Multi-Tenant SaaS System

A scalable multi-tenant backend system built with Node.js, Express, and TypeScript featuring secure tenant data isolation, JWT-based authentication, and role-based access control (RBAC).

Features

• Multi-Tenancy: Complete data isolation between tenants with tenant-scoped queries
• Authentication & Authorization: JWT-based auth with role-based access control (Admin, User roles)
• User Management: User registration, invitations, and role management
• Service Management: CRUD operations for tenant-specific services
• Booking System: Create, manage, and track bookings with status updates
• Billing Integration: Usage tracking and subscription plan management
• Security: Password hashing with bcryptjs, secure JWT tokens, protected routes
• TypeScript: Type-safe codebase for better developer experience

Tech Stack

• Runtime: Node.js
• Language: TypeScript
• Framework: Express
• Database: MongoDB with Mongoose ODM
• Authentication: JWT (jsonwebtoken)
• Password Hashing: bcryptjs
• Environment Config: dotenv
• Development: nodemon + ts-node

Getting Started

Prerequisites

• Node.js (LTS version recommended)
• npm or yarn
• MongoDB instance (local or cloud)

Installation

# Clone the repository
git clone <your-repo-url>
cd Multi-Tenant

# Install dependencies
npm install

Environment Variables

Create a .env file in the project root:

MONGO_URI=mongodb://localhost:27017/multi-tenant
JWT_SECRET=your_jwt_secret_here
NODE_ENV=development
PORT=5000

Note: Replace your_jwt_secret_here with a strong secret key. Adjust MONGO_URI and PORT as needed.

Running the Application

Development mode:

npm run dev

This runs nodemon src/server.ts via ts-node and automatically restarts on file changes.

Server will start at: http://localhost:5000

API Documentation

Authentication

Method	Endpoint	Description	Auth Required
POST	/api/auth/login	Login with email/password, returns JWT	No
POST	/api/auth/forgot-password	Request password reset token	No
POST	/api/auth/reset-password	Reset password using token	No

Tenants

Method	Endpoint	Description	Auth Required
POST	/api/tenants	Create new tenant	Yes
GET	/api/tenants	List all tenants	Yes
GET	/api/tenants/:id	Get tenant by ID	Yes
PUT	/api/tenants/:id	Update tenant (plan, billing)	Yes
DELETE	/api/tenants/:id	Delete tenant	Yes

Users

Method	Endpoint	Description	Auth Required
POST	/api/users	Register/create user	No
POST	/api/users/register	Register user (alias)	No
GET	/api/users	List users (tenant-scoped)	Yes
GET	/api/users/:id	Get user details	Yes
PUT	/api/users/:id	Update user	Yes
DELETE	/api/users/:id	Delete user	Yes
POST	/api/users/invite	Invite user (Admin only)	Yes (Admin)
PATCH	/api/users/:id/role	Update user role (Admin only)	Yes (Admin)

Services

Method	Endpoint	Description	Auth Required
POST	/api/services	Create service	Yes
GET	/api/services	List services (tenant-scoped)	Yes
GET	/api/services/:id	Get service by ID	Yes
PUT	/api/services/:id	Update service	Yes
DELETE	/api/services/:id	Delete service	Yes

Bookings

Method	Endpoint	Description	Auth Required
POST	/api/bookings	Create booking	Yes
GET	/api/bookings	List bookings with filters	Yes
PATCH	/api/bookings/:id/status	Update booking status	Yes
PATCH	/api/bookings/:id/cancel	Cancel booking	Yes

Billing

Method	Endpoint	Description	Auth Required
GET	/api/billing/me	Get current tenant's plan & usage	Yes
POST	/api/billing/checkout	Create checkout session	Yes

Project Structure

src/
├── config/
│   └── db.ts                    # Database connection
├── controllers/
│   ├── tenant.controller.ts     # Tenant business logic
│   ├── user.controller.ts       # User business logic
│   ├── service.controller.ts    # Service business logic
│   └── booking.controller.ts    # Booking business logic
├── middleware/
│   ├── auth.middleware.ts       # JWT verification & RBAC
│   └── error.middleware.ts      # Centralized error handling
├── models/
│   ├── tenant.model.ts          # Tenant schema
│   ├── user.model.ts            # User schema
│   ├── service.model.ts         # Service schema
│   ├── booking.model.ts         # Booking schema
│   └── invite.model.ts          # Invite schema
├── routes/
│   ├── tenant.routes.ts         # Tenant endpoints
│   ├── user.routes.ts           # User endpoints
│   ├── service.routes.ts        # Service endpoints
│   ├── booking.routes.ts        # Booking endpoints
│   └── billing.routes.ts        # Billing endpoints
├── services/
│   └── billing.service.ts       # Billing logic
└── server.ts                    # Application entry point

Key Features Explained

Multi-Tenancy

Each tenant's data is completely isolated. All database queries automatically filter by tenantId to ensure users only access their organization's data.

Role-Based Access Control (RBAC)

• Admin: Full access to tenant management, user invitations, and role assignments
• User: Access to services, bookings, and personal data within their tenant

Security

• Passwords are hashed using bcryptjs before storage
• JWT tokens for stateless authentication
• Protected routes with middleware validation
• Tenant-scoped data access