Technology Stack
Relevant source files
The following files were used as context for generating this wiki page:
The MuteTaxes_Backend project is a relationship-based authorization demo designed to visualize how fine-grained permissions are managed and enforced. The architecture leverages a modern decoupled stack, separating the backend logic for authorization and data management from a responsive frontend interface. The centerpiece of the system is the integration of OpenFGA for relationship-based access control (ReBAC), which dictates the user experience based on dynamic permission checks.
Sources: PLAN.md:3-8, PLAN.md:11-19
Core Infrastructure & Runtime
The project is structured as a monorepo containing a dedicated backend and frontend, orchestrated via Docker Compose for consistent environment management.
| Component | Technology | Description |
|---|---|---|
| Runtime (Backend) | Node.js | Server-side execution environment. |
| Language | TypeScript | Type-safe programming across both backend and frontend. |
| Containerization | Docker Compose | Orchestrates PostgreSQL and OpenFGA server instances. |
| Database | PostgreSQL | Primary relational storage for users, roles, and table metadata. |
| Authorization Engine | OpenFGA | Handles relationship-based authorization logic and tuple storage. |
Sources: PLAN.md:11-19, backend/package.json:20-30, frontend/package.json:16-25
Infrastructure Layout
The following diagram illustrates the high-level infrastructure and the relationship between the application services and the backing infrastructure.
Sources: PLAN.md:11-19, backend/src/index.ts:1-25
Backend Architecture
The backend is built with Express and TypeScript, serving as the coordinator between the relational database and the authorization server.
Data Access and ORM
The system uses Prisma as its Object-Relational Mapper (ORM) to interact with PostgreSQL. It manages entities such as User, Role, UserRole, and Table (a resource registry).
Sources: PLAN.md:46-75, backend/package.json:22-23
Authorization System (OpenFGA)
Authorization is handled by the OpenFGA JS SDK. Unlike traditional RBAC, this system uses "tuples" to define relationships. The backend implements a wrapper (fgaClient.ts) to perform several key operations:
- Permission Checking: Verifying if a user can
create,read,update, ordeletea specific table resource. - Tuple Management: Writing or deleting relationship tuples when roles are assigned or permissions are toggled in the UI.
- Model Management: Automatically ensuring the FGA authorization model is synced from the
.fgadefinition file.
API Dependencies
| Dependency | Version | Purpose |
|---|---|---|
@openfga/sdk | ^0.9.1 | Official client for communicating with the OpenFGA server. |
@prisma/client | ^5.22.0 | Type-safe database client. |
express | ^4.19.2 | Web framework for routing and middleware. |
jsonwebtoken | ^9.0.2 | Token-based authentication (Username-only login demo). |
swagger-ui-express | ^5.0.1 | API documentation interface. |
Sources: backend/package.json:19-30
Frontend Architecture
The frontend is a Single Page Application (SPA) built with React and Vite, focused on providing a "Live" visualization of permissions.
Component & Styling Stack
- Vite: Used as the build tool and development server for fast HMR.
- TailwindCSS: Utilized for utility-first styling, featuring a dark-themed "glassmorphism" UI.
- React Router: Handles navigation between the Users, Roles, Tables, and Permission Matrix pages.
Sources: frontend/package.json:7-25, frontend/tailwind.config.js:1-7, frontend/src/index.css:40-45
State and Data Flow
The frontend consumes the Backend API to dynamically render the UI based on the current user's permissions. This includes:
- Sidebar Filtering: Calling
/me/allowed-tablesto only show links the user hascan_readaccess to. - Action Authorization: In
TablePage.tsx, buttons for Create/Update/Delete are enabled or disabled based on the results ofgetTablePermissions.
Database & Model Seeding
The project includes a robust seeding mechanism (seed.ts) that initializes both the relational database and the OpenFGA store. It creates a default super_admin user, assigns them the superadmin role, and grants that role full creator permissions across default tables like clients, invoices, and tasks.
Sources: backend/src/seed.ts:25-60, PLAN.md:165-175
Summary
The MuteTaxes_Backend technology stack is centered on demonstrating Relationship-Based Access Control. By combining Node.js/Express and Prisma for traditional data management with OpenFGA for authorization, the project provides a modular environment where permissions are decoupled from the core application logic and managed as a graph of relationships.