# fandyajpo/sap_core architecture

> Architecture diagram of the GitHub repository fandyajpo/sap_core, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-09). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/fandyajpo/sap_core
- Repository: https://github.com/fandyajpo/sap_core

## Overview

SAP Core is a tenant workspace with account registration and sign-in, organization membership and resource endpoints, and scoped role administration. Users authenticate before interacting with organization, company, and plant data; tenant services validate scope and membership, load grants, and evaluate permissions before protected operations. Role management covers custom role definitions and revisions as well as assignments. The README is only a title, so capability details and links below rely on the source index and sampled files; unsampled implementation details are not assumed.

Main entry points: [`src/lib/tenant-authorization.ts`](https://github.com/fandyajpo/sap_core/blob/main/src/lib/tenant-authorization.ts) (Tenant permission gate), [`src/lib/prisma.ts`](https://github.com/fandyajpo/sap_core/blob/main/src/lib/prisma.ts) (Database client), [`src/lib/tenant-target-context-core.ts`](https://github.com/fandyajpo/sap_core/blob/main/src/lib/tenant-target-context-core.ts) (Tenant target context), [`src/lib/tenant-role-definition-service.ts`](https://github.com/fandyajpo/sap_core/blob/main/src/lib/tenant-role-definition-service.ts) (Tenant role services)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_identity["Identity and workspace"]
  node_authui["Sign-in and registration<br/>[auth-form.tsx]"]
  node_workspace["Workspace pages<br/>[page.tsx]"]
  node_session["Session access<br/>[auth-session.ts]"]
  node_authserver["Authentication service<br/>[auth.ts]"]
  node_authapi["Authentication API<br/>[route.ts]"]
end

subgraph group_tenant["Tenant operations"]
  node_membershipapi["Organization members API<br/>[route.ts]"]
  node_companyapi["Company resource API<br/>[route.ts]"]
  node_plantapi["Plant resource API<br/>[route.ts]"]
end

subgraph group_authorization["Tenant authorization"]
  node_target["Tenant target context"]
  node_tenantauth["Tenant permission gate"]
  node_grantloader["Authorization grant loader"]
  node_policy["Authorization policy"]
end

subgraph group_roles["Role management"]
  node_rolesapi["Organization roles API<br/>[route.ts]"]
  node_revisionsapi["Role revisions API<br/>[route.ts]"]
  node_assignmentsapi["Role assignments API<br/>[route.ts]"]
  node_tenantroles["Tenant role services"]
  node_roledefs["Role definition service"]
  node_roleassign["Role assignment service"]
end

subgraph group_data["Persistence"]
  node_scopedaccess["Scoped access service"]
  node_prisma[("Database client<br/>[prisma.ts]")]
end

node_user(("Workspace user"))

node_user -->|"submits credentials"| node_authui
node_authui -->|"authenticates via client"| node_authserver
node_user -->|"opens workspace"| node_workspace
node_workspace -->|"reads session"| node_session
node_authapi -->|"routes auth requests"| node_authserver
node_session -->|"gets session"| node_authserver
node_authserver -->|"uses database"| node_prisma
node_membershipapi -->|"checks tenant access"| node_tenantauth
node_membershipapi -->|"resolves tenant scope"| node_target
node_membershipapi -->|"reads memberships"| node_prisma
node_companyapi -->|"checks tenant access"| node_tenantauth
node_companyapi -->|"resolves tenant scope"| node_target
node_companyapi -->|"reads company resource"| node_prisma
node_plantapi -->|"checks tenant access"| node_tenantauth
node_plantapi -->|"resolves tenant scope"| node_target
node_plantapi -->|"reads plant resource"| node_prisma
node_tenantauth -->|"validates target"| node_target
node_tenantauth -->|"loads grants"| node_grantloader
node_tenantauth -->|"evaluates permission"| node_policy
node_grantloader -->|"reads role grants"| node_prisma
node_rolesapi -->|"handles role requests"| node_tenantroles
node_rolesapi -->|"checks role access"| node_tenantauth
node_tenantroles -->|"delegates role changes"| node_roledefs
node_tenantroles -->|"creates scoped database"| node_scopedaccess
node_revisionsapi -->|"handles role revisions"| node_tenantroles
node_revisionsapi -->|"uses role definitions"| node_roledefs
node_assignmentsapi -->|"handles assignments"| node_roleassign
node_assignmentsapi -->|"resolves tenant scope"| node_target
node_roleassign -->|"uses scoped database"| node_scopedaccess
node_roledefs -->|"uses scoped database"| node_scopedaccess
node_scopedaccess -->|"queries database"| node_prisma

