Enterprise Platform Foundation

Build any application with a robust, flexible, and production-ready REST API boilerplate. Everything you need, nothing you don't.

Why This Platform?

Thoughtfully designed, flexible, and ready for any project

1
Config = 5 Endpoints
100%
Type Safe
Extensible
0
Repetitive Code

Generic CRUD

One configuration file generates complete REST API with validation, permissions, and Swagger docs.

Zero Boilerplate
🎨

Admin Panel

Modern React interface with shadcn/ui. Auto-generated forms, tables, and relations management.

Production Ready
🔐

Authentication

Passwordless OTP system with JWT tokens. Email and SMS support with session management.

Secure by Default
🛡️

Authorization

Granular RBAC with permission hierarchy. SUPERADMIN, ADMIN roles with fine-grained control.

Flexible
📬

Notifications

Multi-channel system: EMAIL, SMS, PUSH, INTERNAL. User subscriptions, scheduling, templates.

Complete
⚙️

Event System

Type-safe event-driven architecture. Decoupled modules, automatic handlers, audit logging.

Scalable
🔗

Webhooks

HMAC-signed HTTP callbacks. Retry logic, delivery tracking, per-app subscriptions.

Reliable
📁

File Management

S3/MinIO storage with thumbnails, presigned URLs, polymorphic attachments, auto-cleanup.

Enterprise
🌍

i18n & Templates

Database-stored translations with Handlebars. RTL support, code-first sync, hot reload.

Global Ready
🔑

App Management

External app registration with API tokens. Secure token-based authentication, webhook management, and usage tracking.

API Ready
🤖

AI Integration

OpenAI-compatible client with automatic usage tracking, cost analysis, and multi-provider support (OpenAI, Anthropic, Azure, Ollama).

Features: Usage logs, cost tracking by model, actor context, purpose categorization
Modern
🧙

AI-Powered Wizards

Interactive questionnaires with AI-generated questions. Ping-pong approach: AI asks questions based on previous answers, creating a dynamic conversation.

Use cases: Project requirements gathering, client onboarding, surveys
Interactive

AI-Powered Interactive Wizards

Intelligent questionnaires that adapt to responses

How It Works

Create interactive surveys where AI generates contextual questions based on previous answers:

1. Create

Admin creates wizard, gets public link

2. Start

Respondent fills initial form

3. AI Questions

AI generates questions based on answers

4. Answer

Respondent answers questions

5. More Questions

AI generates new questions (ping-pong)

6. Complete

Wizard completed, all data saved

Ping-Pong Approach

  1. Initial form: Project description, problem, platform, audience, features
  2. AI analyzes: Reads all previous answers and context
  3. Generates questions: Creates relevant questions with suggested answers
  4. Respondent answers: Can accept suggestions or write custom answers
  5. Repeat: Generate more questions based on new answers
  6. Complete: When all important topics are covered
🎯

Context-Aware

AI analyzes all previous answers before generating new questions. Avoids repetition, focuses on gaps.

// AI considers:
- Project description
- All previous Q&A
- Missing information
💡

Suggested Answers

AI provides suggested answers based on context. Respondents can accept, modify, or write their own.

🌍

Multi-Language

Questions and suggestions generated in the wizard's language. Supports 12+ languages.

  • English, Russian, Hebrew
  • Spanish, French, German
  • Chinese, Japanese, Korean
  • And more...
📋

Question Topics

AI focuses on business requirements, not technical details:

  • User roles and tasks
  • Key features
  • User scenarios
  • Business model
  • Integrations
  • Admin requirements

API Flow

// 1. Admin creates wizard
POST /admin/wizards
→ Returns: { id, publicUrl: "/wizard/{id}" }

// 2. Respondent starts wizard
POST /wizard/{id}/start
{ email, name, formData: { description, problem, ... } }

// 3. Generate AI questions
POST /wizard/{id}/generate-questions
{ count: 5 }
→ Returns: { questions: [{ question, suggestedAnswer }] }

// 4. Answer questions
POST /wizard/{id}/questions/{questionId}/answer
{ answer: "..." }

// 5. Generate more questions (ping-pong)
POST /wizard/{id}/generate-questions
→ AI considers all previous answers

// 6. Complete wizard
POST /wizard/{id}/complete

Generic CRUD System

One config file = Complete REST API

How It Works

Define a resource configuration, get 5 CRUD endpoints automatically:

export const usersConfig: ResourceConfig = {
  name: 'users',
  model: 'user',
  searchFields: ['email', 'name'],
  permissions: {
    list: [AdminRole.ADMIN],
    create: [AdminRole.SUPERADMIN],
  },
  schemas: { /* JSON Schema validation */ },
}

Generated Endpoints:

  • GET /admin/users - List with pagination, search, filters
  • GET /admin/users/:id - Get single record
  • POST /admin/users - Create new record
  • PUT /admin/users/:id - Update record
  • DELETE /admin/users/:id - Delete record
✨ Features: JSON Schema validation, RBAC, full-text search, pagination, sorting, bulk operations, Excel export, lifecycle hooks, relation support

Authentication & Authorization

Secure by design, flexible by nature

🔑

Passwordless Auth

OTP-based authentication via email or SMS. Auto user creation, rate limiting, session management.

