# ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system architecture

> Architecture diagram of the GitHub repository ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system
- Repository: https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system

## Overview

This is a zero-trust, just-in-time privileged-access platform: employees request temporary server access, managers approve or deny it, and authorized engineers connect through an SSH bastion. The backend records grants and sessions, while managers can revoke live access; audit and monitoring capabilities provide review and alerting. The graph preserves the documented admin, employee, manager, audit, and session-replay surfaces. Some subsystem links are based on README descriptions or SOURCE INDEX references rather than inspected implementation excerpts.

Main entry points: [`backend/src/app.js`](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/app.js) (REST API), [`gateway/app/ssh_server.py`](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/gateway/app/ssh_server.py) (SSH bastion), [`frontend/src/App.jsx`](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/frontend/src/App.jsx) (Role dashboards), [`monitoring/src/app.js`](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/monitoring/src/app.js) (Event ingestion and queries)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_web["Web portals"]
  node_webapp["Role dashboards<br/>[App.jsx]"]
  node_employeeui["JIT request and grants"]
  node_managerui["Approvals and sessions"]
  node_adminui["Server and user admin<br/>[AdminDashboard.jsx]"]
  node_auditui["Audit review and replay<br/>[AuditView.jsx]"]
end

subgraph group_api["Access management API"]
  node_api["REST API<br/>[app.js]"]
  node_auth["Identity and role checks<br/>[auth.js]"]
  node_requests["Request lifecycle"]
  node_approvals["Grant and revocation"]
  node_serveradmin["Server administration"]
  node_gatewayauth["Gateway access check"]
  node_records[("Access and audit records<br/>[index.js]")]
end

subgraph group_gateway["SSH gateway"]
  node_bastion["SSH bastion<br/>[ssh_server.py]"]
  node_policy["Access policy<br/>[policy.py]"]
  node_sessionstate["Live session manager<br/>[session_manager.py]"]
  node_recorder["Session recording<br/>[recorder.py]"]
  node_revocation["Revocation listener<br/>[revocation.py]"]
end

subgraph group_observability["Audit and monitoring"]
  node_monitor["Event ingestion and queries<br/>[app.js]"]
  node_metrics["Prometheus metrics<br/>[metrics.js]"]
  node_alerts["Alert rules<br/>[alerts.js]"]
  node_monitorstore[("Monitoring event store<br/>[db.js]")]
end

node_engineer(("Engineer"))
node_manager(("Security manager"))
node_admin(("Administrator"))
node_terminal["SSH terminal"]
node_target["Managed server"]
node_postgres[("PostgreSQL")]
node_redis[("Redis cache and pubsub")]

node_engineer -->|"uses portal"| node_webapp
node_manager -->|"uses portal"| node_webapp
node_admin -->|"uses portal"| node_webapp
node_webapp -->|"routes to"| node_employeeui
node_webapp -->|"routes to"| node_managerui
node_webapp -->|"routes to"| node_adminui
node_webapp -->|"routes to"| node_auditui
node_employeeui -.->|"requests access"| node_api
node_managerui -.->|"reviews access"| node_api
node_adminui -.->|"manages servers"| node_api
node_auditui -.->|"queries audit"| node_api
node_api -->|"mounts routes"| node_auth
node_api -->|"routes requests"| node_requests
node_api -->|"routes manager actions"| node_approvals
node_api -->|"routes server actions"| node_serveradmin
node_api -->|"routes internal checks"| node_gatewayauth
node_approvals -->|"reads and writes"| node_records
node_approvals -->|"caches grants and publishes revocations"| node_redis
node_records -->|"persists records"| node_postgres
node_terminal -->|"connects over SSH"| node_bastion
node_bastion -->|"checks authorization"| node_gatewayauth
node_bastion -->|"enforces policy"| node_policy
node_bastion -->|"tracks sessions"| node_sessionstate
node_bastion -->|"records session"| node_recorder
node_bastion -->|"opens SSH tunnel"| node_target
node_redis -->|"delivers revocations"| node_revocation
node_revocation -.->|"severs session"| node_sessionstate
node_bastion -->|"submits events"| node_monitor
node_api -->|"submits events"| node_monitor
node_monitor -->|"persists and queries"| node_monitorstore
node_monitor -->|"updates metrics"| node_metrics
node_monitor -->|"evaluates rules"| node_alerts
node_alerts -->|"re-ingests alerts"| node_monitor
node_monitor -.->|"serves audit data"| node_auditui