click node_authui "https://github.com/fandyajpo/sap_core/blob/main/src/components/auth-form.tsx"
click node_workspace "https://github.com/fandyajpo/sap_core/blob/main/src/app/page.tsx"
click node_session "https://github.com/fandyajpo/sap_core/blob/main/src/lib/auth-session.ts"
click node_authserver "https://github.com/fandyajpo/sap_core/blob/main/src/lib/auth.ts"
click node_authapi "https://github.com/fandyajpo/sap_core/blob/main/src/app/api/auth/%5B...all%5D/route.ts"
click node_membershipapi "https://github.com/fandyajpo/sap_core/blob/main/src/app/api/organizations/%5BorganizationId%5D/members/route.ts"
click node_companyapi "https://github.com/fandyajpo/sap_core/blob/main/src/app/api/organizations/%5BorganizationId%5D/companies/%5BcompanyId%5D/route.ts"
click node_plantapi "https://github.com/fandyajpo/sap_core/blob/main/src/app/api/organizations/%5BorganizationId%5D/companies/%5BcompanyId%5D/plants/%5BplantId%5D/route.ts"
click node_target "https://github.com/fandyajpo/sap_core/blob/main/src/lib/tenant-target-context-core.ts"
click node_tenantauth "https://github.com/fandyajpo/sap_core/blob/main/src/lib/tenant-authorization.ts"
click node_grantloader "https://github.com/fandyajpo/sap_core/blob/main/src/lib/authorization-grant-loader.ts"
click node_policy "https://github.com/fandyajpo/sap_core/blob/main/src/lib/authorization-policy-core.ts"
click node_rolesapi "https://github.com/fandyajpo/sap_core/blob/main/src/app/api/organizations/%5BorganizationId%5D/roles/route.ts"
click node_revisionsapi "https://github.com/fandyajpo/sap_core/blob/main/src/app/api/organizations/%5BorganizationId%5D/roles/%5BroleDefinitionId%5D/revisions/route.ts"
click node_assignmentsapi "https://github.com/fandyajpo/sap_core/blob/main/src/app/api/organizations/%5BorganizationId%5D/roles/assignments/route.ts"
click node_tenantroles "https://github.com/fandyajpo/sap_core/blob/main/src/lib/tenant-role-definition-service.ts"
click node_roledefs "https://github.com/fandyajpo/sap_core/blob/main/src/lib/role-definition-service.ts"
click node_roleassign "https://github.com/fandyajpo/sap_core/blob/main/src/lib/role-assignment-service.ts"
click node_scopedaccess "https://github.com/fandyajpo/sap_core/blob/main/src/lib/scoped-access-service.ts"
click node_prisma "https://github.com/fandyajpo/sap_core/blob/main/src/lib/prisma.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_authui,node_workspace,node_session,node_authserver,node_authapi,node_user toneBlue
class node_membershipapi,node_companyapi,node_plantapi toneAmber
class node_target,node_tenantauth,node_grantloader,node_policy toneMint
class node_rolesapi,node_revisionsapi,node_assignmentsapi,node_tenantroles,node_roledefs,node_roleassign toneRose
class node_scopedaccess,node_prisma toneIndigo
```

## Components

### Identity and workspace

- [Sign-in and registration](https://github.com/fandyajpo/sap_core/blob/main/src/components/auth-form.tsx): `src/components/auth-form.tsx`
- [Workspace pages](https://github.com/fandyajpo/sap_core/blob/main/src/app/page.tsx): `src/app/page.tsx`
- [Session access](https://github.com/fandyajpo/sap_core/blob/main/src/lib/auth-session.ts): `src/lib/auth-session.ts`
- [Authentication service](https://github.com/fandyajpo/sap_core/blob/main/src/lib/auth.ts): `src/lib/auth.ts`
- [Authentication API](https://github.com/fandyajpo/sap_core/blob/main/src/app/api/auth/%5B...all%5D/route.ts): `src/app/api/auth/[...all]/route.ts`

