Identity, Access & Tenant Trust
permissions
RBAC + ABAC engine — CASL for in-process checks. defineAbility() server, <Can /> in React.
RBAC · ABAC
| Resource | read | write | delete | manage |
|---|---|---|---|---|
| Project | ||||
| Billing | ||||
| Audit log | ||||
| API key | ||||
| Team member |
Powered by CASL · evaluated server-side
More in nebutra.com
- auditHash-chained, SHA-256 append-only audit log for actor/tenant actions. SOC 2-grade tamper detection, streaming export, and replay-safe queries.
- authBetter Auth on Postgres — organization membership, device-flow login, MFA-enforced, session HMAC-signed. One identity layer, no vendor in the loop.
- captchaBot challenge with Cloudflare Turnstile / hCaptcha / reCAPTCHA behind one verify() call. Server-side scoring, per-route enable, no third-party tracker on the client.
- identityShared actor primitive — usr_/svc_/api_ ID space, role/membership lookup, tenant attachment. The single identity object every iam package reads.
- oauthYour own OIDC identity provider — "Sign in with Nebutra" for third-party apps. Authorization code + PKCE, refresh-token rotation, consent, clients stored in Postgres.
- tenantRequest-scoped tenant context via AsyncLocalStorage, with Prisma RLS bridge. One tenantId resolves through middleware and propagates the whole stack.