POST /auth/request-otp
POST /auth/verify-otp
POST /auth/refresh
🛡️

RBAC System

Role-based access with granular permissions. SUPERADMIN bypass, ADMIN with permission checks.

permissions: [
  'users',
  'files',
  'notifications.list'
]

Flexible Permission System

Granular access control with permission hierarchy and categories:

Roles

SUPERADMIN
Full access, bypasses all checks
ADMIN
Access based on assigned permissions

Permission Categories

CORE:
dashboard, users, files
CONTENT:
pages, i18n.*
SYSTEM:
system.*
NOTIFICATIONS:
notifications.*
AI:
ai.usage, ai.models
APPS:
apps.*, apps.webhooks

Permission Hierarchy

Parent permissions cover children:

users // Full access (view, create, edit, delete)
  └── users.readonly // View only (automatically included)

If admin has users permission, they automatically have users.readonly access.

Per-Operation Permissions

// Different permissions for different operations
permissions: {
  list: [AdminRole.ADMIN],
  get: [AdminRole.ADMIN],
  create: [AdminRole.SUPERADMIN],
  update: [AdminRole.ADMIN],
  delete: [AdminRole.SUPERADMIN]
}

Multi-Channel Notifications

Reach users everywhere they are

Notification Flow

Event Trigger

Domain events emit

Router

Resolves config

Channels

EMAIL, SMS, PUSH, INTERNAL

Delivery

SendGrid, Inforu, FCM

User Subscriptions

Per-event channel preferences. Users control how they receive notifications.

Scheduling

Preferred delivery times, timezone support. Respect user preferences.

Templates

Handlebars templates with i18n. Dynamic content with variables.

Event-Driven Architecture

Subscribe to events, trigger webhooks and notifications automatically

How Events Work

Events are emitted when something happens in the system. Multiple handlers can react to the same event:

Event Emitted

user.created

Notification Handler

Send email/SMS

Webhook Handler

POST to external API

Audit Handler

Log to database

// Emit an event
appEvents.emit('user.created', {
  userId: 'user-123',
  email: 'user@example.com',
  name: 'John Doe'
}, {
  shouldNotify: true,
  priority: 1
})
📡

Webhook Subscriptions

Subscribe external apps to events. Receive HTTP callbacks with HMAC signatures when events occur.

// Subscribe to events
eventTypes: [
  'user.created',
  'order.shipped'
]
// → POST to your webhook URL
🔔

Notification Subscriptions

Users and admins subscribe to events. Receive notifications via EMAIL, SMS, PUSH, or INTERNAL channels.

// User preferences
channels: ['EMAIL', 'PUSH']
preferredDeliveryTime: '09:00'
📋

Available Events

Pre-defined events for common operations. Add custom events for your business logic.

  • user.created - New user registered
  • user.updated - User profile changed
  • auth.otp.requested - OTP code sent
  • entity.created - Any entity created
  • entity.updated - Any entity updated
  • notification.failed - Delivery failed
⚙️

Event Registry

Events defined in code, synced to database. Admins configure active channels and delivery times.

Access Levels:
PUBLIC - Users can subscribe
ADMIN_ONLY - Admins only
SYSTEM - Mandatory (e.g., OTP)

Complete Flow Example

  1. Event emitted: user.created with user data
  2. Notification handler: Checks user subscriptions → Sends welcome email
  3. Webhook handler: Finds subscribed apps → POSTs to webhook URLs
  4. Audit handler: Logs event to database for history
  5. Result: User gets email, external systems get notified, everything is logged

App Management & API Tokens

Secure API access for external applications

How It Works

External applications register and receive API tokens for authenticated access. Each app can have multiple tokens (production, staging, etc.) with independent expiration and access control.

1. Register App

Admin creates app in admin panel

2. Generate Token

Create API token with name and expiration

3. Use Token

Send X-App-Token header in requests

4. Access API

Manage webhooks, view logs

// 1. Admin creates app and token
POST /admin/apps
POST /admin/app-tokens
→ Returns: { token: "app_xxx..." } (shown once!)

// 2. External app uses token
GET /api/v1/apps/me
Headers: X-App-Token: app_xxx...

// 3. Manage webhooks
GET /api/v1/apps/webhooks
POST /api/v1/apps/webhooks
{ url, eventTypes: ["user.created"] }

// 4. View delivery logs
GET /api/v1/apps/webhooks/:id/logs
🔐

Secure Tokens

Tokens are SHA-256 hashed before storage. Only token prefix is shown after creation. Automatic expiration and revocation support.