### Tenant operations

- [Organization members API](https://github.com/fandyajpo/sap_core/blob/main/src/app/api/organizations/%5BorganizationId%5D/members/route.ts): `src/app/api/organizations/[organizationId]/members/route.ts`
- [Company resource API](https://github.com/fandyajpo/sap_core/blob/main/src/app/api/organizations/%5BorganizationId%5D/companies/%5BcompanyId%5D/route.ts): `src/app/api/organizations/[organizationId]/companies/[companyId]/route.ts`
- [Plant resource API](https://github.com/fandyajpo/sap_core/blob/main/src/app/api/organizations/%5BorganizationId%5D/companies/%5BcompanyId%5D/plants/%5BplantId%5D/route.ts): `src/app/api/organizations/[organizationId]/companies/[companyId]/plants/[plantId]/route.ts`

### Tenant authorization

- [Tenant target context](https://github.com/fandyajpo/sap_core/blob/main/src/lib/tenant-target-context-core.ts): `src/lib/tenant-target-context-core.ts`
- [Tenant permission gate](https://github.com/fandyajpo/sap_core/blob/main/src/lib/tenant-authorization.ts): `src/lib/tenant-authorization.ts`
- [Authorization grant loader](https://github.com/fandyajpo/sap_core/blob/main/src/lib/authorization-grant-loader.ts): `src/lib/authorization-grant-loader.ts`
- [Authorization policy](https://github.com/fandyajpo/sap_core/blob/main/src/lib/authorization-policy-core.ts): `src/lib/authorization-policy-core.ts`

### Role management

- [Organization roles API](https://github.com/fandyajpo/sap_core/blob/main/src/app/api/organizations/%5BorganizationId%5D/roles/route.ts): `src/app/api/organizations/[organizationId]/roles/route.ts`
- [Role revisions API](https://github.com/fandyajpo/sap_core/blob/main/src/app/api/organizations/%5BorganizationId%5D/roles/%5BroleDefinitionId%5D/revisions/route.ts): `src/app/api/organizations/[organizationId]/roles/[roleDefinitionId]/revisions/route.ts`
- [Role assignments API](https://github.com/fandyajpo/sap_core/blob/main/src/app/api/organizations/%5BorganizationId%5D/roles/assignments/route.ts): `src/app/api/organizations/[organizationId]/roles/assignments/route.ts`
- [Tenant role services](https://github.com/fandyajpo/sap_core/blob/main/src/lib/tenant-role-definition-service.ts): `src/lib/tenant-role-definition-service.ts`
- [Role definition service](https://github.com/fandyajpo/sap_core/blob/main/src/lib/role-definition-service.ts): `src/lib/role-definition-service.ts`
- [Role assignment service](https://github.com/fandyajpo/sap_core/blob/main/src/lib/role-assignment-service.ts): `src/lib/role-assignment-service.ts`

### Persistence

- [Scoped access service](https://github.com/fandyajpo/sap_core/blob/main/src/lib/scoped-access-service.ts): `src/lib/scoped-access-service.ts`
- [Database client](https://github.com/fandyajpo/sap_core/blob/main/src/lib/prisma.ts): `src/lib/prisma.ts`

### Other components

- **Workspace user**

## Connections

- Workspace user → Sign-in and registration: submits credentials (evidence: `src/components/auth-form.tsx`)
- Sign-in and registration → Authentication service: authenticates via client (evidence: `src/components/auth-form.tsx`)
- Workspace user → Workspace pages: opens workspace (evidence: `src/app/page.tsx`)
- Workspace pages → Session access: reads session (evidence: `src/app/page.tsx`)
- Authentication API → Authentication service: routes auth requests (evidence: `src/app/api/auth/[...all]/route.ts`)
