Module: Table Management
Relevant source files
The following files were used as context for generating this wiki page:
The Table Management module serves as the central registry for resource entities, referred to as "tables," within the MuteTaxes CRM. Its primary purpose is to define and manage the metadata for business objects (e.g., clients, invoices, tasks) that are subject to Relationship-Based Access Control (ReBAC) via OpenFGA.
This module bridges the gap between the physical database schema and the authorization layer. When a new table is registered, the system not only persists its metadata in PostgreSQL but also initializes the necessary authorization tuples in OpenFGA to ensure that administrative roles maintain control over the new resource.
Architecture and Data Flow
The architecture of the Table Management module involves a synchronized flow between the relational database (PostgreSQL) and the authorization engine (OpenFGA). The backend utilizes Prisma for relational persistence and a dedicated OpenFGA client for permission management.
System Interaction Flow
The following diagram illustrates the process of registering a new table and how it propagates through the system.
Data Models
The system maintains a specific schema for table resources in both the relational database and the OpenFGA authorization model.
Database Schema (PostgreSQL)
The Table entity stores display information and unique identifiers used for routing and authorization checks.
| Field | Type | Constraints | Description |
|---|---|---|---|
id | TEXT | PRIMARY KEY | Unique UUID or identifier for the record. |
slug | TEXT | UNIQUE, NOT NULL | Machine-readable name (e.g., clients). |
displayName | TEXT | NOT NULL | Human-readable name (e.g., Clients). |
createdAt | TIMESTAMP | DEFAULT NOW() | Timestamp of resource registration. |
Sources: backend/prisma/migrations/20260122120201_init/migration.sql:28-36, PLAN.md:65-71
Authorization Model (OpenFGA)
In OpenFGA, a table is a first-class type with specific relations that define access rights.
The OpenFGA model defines computed relations where can_read is granted if a user has any direct badge (creator, reader, updater, or deleter).
Sources: PLAN.md:31-43, backend/src/fga/fgaClient.ts:98-124
API Endpoints
The Table Management module exposes several endpoints for administrative management and user-specific discovery.
Administrative Endpoints
These endpoints are restricted to users with the superadmin role.
| Method | Path | Description |
|---|---|---|
GET | /api/tables | Retrieves a list of all registered table resources. |
POST | /api/tables | Registers a new table and grants creator badge to the superadmin role. |
Sources: backend/src/modules/tables/tables.routes.ts:10-24
Discovery Endpoints
Used by the frontend to dynamically render the UI based on user permissions.
| Method | Path | Description |
|---|---|---|
GET | /api/me/allowed-tables | Returns a list of tables the current user is authorized to read. |
GET | /api/me/table-permissions | Returns granular CRUD permissions for a specific table slug. |
Sources: backend/src/modules/me/me.routes.ts:10-53
Frontend Implementation
The frontend provides a management interface for table registration and a dynamic sidebar that reflects available resources.
Table Registry Page
The TablesPage component allows administrators to view existing tables and add new ones via a form. It manages local state for slug and displayName inputs before dispatching requests to the backend.
Sources: frontend/src/pages/TablesPage.tsx:1-81
Dynamic Resource Access
The application's Layout component calls refreshAllowedTables to fetch the list of authorized resources for the current user. These are then rendered as navigation links in the sidebar.
Conclusion
Table Management is a foundational module that enables dynamic resource definitions within the MuteTaxes architecture. By coupling PostgreSQL metadata with OpenFGA authorization tuples, it ensures that every business resource registered in the system is immediately integrated into the security perimeter, allowing for fine-grained, role-based, and relationship-based access control.