Token format: app_xxxxxxxx
Storage: SHA-256 hash
Display: app_xxxx... (prefix only)
📊

Usage Tracking

Automatic tracking of token usage. Last used timestamp, active/inactive status, and expiration dates. Monitor API access patterns.

  • Last used timestamp
  • Active/inactive status
  • Expiration dates
  • App-level access control
🔗

Webhook Management

Apps can manage their own webhook subscriptions via API. Subscribe to events, view delivery logs, and manage endpoints programmatically.

// Self-service webhook management
POST /api/v1/apps/webhooks
{
  url: "https://myapp.com/webhook",
  eventTypes: ["user.created", "order.shipped"]
}
🛡️

Access Control

App-level and token-level access control. Deactivate apps or individual tokens without affecting others. Granular security management.

  • App activation/deactivation
  • Token activation/deactivation
  • Per-token expiration
  • Automatic validation

Internationalization (i18n)

Multi-language support with database overrides

How It Works

Translation system with code-first approach and database overrides. Supports 12+ languages with RTL support, Handlebars templates, and hot reload.

Resolution Order

  1. Database: Check DB for target locale translation
  2. File: Check file-based translation for target locale
  3. Database Fallback: Check DB for fallback locale (usually "en")
  4. File Fallback: Check file-based translation for fallback locale
  5. Key: Return translation key if nothing found
// Translation files: src/i18n/locales/{locale}/*.json
// Example: locales/en/common.json
{
  "welcome": {
    "title": "Welcome, {{name}}!"
  }
}

// Use in code
const message = await i18n.t(
  'common.welcome.title',
  { name: 'John' },
  'en'
)
// → "Welcome, John!"
📁

File-Based Translations

JSON files organized by locale and namespace. Version controlled, code-first approach. Easy to sync and maintain.

  • Namespaced JSON files
  • Hot reload support
  • Version controlled
  • Code-first sync
💾

Database Overrides

Admin can override translations in database without code changes. Perfect for client-specific customizations and A/B testing.

// DB override takes precedence
DB: "Welcome, {{name}}!"
File: "Hello, {{name}}!"
// → Uses DB version
🎨

Handlebars Templates

Dynamic content with Handlebars syntax. Variables, conditionals, and helpers supported. Perfect for email and SMS templates.

"message": "{{#if paid}}Paid{{else}}Pending{{/if}}"
"count": "You have {{count}} items"
🌐

Multi-Language Support

12+ languages supported with RTL (Right-to-Left) support for Hebrew, Arabic, and other RTL languages.

  • English, Russian, Hebrew
  • Spanish, French, German
  • Chinese, Japanese, Korean
  • RTL support included
  • Easy to add more

Comprehensive Logging

Track everything that happens in your system

📝

Audit Logs

Automatic logging of all CRUD operations. Track who changed what, when, and from where. Includes before/after states and change diffs.

// Auto-logged:
entity: 'User'
action: 'update'
actorType: 'ADMIN'
before / after / changes
📧

Message Logs

Complete history of all EMAIL and SMS messages sent. Track delivery status, provider responses, and retry attempts.

  • Recipient and subject
  • Delivery status (SENT, FAILED)
  • Provider message IDs
  • Retry history
🔗

Webhook Logs

Full delivery history for webhook calls. Track HTTP responses, retry attempts, and delivery failures.

  • Event type and payload
  • HTTP status codes
  • Response bodies
  • Retry schedule
  • Duration tracking
🤖

AI Usage Logs

Track all AI API calls with token usage, costs, and performance metrics. Analyze usage by model, user, and purpose.

model: 'gpt-4o'
inputTokens: 150
outputTokens: 300
totalCostCents: 0.34
purpose: 'translation'

Log Features

  • Read-only access: All logs are immutable for audit compliance
  • Search & filter: Full-text search across log entries
  • Date ranges: Filter by time periods
  • Export: Export logs to Excel for analysis
  • Automatic: No manual logging needed - everything is tracked automatically
  • Context: IP addresses, user agents, actor information included

System Architecture

Built for scale, designed for flexibility

Fastify Server

High-performance HTTP framework

Generic CRUD

Auto-generated endpoints

Service Layer

Business logic separation

Event System

Decoupled communication

Prisma ORM

Type-safe database access

External Services

SendGrid, FCM, S3

Type Safety

Full TypeScript with JSON Schema validation. End-to-end type safety.

Code-First

Templates and events defined in code, synced to database. Version controlled.

Plugin Architecture

Cross-cutting concerns as plugins. Easy to extend and customize.

Stateless Design

JWT-based auth, no server sessions. Horizontal scaling ready.