team Management module provides the foundational security and organizational structure for SecondLayer. By combining dual-factor authentication with a detailed billing and matter-access schema, the system ensures that legal professionals can collaborate effectively while maintaining strict data isolation and accurate financial tracking.