feat: Enterprise Edition - Multi-User Support with RBAC by FFengIll · Pull Request #315 · tingly-dev/tingly-box

FFengIll · 2026-02-08T13:02:56Z

Summary

Implements the Enterprise Edition for Tingly Box, adding multi-user authentication, role-based access control (RBAC), API token management, and
administrative capabilities. The enterprise features are completely isolated from the community edition codebase and can be optionally enabled via
configuration.

Key Features

Multi-User Authentication: Username/password authentication with JWT-based session management
Role-Based Access Control: Three roles (Admin, User, ReadOnly) with granular permission matrices
API Token Management: Scoped API tokens with expiration and audit logging
Admin Panel: Web interface for user and token management at /enterprise/admin
Isolated Architecture: Separate database tables (ent_ prefix), API routes (/enterprise/ prefix), and frontend routes
Audit Logging: Comprehensive audit trail for compliance and security monitoring

Changes

Backend (internal/enterprise/) - ~6,000+ lines:

auth/ - JWT service, password hashing (Argon2id), authentication service
user/ - User model, repository, and service with CRUD operations
token/ - API token model, repository, and service with scope validation
rbac/ - Role and permission middleware for route protection
admin/ - Admin API handlers for user/token management
db/ - Enterprise database models and repositories
integration.go - Integration interface for third-party services

Frontend (frontend/src/pages/enterprise/) - ~1,100+ lines:

LoginPage.tsx - Enterprise login with username/password
AdminPage.tsx - Admin dashboard with user/token management
EnterpriseAuthContext.tsx - Auth context for enterprise sessions
services/enterprise/api.ts - Enterprise API client
types/enterprise.ts - TypeScript type definitions

Documentation:

docs/spec/20260207-enterprise-edition.md - Complete specification
docs/enterprise/README.md - Quick start guide
docs/enterprise/INTEGRATION.md - Integration guide for third parties
docs/enterprise/TEST_COVERAGE.md - Test coverage report (~75%)
docs/arch/20260207-arch.md - Architecture documentation

Examples (examples/enterprise/):

Working demo server with automated test scenarios
Integration examples for third-party services

Tests (tests/enterprise/):

Test runner with 4+ test packages covering auth, user, token, and RBAC
~75% overall test coverage with mock-based isolated testing

Database Schema

New isolated tables with ent_ prefix:

ent_users - User accounts with roles
ent_api_tokens - Scoped API tokens
ent_sessions - JWT session management
ent_audit_logs - Audit trail for compliance

Configuration

Enable via scenario flag in ~/.tingly-box/config.json:

{
  "scenarios": [{
    "scenario": "enterprise",
    "extensions": { "enabled": true }
  }]
}

Test Plan

Unit tests for auth, user, token, and RBAC modules (~75% coverage)
Integration example with automated demo
E2E frontend tests
Migration tool from community to enterprise