- Session access → Authentication service: gets session (evidence: `src/lib/auth-session.ts`)
- Authentication service → Database client: uses database (evidence: `src/lib/auth.ts`)
- Organization members API → Tenant permission gate: checks tenant access (evidence: `src/app/api/organizations/[organizationId]/members/route.ts`)
- Organization members API → Tenant target context: resolves tenant scope (evidence: `src/app/api/organizations/[organizationId]/members/route.ts`)
- Organization members API → Database client: reads memberships
- Company resource API → Tenant permission gate: checks tenant access (evidence: `src/app/api/organizations/[organizationId]/companies/[companyId]/route.ts`)
- Company resource API → Tenant target context: resolves tenant scope (evidence: `src/app/api/organizations/[organizationId]/companies/[companyId]/route.ts`)
- Company resource API → Database client: reads company resource
- Plant resource API → Tenant permission gate: checks tenant access (evidence: `src/app/api/organizations/[organizationId]/companies/[companyId]/plants/[plantId]/route.ts`)
- Plant resource API → Tenant target context: resolves tenant scope (evidence: `src/app/api/organizations/[organizationId]/companies/[companyId]/plants/[plantId]/route.ts`)
- Plant resource API → Database client: reads plant resource
- Tenant permission gate → Tenant target context: validates target (evidence: `src/lib/tenant-authorization.ts`)
- Tenant permission gate → Authorization grant loader: loads grants (evidence: `src/lib/tenant-authorization.ts`)
- Tenant permission gate → Authorization policy: evaluates permission (evidence: `src/lib/tenant-authorization.ts`)
- Authorization grant loader → Database client: reads role grants (evidence: `src/lib/authorization-grant-loader.ts`)
- Organization roles API → Tenant role services: handles role requests (evidence: `src/app/api/organizations/[organizationId]/roles/route.ts`)
- Organization roles API → Tenant permission gate: checks role access (evidence: `src/app/api/organizations/[organizationId]/roles/route.ts`)
- Tenant role services → Role definition service: delegates role changes (evidence: `src/lib/tenant-role-definition-service.ts`)
- Tenant role services → Scoped access service: creates scoped database (evidence: `src/lib/tenant-role-definition-service.ts`)
- Role revisions API → Tenant role services: handles role revisions (evidence: `src/app/api/organizations/[organizationId]/roles/[roleDefinitionId]/revisions/route.ts`)
- Role revisions API → Role definition service: uses role definitions (evidence: `src/app/api/organizations/[organizationId]/roles/[roleDefinitionId]/revisions/route.ts`)
- Role assignments API → Role assignment service: handles assignments (evidence: `src/app/api/organizations/[organizationId]/roles/assignments/route.ts`)
- Role assignments API → Tenant target context: resolves tenant scope (evidence: `src/app/api/organizations/[organizationId]/roles/assignments/route.ts`)
- Role assignment service → Scoped access service: uses scoped database (evidence: `src/lib/role-assignment-service.ts`)
- Role definition service → Scoped access service: uses scoped database (evidence: `src/lib/role-definition-service.ts`)
- Scoped access service → Database client: queries database (evidence: `src/lib/scoped-access.ts`)