ManageX | Ashim Parajuli

A modular, multi-tenant management platform with fine-grained RBAC and realtime collaboration.

Built to explore the architecture behind real-world organization-based management systems.

🚧 Under active development

What is ManageX?

ManageX is a management platform designed around organizations, members, roles, permissions, and modular features.

Users can belong to multiple organizations, each organization can define its own roles and access rules, and individual module instances can have their own permissions.

The project is intentionally being built beyond a basic CRUD application, with a focus on:

Multi-tenant architecture
Fine-grained authorization
Modular feature design
Relational database modeling
REST API architecture
Realtime collaboration
Scalable backend design

ManageX is currently under construction, with the backend architecture being developed before the platform’s larger management modules are added.

Architecture

ManageX is organized around several interconnected domains:

Domain	Responsibility
👤 Identity	Users and authentication
🏢 Organizations	Organizations and their members
🎭 Roles	Organization-specific roles
🔐 Permissions	System and instance-level authorization
🧩 Modules	Reusable module instances
✉️ Invitations	Organization membership invitations
⚡ Realtime	Presence, broadcasts, and live activity

Data model

                           ┌──────────────┐
                           │     User     │
                           └──────┬───────┘
                                  │
                                  ▼
                       ┌────────────────────┐
                       │ OrganizationUser   │
                       └─────────┬──────────┘
                                 │
                                 ▼
                      ┌─────────────────────┐
                      │    Organization     │
                      └──────┬─────────┬────┘
                             │         │
                   ┌─────────┘         └─────────────┐
                   ▼                                 ▼
              ┌──────────┐                   ┌────────────────┐
              │   Role   │                   │ ModuleInstance │
              └────┬─────┘                   └───────┬────────┘
                   │                                  │
          ┌────────┴────────┐                         ▼
          ▼                 ▼                ┌──────────────────┐
┌──────────────────┐ ┌──────────────────┐    │InstancePermission│
│SystemPermission  │ │RoleSystemPerm.   │    └────────┬─────────┘
└──────────────────┘ └──────────────────┘             │
          ▲                                           ▼
          │                                  ┌──────────────────┐
          │                                  │RoleInstancePerm. │
          │                                  └──────────────────┘
          │
          │
   ┌──────┴─────────────┐
   │                    │
   ▼                    ▼
┌──────────────┐  ┌─────────────────┐
│   System     │  │    Instance     │
│   Override   │  │    Override     │
└──────────────┘  └─────────────────┘

Authorization

Authorization is one of the core parts of ManageX.

Rather than relying on a fixed set of hard-coded roles, organizations can define their own roles and assign permissions to them.

System permissions

System permissions control organization-wide features.

organization.view
organization.edit

role.view
role.create
role.edit
role.delete

member.view
member.invite
member.remove

Instance permissions

Some modules can exist as multiple independent instances within an organization.

For example:

Inventory #1
├── view
├── create
├── edit
└── delete

Inventory #2
├── view
└── edit

This allows access to be controlled at the individual module-instance level, rather than only at the module level.

Permission overrides

Roles provide the normal permission set for a user, but individual users can also receive explicit permission overrides.

Role
 │
 ├── System permissions
 │
 └── Instance permissions
          │
          ▼
    User-specific
      overrides
       ├── allow
       └── deny

This makes it possible to handle cases such as:

A Manager can edit inventory, but a particular Manager can be denied access to one specific inventory instance.

Realtime collaboration

Realtime collaboration is planned as part of the platform.

The goal is to allow users working inside the same module instance to see each other’s presence and activity.

For example:

┌─────────────────────────────────┐
│ Inventory                       │
│                                 │
│  👤 Ashim     👤 Bob            │
│  ● viewing    ● editing         │
│                                 │
│  2 people currently here        │
└─────────────────────────────────┘

Planned realtime functionality includes:

👥 User presence
🟢 Join/leave events
⌨️ Activity and typing indicators
📡 Broadcast events
🔄 Live updates
🧩 Module-instance-specific channels

Realtime architecture

The planned deployment architecture separates application authority from realtime communication.

