Building Multi-Tenant Auth from Scratch Is Painful. So I Open-Sourced MT-URBAC (NestJS + Angular)

KASOIR ABBAS — Tue, 11 Aug 2026 04:14:30 +0000

Every time you build a SaaS product, you hit the same wall: spending the first few days re-writing multi-tenant architecture, handling tenant context isolation, setting up JWT guards, and building permission directives.

After open-sourcing the initial Unified Role-Based Access Control boilerplate, the most common question I thought about was: “How to scale this for multi-tenancy?”

Building multi-tenant apps means dealing with a cascade of complexities: tenant context resolution, isolated access control policies, routing adjustments, and clean database partitioning. Building all of that from scratch for every B2B SaaS project is a massive time sink.

So I built a production-ready solution once, engineered it cleanly, and open-sourced it: MT-URBAC (Multi-Tenant Unified Role-Based Access Control).

What is MT-URBAC?

MT-URBAC is a full-stack, enterprise-grade boilerplate designed to let you spin up a secure, multi-tenant B2B application in under five minutes.

Backend: NestJS, TypeORM, PostgreSQL
Frontend: Angular, OptimusUI, Tailwind CSS
License: 100% Free & Open-Source (MIT)

Key Architectural Breakthroughs

1. Zero-Hassle Local Multi-Tenant Routing
Testing subdomains locally usually requires hacking your OS /etc/hosts file and running custom proxy configurations. MT-URBAC solves this out of the box with dual-mode routing:

Local Development (Path-Based): Zero setup required. Test tenant boundaries instantly using clean paths like http://localhost:4200/tenant-a/login or http://localhost:4200/admin/....
Production (Subdomain-Based): Automatically maps incoming host headers (tenant-a.yourdomain.com) to tenant contexts seamless in production.

2. Clean Top-Down Grouping (No Junction-Table Hell)
Instead of messy three-way many-to-many junction tables that destroy query performance, MT-URBAC enforces a streamlined hierarchy:
User → Group → Role → Privilege

3. Automatic Privilege Escalation Defense
Security flaw #1 in custom RBAC systems is horizontal/vertical privilege escalation (e.g., an Admin granting someone Super Admin privileges). MT-URBAC assigns numeric weight levels to every role (e.g., Admin = 50, Super Admin = 100). The NestJS guards intercept and reject any action where a user attempts to mutate or assign a role higher than their own level.

Developer Experience (DX) First

Protecting backend endpoints takes a single line:

@Post('create')
@RequirePermissions('user:create')
async createNewUser() {
  // Executed only if the user possesses 'user:create' in their active tenant context
}

Hiding or rendering elements dynamically in Angular requires zero boilerplate logic in your components:

<!-- Automatically listens to user permission state -->
<button *hasPermission="'user:delete'" class="p-button-danger">
  Delete User
</button>

Try It in 2 Minutes

# 1. Clone & install
git clone https://github.com/kasoir/mt-urbac.git
cd mt-urbac/backend && npm install

# 2. Seed database & start
npm run seed
npm run start:dev

The repository ships with an automated database seeder that provisions default roles, privileges, and a Super Admin account out of the box (admin@mt-urbac.com / Admin123!).

Check out the source code on GitHub: https://github.com/kasoir/mt-urbac

If this saves you a weekend of architecture setup, drop a Star on the repo! I'd love to hear in the comments how you typically handle multi-tenancy isolation in your projects.

To avoid rebuilding Auth every time, I open-sourced URBAC (Unified RBAC) (NestJS + Angular + PostgreSQL)

KASOIR ABBAS — Mon, 03 Aug 2026 09:51:23 +0000

Edit: I've migrated the boilerplate from PrimeNG to OptimusUI to keep the project completely open-source and free under the MIT license! The Tailwind CSS integration remains just as smooth.

Every time I start a new full-stack project, the first week is always the same: setting up users, configuring database relationships, writing JWT guards, and building route protectors.

Role-Based Access Control (RBAC) is something every enterprise app needs, but building a clean, scalable version of it from scratch every single time is exhausting.

So, I decided to build it once, build it right, and open-source it for everyone.

Meet URBAC (Unified Role-Based Access Control).

What is URBAC?
URBAC is a production-ready, full-stack boilerplate designed to help you scaffold secure, multi-level access control systems in minutes.

The stack is strictly built for enterprise scale:

Backend: NestJS & TypeORM
Frontend: Angular (with PrimeNG & Tailwind CSS)
Database: PostgreSQL

The Architecture
Instead of using messy, complicated three-way junction tables, I architected URBAC with a clean, top-down administrative grouping model. This makes the database queries lightning-fast and the mental model incredibly easy to understand:

Groups are administrative buckets (e.g., "Users", "Admins", "Super Admins").
Users are assigned to a Group.
Roles are assigned to a Group.
Privileges are attached to Roles.

It also features Role Escalation Security. Every role has a numeric level (e.g., Admin = 50, Super Admin = 100). The backend guards automatically ensure that a Level 10 user can never grant someone a Level 50 role.

Developer Experience First
I wanted this template to feel like magic when you use it.

On the backend, protecting a route is as simple as dropping a custom decorator on your NestJS controller:

@Post('create') @RequirePermissions('user:create') async createNewUser() { // Only users with this specific privilege can execute this }
On the frontend, I built a custom structural directive for Angular that reacts to the logged-in user's active group context. Hiding buttons from unauthorized users takes one line of HTML:

<button *hasPermission="'user:delete'" class="p-button-danger"> Delete User </button>

Try it out
The repository comes with a database seed script that instantly provisions a Super Admin account (admin@urbac.com), so you can clone it, run npm run seed, and immediately log into the dashboard to start managing roles.

You can check out the full source code and documentation here: URBAC