Project
Acme Approvals (Multi-tenant SaaS)
Multi-tenant tasks + approvals with RBAC, audit logs, slug redirects, and E2E tests
- Role
- Solo
- Focus
- Multi-tenant RBAC, Approval workflows, Audit trail
- Testing
- Playwright E2E, Unit tests for state machine, Integration (mutation flows)
- Key patterns
- SaaS, Next.js, Postgres, Prisma
- Next.js (App Router)
- TypeScript
- Postgres
- Prisma
- NextAuth (OAuth)
- Playwright
- Docker
What it does
- Creates workspaces (orgs) with invites and role-based permissions
- Lets members create tasks, submit for approval, and track decisions
- Lets managers/admins approve/reject with reasons, comments, and history
- Shows dashboards: KPIs, pending approvals, and recent activity
- Preserves auditability with an append-only event log
Architecture
┌────────────────────────┐ ┌─────────────────────────┐
│ Next.js UI │─────►│ Next.js Route Handlers │
│ /app/[orgSlug]/... │ │ REST-ish API │
└───────────┬────────────┘ └───────────┬─────────────┘
│ │
│ auth session │ Prisma ORM
▼ ▼
┌───────────────────────┐ ┌──────────────────────────┐
│ NextAuth │ │ Postgres │
│ OAuth (GH/GO) │ │ orgs/members/tasks │
└───────────────────────┘ │ comments/audit log │
└──────────────────────────┘Reliability and guardrails
- Server-side RBAC + tenancy enforcement on every query/mutation (no client trust)
- State machine guardrails prevent invalid transitions (e.g., approve only when SUBMITTED)
- Audit events recorded for all mutations; activity feed is derived from event log
- Slug redirects prevent broken links in emails/bookmarks after org renames
- Rate limiting on sensitive endpoints and consistent error envelopes
How to demo in 2 minutes
- 1Clone the repo and install deps: npm install
- 2Start Postgres (docker compose up -d) and run migrations/seed
- 3Run dev server: npm run dev
- 4Login (demo OAuth or demo user) → create org → invite member
- 5Create a task → submit → switch to approver → approve/reject
- 6Open Activity feed and Task history to see the audit trail