                         ┌─────────────────┐
                         │     Next.js     │
                         │    Frontend     │
                         └────────┬────────┘
                                  │
                    ┌─────────────┴─────────────┐
                    │                           │
                  REST                       Realtime
                    │                           │
                    ▼                           ▼
           ┌─────────────────┐        ┌─────────────────┐
           │     FastAPI     │        │    Supabase     │
           │                 │        │    Realtime     │
           │ Authentication  │        │                 │
           │ Authorization   │        │ Presence        │
           │ Business Logic  │        │ Broadcasts      │
           │ REST API        │        │ Activity        │
           └────────┬────────┘        └─────────────────┘
                    │
                    ▼
           ┌─────────────────┐
           │   PostgreSQL    │
           │    Supabase     │
           └─────────────────┘

FastAPI remains the authority.

Supabase Realtime is only intended to provide realtime communication such as presence and broadcasts.

Authentication, authorization, permissions, and business rules remain under the control of the FastAPI backend.

Realtime clients are never treated as an authority for determining whether an operation is allowed.

Database models

ManageX currently contains 12 interconnected SQLAlchemy models covering identity, organizations, roles, permissions, modules, and authorization relationships.

User

Column	Type	Constraints
`id`	int	PK
`email`	str	unique, indexed
`username`	str	unique, indexed
`first_name`	str
`middle_name`	str	None
`last_name`	str
`password_hash`	str
`is_active`	bool	default `True`

Organization

Column	Type	Constraints
`id`	int	PK
`name`	str	not null
`owner_id`	int	FK → `users.id`

OrganizationUser

Column	Type	Constraints
`id`	int	PK
`user_id`	int	FK → `users.id`
`organization_id`	int	FK → `organizations.id`
`date_joined`	datetime
`role_id`	int	None
`is_active`	bool	default `True`

Unique constraint:

(user_id, organization_id)

Invite

Handles organization membership invitations.

organization_id
user_identifier
invited_by
status
created_at

Supported states:

pending
accepted
rejected
seen

Role

Roles belong to an organization.

id
name
organization_id

Role names are unique within an organization.

SystemPermission

Defines organization-wide permissions.

id
feature
action

Examples:

role.create
role.delete
member.invite
organization.edit

RoleSystemPermission

Association table between roles and system permissions.

role_id
system_permission_id

Uses a composite primary key.

ModuleInstance

Represents an individual instance of a module inside an organization.

id
name
template
organization_id

InstancePermission

Defines permissions available for a particular module instance.

id
instance_id
action

RoleInstancePermission

Association table between roles and instance permissions.

role_id
instance_permission_id

Uses a composite primary key.

SystemPermissionOverride

Allows individual users to override system-level permissions.

id
user_id
permission_id
effect

InstancePermissionOverride

Allows individual users to override permissions for specific module instances.

id
user_id
instance_permission_id
effect

Current progress

Roadmap

Foundation
    │
    ├── Authentication ──────────────── ✓
    ├── Organizations ──────────────── ✓
    ├── Membership ─────────────────── ✓
    └── Invitations ────────────────── ✓
    │
    ▼
Authorization
    │
    ├── Roles ──────────────────────── ✓
    ├── System permissions ─────────── ✓
    ├── Instance permissions ───────── ✓
    ├── Permission overrides ───────── ✓
    └── Permission enforcement ─────── 🚧
    │
    ▼
Modules
    │
    ├── Module architecture ────────── 🚧
    ├── Management features ────────── 📋
    └── Module workflows ───────────── 📋
    │
    ▼
Realtime
    │
    ├── Supabase Realtime ──────────── 📋
    ├── User presence ──────────────── 📋
    ├── Broadcast events ───────────── 📋
    └── Activity indicators ────────── 📋
    │
    ▼
Platform
    │
    ├── Frontend ───────────────────── 📋
    ├── Testing ────────────────────── 📋
    └── Production deployment ─────── 📋

Legend: ✓ Complete · 🚧 In progress · 📋 Planned

Project goals

ManageX is being built as a large-scale portfolio project to explore the architectural problems that appear in real-world management platforms.

The main goals are:

Build a proper multi-tenant architecture
Implement fine-grained RBAC
Support instance-level authorization
Explore user-specific permission overrides
Build modular management features
Design a relational database around real application requirements
Build and maintain a REST API
Explore realtime collaboration
Learn production-oriented deployment architecture

The project is still under construction, and the architecture will continue to evolve as new requirements are introduced.