I got tired of rebuilding Auth, so I open-sourced URBAC (NestJS + Angular + PostgreSQL)

Every time I start a new full-stack project, the first week is always the same: setting up users, configuring database relationships, writing JWT guards, and building route protectors.

Role-Based Access Control (RBAC) is something every enterprise app needs, but building a clean, scalable version of it from scratch every single time is exhausting.

So, I decided to build it once, build it right, and open-source it for everyone.

Meet URBAC (Unified Role-Based Access Control).

What is URBAC?
URBAC is a production-ready, full-stack boilerplate designed to help you scaffold secure, multi-level access control systems in minutes.

The stack is strictly built for enterprise scale:

• Backend: NestJS & TypeORM
• Frontend: Angular (with PrimeNG & Tailwind CSS)
• Database: PostgreSQL

The Architecture
Instead of using messy, complicated three-way junction tables, I architected URBAC with a clean, top-down administrative grouping model. This makes the database queries lightning-fast and the mental model incredibly easy to understand:

1. Groups are administrative buckets (e.g., "Users", "Admins", "Super Admins").
2. Users are assigned to a Group.
3. Roles are assigned to a Group.
4. Privileges are attached to Roles.

It also features Role Escalation Security. Every role has a numeric level (e.g., Admin = 50, Super Admin = 100). The backend guards automatically ensure that a Level 10 user can never grant someone a Level 50 role.

Developer Experience First
I wanted this template to feel like magic when you use it.

On the backend, protecting a route is as simple as dropping a custom decorator on your NestJS controller:

@Post('create')
@RequirePermissions('user:create')
async createNewUser() {
// Only users with this specific privilege can execute this
}
On the frontend, I built a custom structural directive for Angular that reacts to the logged-in user's active group context. Hiding buttons from unauthorized users takes one line of HTML:

<button *hasPermission="'user:delete'" class="p-button-danger">
Delete User
</button>

Try it out
The repository comes with a database seed script that instantly provisions a Super Admin account ([email protected]), so you can clone it, run npm run seed, and immediately log into the dashboard to start managing roles.

You can check out the full source code and documentation here: URBAC

If you find this template useful for your next NestJS/Angular project, I would hugely appreciate a star on GitHub! Let me know in the comments what features or auth modules you'd like to see added next.