RBAD

A Next.js dashboard against a Django REST backend split into three apps: accounts, uploads and audit. Permissions are checked on the server and every mutation is written to the audit app.

Stack

• Django 4.2 backend
• DRF 3.14 backend
• Simple JWT backend
• drf-yasg backend
• pandas backend
• OpenPyXL backend
• PostgreSQL (psycopg2) data
• Gunicorn infra
• WhiteNoise infra
• Next.js client
• Axios client

Architecture

A conventional client and API split, with ingestion and auditing as their own apps rather than helpers.

• Next.js dashboard client
  • Axios
  • date-fns
  • js-cookie
  • Lucide
• Django REST API service
  • DRF
  • Simple JWT
  • drf-yasg
• Accounts service Roles and per-capability permissions
• Uploads service Row-by-row validation with per-row error reporting
  • pandas
  • OpenPyXL
  • NumPy
• Audit service Before and after values, attributed to a user
• PostgreSQL datastore

Flow

• Next.js dashboard → Django REST API HTTPS, bearer token
• Django REST API → Accounts
• Django REST API → Uploads CSV / Excel
• Django REST API → Audit Every mutation
• Accounts → PostgreSQL
• Uploads → PostgreSQL
• Audit → PostgreSQL

API

REST

• Interactive schema documentation generated by drf-yasg
• Cross-origin access handled by django-cors-headers

Data

PostgreSQL

• Accessed through psycopg2, with the URL supplied by dj-database-url

Authentication

JSON Web Tokens with role-based access control

• Admin
• Manager
• Viewer

• Simple JWT, with automatic refresh on the client
• Granular per-capability permissions rather than role checks at the view
• The public demo account is a Manager: upload, edit, export and audit are allowed; managing users and deleting data are denied

Integrations

• pandas Parsing and validating uploaded spreadsheets
• OpenPyXL Reading Excel workbooks

Technical capabilities

• CSV and Excel upload with drag and drop
• Row-by-row validation with detailed error reporting
• Upload history with a success rate per run
• Complete audit timeline with change attribution
• Bulk user activation and deactivation

Infrastructure

• Vercel (dashboard)

• Procfile process types, with migrate and collectstatic in the release phase
• Backend pinned to Python 3.11.10

Notable decisions

• Permissions expressed per capability rather than per role

  A role becomes a set of capabilities, so a new role needs no new checks

• Record both the before and after value on every change

  An audit trail without the prior value cannot answer what actually changed

• Auditing as its own app rather than a mixin

  Keeps the trail independent of the models being written to