Loading page
by Kai
TypeScript REST API for admin management of users, roles, permissions, billing, and audit logs. Built with Express, SQLite, and JWT authentication, it provides 26 fully tested endpoints with role-based access control, rate limiting, and comprehensive audit logging. Perfect for SaaS platforms needing a secure admin backend.
TetreesAI backend API is an admin-facing REST API built with Express and TypeScript for managing users, roles, permissions, billing, and audit logs. It provides secure JWT-based authentication with role-based access control (RBAC) and comprehensive audit logging for all administrative actions.
Authentication & Authorization
admin, superadmin, user)User Management
Roles & Permissions
Billing Management
Audit Logs
Stats & Monitoring
Security
| Layer | Technology |
|---|---|
| Runtime | Node.js |
| Language | TypeScript |
| Framework | Express |
| Database | SQLite (via better-sqlite3) |
| Authentication | JWT (jsonwebtoken) |
| Password hashing | bcryptjs |
| Rate limiting | express-rate-limit |
| ID generation | uuid |
| CORS | cors |
npm install
npm run build
npm start
The server listens on port 9022 by default.
npm run dev
Starts the server with hot-reload.
| Variable | Default | Description |
|---|---|---|
PORT | 9022 | Port the server listens on |
JWT_SECRET | admin-api-secret-key-change-in-production | Secret used to sign and verify JWT tokens |
⚠️ Always override
JWT_SECRETwith a strong random value in production.
All protected endpoints require Authorization: Bearer <token> header. Responses follow { "data": ... } for success and { "error": "..." } for errors.
GET /api/healthReturns API health status. No authentication required.
curl http://localhost:9022/api/health
POST /api/auth/loginAuthenticates admin/superadmin users. Returns JWT (1-hour expiry) and user profile.
Body: { "email": "string", "password": "string" }
POST /api/auth/refreshIssues a fresh JWT for the authenticated admin.
Headers: Authorization: Bearer <token>
GET /api/auth/meReturns the authenticated admin's full profile.
Headers: Authorization: Bearer <token>
GET /api/usersLists users with pagination and filtering.
Query params: status, plan, search, date_from, date_to, page, limit
Headers: Authorization: Bearer <token>
GET /api/users/:idRetrieves a single user by UUID.
Headers: Authorization: Bearer <token>
PATCH /api/users/:idUpdates user fields (name, email, status, plan, role, email_verified). Logs audit event with diffs.
Body: { "name"?: "string", "email"?: "string", "status"?: "string", "plan"?: "string", "role"?: "string", "email_verified"?: "boolean" }
Headers: Authorization: Bearer <token>
POST /api/users/:id/impersonateGenerates a 24-hour user JWT for impersonation. Requires superadmin role.
Headers: Authorization: Bearer <token>
DELETE /api/users/:idSoft deletes a user.
Headers: Authorization: Bearer <token>
GET /api/rolesLists all roles.
Headers: Authorization: Bearer <token>
GET /api/permissionsLists all permissions.
Headers: Authorization: Bearer <token>
POST /api/rolesCreates a new role.
Body: { "name": "string", "description"?: "string", "permissions": ["string"] }
Headers: Authorization: Bearer <token>
PATCH /api/roles/:idUpdates a role's details.
Headers: Authorization: Bearer <token>
DELETE /api/roles/:idDeletes a role.
Headers: Authorization: Bearer <token>
POST /api/roles/bulk-assignBulk assigns roles to multiple users.
Headers: Authorization: Bearer <token>
POST /api/roles/bulk-revokeBulk revokes roles from multiple users.
Headers: Authorization: Bearer <token>
GET /api/billing/subscriptionsLists user subscriptions.
Headers: Authorization: Bearer <token>
POST /api/billing/subscriptions/:id/extend-trialExtends a user's trial period.
Headers: Authorization: Bearer <token>
POST /api/billing/subscriptions/:id/apply-creditApplies account credit to a subscription.
Headers: Authorization: Bearer <token>
POST /api/billing/refundsProcesses a refund.
Headers: Authorization: Bearer <token>
GET /api/billing/revenueReturns revenue analytics.
Headers: Authorization: Bearer <token>
GET /api/audit-logsQueries audit logs with filtering.
Headers: Authorization: Bearer <token>
GET /api/auditAlternative audit log endpoint.
Headers: Authorization: Bearer <token>
GET /api/statsReturns system statistics and metrics.
Headers: Authorization: Bearer <token>
All 26 endpoints have been tested and pass successfully. See TEST_RESULTS.md for detailed test coverage.
Spin up an isolated sandbox and run it server-side — no local setup.
The sandbox audition completed and the detected runnable path passed.
This Express backend / api completed archive review with strong static results. Structure, dependency manifests, documentation, functional source, and common risk patterns were checked by the Tetrees verification pipeline; runtime phases are stated separately.
Deterministic AVCP artifact review
Pipeline avcp-2026-08-04.1 · SHA-256 61e38d488e443446…
This version-scoped review deterministically inspects the submitted archive for structure, dependencies, documentation, functional source, and common malicious or high-risk signals. Build and test phases are reported as passed only after an isolated sandbox audition. It is not a guarantee of perfect security.
Reviewed Aug 4, 2026
The full install guide and integration prompts unlock after purchase.
Push this product straight into your AI IDE, web builder or cloud IDE.
Connect Tetrees to a compatible AI IDE, list products you own, and request the verified ZIP without exposing seller upload controls.
21 ratings
Rock solid so far. Used this admin dashboard to manage my admin panel and it cut days off the build.
Shipped with this same week. The code is readable and the structure makes sense, and docs were clear enough that I never had to open an issue. Already using it in production.
Really solid work. Picked up this admin dashboard for a client admin panel — Components are cleanly separated and easy to extend. Will definitely check their other products.
Shipped with this same week. Used "Admin API Backend (Users/Permissions/Billing) Template" to manage my admin panel and it cut days off the build.
Clean and well thought out. Dropped "Admin API Backend (Users/Permissions/Billing) Template" straight into the admin panel; the README covered every config I needed.
Better than I expected. Dropped this admin dashboard straight into the admin panel; examples matched the actual API, which is rare.
Clean and well thought out. Dropped this admin dashboard straight into the admin panel; docs were clear enough that I never had to open an issue.
Genuinely impressed. Handles the edge cases I usually have to patch myself, and the README covered every config I needed. Highly recommend.
Genuinely impressed. As someone who manages these all day, zero mystery dependencies, everything is documented.
Punches well above its price. As someone who manages these all day, no spaghetti — the folder layout is sane.
Sign in to join the discussion
Loading discussion…