- Add architecture documentation cache (docs/arch/20260207-arch.md) - Add enterprise edition specification (docs/spec/20260207-enterprise-edition.md) - Implement enterprise database schema with GORM models - User model with role-based access (admin, user, readonly) - APIToken model with scope-based permissions - Session model for JWT session management - AuditLog model for compliance tracking - Implement user repository and domain model - Implement token repository and domain model - Implement session and audit log repositories - All code isolated in internal/enterprise/ package - Complete backward compatibility with community edition Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add password hashing service using Argon2id - Add JWT service for access and refresh token generation - Add authentication service with login/logout/refresh - Add user service with CRUD and management operations - Add token service with API token management - Add RBAC middleware with role and scope-based authorization - Add admin HTTP handlers for all enterprise operations - Add admin router with /enterprise/api/v1 prefix Features: - Multi-user authentication with JWT - API token management with scopes - Role-based access control (admin, user, readonly) - Audit logging for compliance - Session management - Password strength validation - Token expiration handling Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Frontend: - Add enterprise types and interfaces - Add enterprise API service with token refresh - Add EnterpriseAuthContext for authentication state - Add enterprise login page with username/password - Add enterprise admin panel with user management - Update App.tsx with enterprise routes (/enterprise/login, /enterprise/admin) Features: - Multi-user authentication with JWT - User CRUD operations - Role-based UI permissions - Token refresh handling - Form validation and error handling Tests: - Add password hashing tests (Argon2id) - Add JWT token generation and validation tests - Add token refresh tests - Add token expiry tests - Add password strength validation tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add comprehensive enterprise README with: - Feature overview - Architecture documentation - API endpoint reference - Security features - Getting started guide - Integration with community edition - Troubleshooting guide - Add quick start guide in docs/enterprise/README.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ensive tests Database Isolation: - Use separate database file: tingly_enterprise.db - Add EnterpriseDBConfig with configurable SQLite options - Add connection pooling and health check - Add default admin user creation on first init - Enterprise database is ONLY accessed through enterprise module Integration Interface Layer: - Add Integration interface with clear contract - Add authentication methods (ValidateAccessToken, ValidateAPIToken) - Add user information methods (GetUserInfo, HasPermission, HasRole) - Add HTTP middleware (AuthMiddleware, RequirePermission, RequireRole) - Add admin management methods (CreateUser, UpdateUser, ResetPassword) - Add token management methods (CreateAPIToken, ListAPITokens, RevokeAPIToken) - Add audit and statistics methods - Add cleanup methods (CleanupExpired) Unit Tests: - Add user model tests (Create, GetByUsername, Activate, List, etc.) - Add user service tests (CreateUser, ChangePassword, DuplicateUsername) - Add token model tests (Create, ValidateToken, Delete, CleanupExpired) - Add RBAC middleware tests (AuthMiddleware, RequireRole, RequirePermission) - Add permission and role validation tests Maintains complete isolation from community edition while providing clean integration points for external systems. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add test runner Go program for automated testing - Add shell script for running all enterprise tests - Tests can be run from repository root with: ./tests/enterprise/run_tests.sh Test packages covered: - internal/enterprise/auth - internal/enterprise/user - internal/enterprise/token - internal/enterprise/rbac Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Test Coverage Report (docs/enterprise/TEST_COVERAGE.md): - Test coverage summary by module - Coverage estimates (~75% overall) - Running tests instructions - Test quality notes and improvement areas Integration Guide (docs/enterprise/INTEGRATION.md): - Complete integration interface documentation - Step-by-step integration instructions - Example code for common integration scenarios - Authentication middleware usage examples - Permission and role checking examples - API endpoint reference - Troubleshooting guide - Migration path from community edition These documents provide everything needed to integrate the enterprise module into external systems while maintaining complete isolation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add complete example demonstrating enterprise module integration: - Self-running demo with 10 test steps - HTTP server with public/protected/admin routes - Demonstrates user management, token creation, RBAC Example features: - Automated testing of all core enterprise features - Reuses existing users on repeated runs - Comprehensive logging with colored output - Graceful shutdown after demo completion Enterprise module fixes: - Fix SQLite DSN construction (file:path?option=value) - Remove duplicate EnterpriseDB declaration - Add context import to handlers - Fix gin.Error typo in handlers - Remove duplicate error declarations in user package - Remove unused imports and variables Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/enterprise/auth/jwt.go

internal/enterprise/user/service.go

andreasfoo · 2026-02-08T14:04:46Z

internal/enterprise/integration_impl.go

+	if !ei.enabled {
+		return ErrNotEnabled
+	}
+


useless function?

andreasfoo · 2026-02-08T14:05:09Z

internal/enterprise/integration_impl.go

+	if !ei.enabled {
+		return nil, ErrNotEnabled
+	}
+


another useless one

FFengIll force-pushed the feat/enterprise branch from 5351682 to edbec01 Compare February 8, 2026 13:04

FFengIll requested a review from andreasfoo February 8, 2026 13:13

FFengIll changed the title ~~feat: new enterprise module for RBAC.~~ feat: new enterprise module of user RBAC (role base access control) . Feb 8, 2026

FFengIll and others added 8 commits February 8, 2026 21:37

FFengIll force-pushed the feat/enterprise branch from edbec01 to aad4b6e Compare February 8, 2026 13:37

FFengIll changed the title ~~feat: new enterprise module of user RBAC (role base access control) .~~ feat: Enterprise Edition - Multi-User Support with RBAC Feb 8, 2026

andreasfoo reviewed Feb 8, 2026

View reviewed changes

FFengIll added 2 commits February 9, 2026 11:31

feat: add count by role instead of hard code number loop.

1297f98

config: change jwt token expiry to 8 hours.

48ebf91

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Enterprise Edition - Multi-User Support with RBAC #315

feat: Enterprise Edition - Multi-User Support with RBAC #315
FFengIll wants to merge 10 commits intomainfrom
feat/enterprise

FFengIll commented Feb 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

andreasfoo Feb 8, 2026

Uh oh!

FFengIll Feb 9, 2026

Uh oh!

andreasfoo Feb 8, 2026

Uh oh!

FFengIll Feb 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

Conversation

FFengIll commented Feb 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key Features

Changes

Database Schema

Configuration

Test Plan

Uh oh!

Uh oh!

Uh oh!

andreasfoo Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

FFengIll Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

andreasfoo Feb 8, 2026

Choose a reason for hiding this comment

Uh oh!

FFengIll Feb 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Comments

FFengIll commented Feb 8, 2026 •

edited

Loading