click node_webapp "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/frontend/src/App.jsx"
click node_employeeui "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/frontend/src/pages/EmployeeDashboard.jsx"
click node_managerui "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/frontend/src/pages/ManagerDashboard.jsx"
click node_adminui "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/frontend/src/pages/AdminDashboard.jsx"
click node_auditui "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/frontend/src/pages/AuditView.jsx"
click node_api "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/app.js"
click node_auth "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/middleware/auth.js"
click node_requests "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/controllers/requestController.js"
click node_approvals "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/controllers/managerController.js"
click node_serveradmin "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/controllers/serverController.js"
click node_gatewayauth "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/controllers/gatewayController.js"
click node_records "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/models/index.js"
click node_bastion "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/gateway/app/ssh_server.py"
click node_policy "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/gateway/app/policy.py"
click node_sessionstate "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/gateway/app/session_manager.py"
click node_recorder "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/gateway/app/recorder.py"
click node_revocation "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/gateway/app/revocation.py"
click node_monitor "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/monitoring/src/app.js"
click node_metrics "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/monitoring/src/metrics.js"
click node_alerts "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/monitoring/src/alerts.js"
click node_monitorstore "https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/monitoring/src/db.js"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_webapp,node_employeeui,node_managerui,node_adminui,node_auditui toneBlue
class node_api,node_auth,node_requests,node_approvals,node_serveradmin,node_gatewayauth,node_records,node_postgres,node_redis toneAmber
class node_bastion,node_policy,node_sessionstate,node_recorder,node_revocation,node_target toneMint
class node_monitor,node_metrics,node_alerts,node_monitorstore toneRose
class node_engineer,node_manager,node_admin,node_terminal toneIndigo
```

## Components

### Web portals

- [Role dashboards](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`
- [JIT request and grants](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/frontend/src/pages/EmployeeDashboard.jsx): `frontend/src/pages/EmployeeDashboard.jsx`
- [Approvals and sessions](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/frontend/src/pages/ManagerDashboard.jsx): `frontend/src/pages/ManagerDashboard.jsx`
- [Server and user admin](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/frontend/src/pages/AdminDashboard.jsx): `frontend/src/pages/AdminDashboard.jsx`
- [Audit review and replay](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/frontend/src/pages/AuditView.jsx): `frontend/src/pages/AuditView.jsx`

### Access management API

- [REST API](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/app.js): `backend/src/app.js`
- [Identity and role checks](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/middleware/auth.js): `backend/src/middleware/auth.js`
- [Request lifecycle](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/controllers/requestController.js): `backend/src/controllers/requestController.js`
- [Grant and revocation](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/controllers/managerController.js): `backend/src/controllers/managerController.js`
- [Server administration](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/controllers/serverController.js): `backend/src/controllers/serverController.js`
- [Gateway access check](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/controllers/gatewayController.js): `backend/src/controllers/gatewayController.js`
- [Access and audit records](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/backend/src/models/index.js): `backend/src/models/index.js`

### SSH gateway

- [SSH bastion](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/gateway/app/ssh_server.py): `gateway/app/ssh_server.py`
- [Access policy](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/gateway/app/policy.py): `gateway/app/policy.py`
- [Live session manager](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/gateway/app/session_manager.py): `gateway/app/session_manager.py`
- [Session recording](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/gateway/app/recorder.py): `gateway/app/recorder.py`
- [Revocation listener](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/gateway/app/revocation.py): `gateway/app/revocation.py`

### Audit and monitoring

- [Event ingestion and queries](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/monitoring/src/app.js): `monitoring/src/app.js`
- [Prometheus metrics](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/monitoring/src/metrics.js): `monitoring/src/metrics.js`
- [Alert rules](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/monitoring/src/alerts.js): `monitoring/src/alerts.js`
- [Monitoring event store](https://github.com/ankit-goyal-git/secure-infrastructure-access-management-and-session-monitoring-system/blob/main/monitoring/src/db.js): `monitoring/src/db.js`

### Other components

- **Engineer**
- **Security manager**
- **Administrator**
- **SSH terminal**
- **Managed server**
- **PostgreSQL**
- **Redis cache and pubsub**

## Connections

- Engineer → Role dashboards: uses portal (evidence: `README.md`)
- Security manager → Role dashboards: uses portal (evidence: `README.md`)
- Administrator → Role dashboards: uses portal (evidence: `README.md`)
- Role dashboards → JIT request and grants: routes to (evidence: `frontend/src/App.jsx`)
- Role dashboards → Approvals and sessions: routes to (evidence: `frontend/src/App.jsx`)
- Role dashboards → Server and user admin: routes to (evidence: `frontend/src/App.jsx`)
- Role dashboards → Audit review and replay: routes to (evidence: `frontend/src/App.jsx`)
- JIT request and grants → REST API: requests access
- Approvals and sessions → REST API: reviews access
- Server and user admin → REST API: manages servers
- Audit review and replay → REST API: queries audit
- REST API → Identity and role checks: mounts routes (evidence: `backend/src/app.js`)
- REST API → Request lifecycle: routes requests (evidence: `backend/src/app.js`)
- REST API → Grant and revocation: routes manager actions
- REST API → Server administration: routes server actions
- REST API → Gateway access check: routes internal checks
- Grant and revocation → Access and audit records: reads and writes (evidence: `backend/src/controllers/managerController.js`)
- Grant and revocation → Redis cache and pubsub: caches grants and publishes revocations (evidence: `backend/src/controllers/managerController.js`)
- Access and audit records → PostgreSQL: persists records
- SSH terminal → SSH bastion: connects over SSH (evidence: `README.md`)
- SSH bastion → Gateway access check: checks authorization
- SSH bastion → Access policy: enforces policy (evidence: `gateway/app/ssh_server.py`)
- SSH bastion → Live session manager: tracks sessions (evidence: `gateway/app/ssh_server.py`)
- SSH bastion → Session recording: records session (evidence: `gateway/app/ssh_server.py`)
- SSH bastion → Managed server: opens SSH tunnel (evidence: `README.md`)
- Redis cache and pubsub → Revocation listener: delivers revocations (evidence: `README.md`)
- Revocation listener → Live session manager: severs session
- SSH bastion → Event ingestion and queries: submits events (evidence: `monitoring/src/app.js`)
- REST API → Event ingestion and queries: submits events (evidence: `monitoring/src/app.js`)
- Event ingestion and queries → Monitoring event store: persists and queries (evidence: `monitoring/src/app.js`)
- Event ingestion and queries → Prometheus metrics: updates metrics (evidence: `monitoring/src/app.js`)
- Event ingestion and queries → Alert rules: evaluates rules (evidence: `monitoring/src/app.js`)
- Alert rules → Event ingestion and queries: re-ingests alerts (evidence: `monitoring/src/app.js`)
- Event ingestion and queries → Audit review and replay: serves audit data