ProjectRole-Based Dashboard
Role-based access control (RBAC) admin dashboard for managing users, roles, permissions and departments, where each role sees its own set of pages. Paired with an Express API that enforces admin-only routes with JWT and is covered by Jest tests.
Overview
An admin dashboard for role-based access control. Admins create and edit roles and their permissions, manage users and departments, and plan on a shared calendar; the sidebar adapts to the signed-in role, so Admins, Managers and Employees each see their own set of pages. The live demo runs on mock services, so its data resets on reload.
Alongside it, a standalone Express API stores users and roles in SQLite through Sequelize, hashes passwords with bcrypt, signs a JWT at login and puts role and user changes behind admin-only middleware, with Jest and Supertest tests for the allowed and the denied cases.
Key Features
- Create, edit and delete roles and their permissions
- Role-aware navigation for Admin, Manager and Employee
- User and department management, plus a team calendar
- Express API with JWT auth and admin-only routes
- Jest and Supertest tests for allowed and denied requests
Stack
Challenges & Solutions
- Enforcing role checks on the API, not just hiding links in the UI.Verified a signed JWT on every protected route and put role and user changes behind admin-only middleware, with Jest and Supertest tests for both the allowed and the denied cases.
- Stopping an admin from locking everyone out by editing or deleting the admin role.Made the role controller refuse updates and deletes on the built-in admin role, and covered the delete case in the API tests.