To avoid rebuilding Auth every time, I open-sourced URBAC (Unified RBAC) (NestJS + Angular + PostgreSQL)

Edit: I've migrated the boilerplate from PrimeNG to OptimusUI to keep the project completely open-source and free under the MIT license! The Tailwind CSS integration remains just as smooth.

Every time I start a new full-stack project, the first week is always the same: setting up users, configuring database relationships, writing JWT guards, and building route protectors.

Role-Based Access Control (RBAC) is something every enterprise app needs, but building a clean, scalable version of it from scratch every single time is exhausting.

So, I decided to build it once, build it right, and open-source it for everyone.

Meet URBAC (Unified Role-Based Access Control).

What is URBAC?
URBAC is a production-ready, full-stack boilerplate designed to help you scaffold secure, multi-level access control systems in minutes.

The stack is strictly built for enterprise scale:

• Backend: NestJS & TypeORM
• Frontend: Angular (with PrimeNG & Tailwind CSS)
• Database: PostgreSQL

The Architecture
Instead of using messy, complicated three-way junction tables, I architected URBAC with a clean, top-down administrative grouping model. This makes the database queries lightning-fast and the mental model incredibly easy to understand:

1. Groups are administrative buckets (e.g., "Users", "Admins", "Super Admins").
2. Users are assigned to a Group.
3. Roles are assigned to a Group.
4. Privileges are attached to Roles.

It also features Role Escalation Security. Every role has a numeric level (e.g., Admin = 50, Super Admin = 100). The backend guards automatically ensure that a Level 10 user can never grant someone a Level 50 role.

Developer Experience First
I wanted this template to feel like magic when you use it.

On the backend, protecting a route is as simple as dropping a custom decorator on your NestJS controller:

@Post('create')
@RequirePermissions('user:create')
async createNewUser() {
// Only users with this specific privilege can execute this
}
On the frontend, I built a custom structural directive for Angular that reacts to the logged-in user's active group context. Hiding buttons from unauthorized users takes one line of HTML:

<button *hasPermission="'user:delete'" class="p-button-danger">
Delete User
</button>

Try it out
The repository comes with a database seed script that instantly provisions a Super Admin account ([e-mail]), so you can clone it, run npm run seed, and immediately log into the dashboard to start managing roles.

You can check out the full source code and documentation here: URBAC

If you find this template useful for your next NestJS/Angular project, I would hugely appreciate a star on GitHub! Let me know in the comments what features or auth modules you'd like to see added next.

Comments

[LiberStudio]

Thanks so much for the news about PrimeNG! Migrating 11 projects to PrimeNG v22 was an absolute nightmare. And now I've just heard about OptimusUI — thank you!

P.S:
As for me, I created two separate libraries, complete with all the functions for Authentication & Authorisation + RBAC. However, everything is based on KeyCloak!
Front-End library: ng-keycloak,
Back-End library: nestjs-keycloak.
This way, I can install them in any project!"

[KASOIR ABBAS]

Appreciate the shout-out! Packaging those into ng-keycloak and nestjs-keycloak is a super clean way to standardize auth when you're dealing with a distributed, multi-app ecosystem.

URBAC, on the other hand, targets a different tier: standalone or modular monoliths where you want zero external infrastructure overhead and native database control right inside your codebase.