An open-source, production-grade Full-Stack OpenSaaS Monorepo combining a Go Workspace Modular Monolith Backend Core with a Next.js 16+ TypeScript Frontend (apps/web). The system delivers sub-millisecond policy-cached API responses, strict workspace-as-tenant isolation, type-safe OpenAPI TypeScript SDK generation, dual RBAC/PBAC access control, mandatory feature flagging, and formal API Version Management (/v1, /v2).
| Metric | Target SLA | Engine Implementation |
|---|---|---|
| PBAC Policy Evaluation | < 1 ms |
Redis sub-millisecond policy cache (POLICY_CACHE_TTL=5m) |
| API Throughput | 10,000+ req/sec |
Non-blocking Go HTTP multiplexing & connection pooling |
| Tenant Isolation Overhead | 0 ms |
Context-injected workspace_id validation |
| Database Migration Safety | Zero Downtime |
Idempotent golang-migrate schema scripts |
┌─────────────────────────────────────────────────────────┐
│ cmd/server/main.go │
│ (Composition Root / Entry) │
├─────────────────────────────────────────────────────────┤
│ internal/app/ │
│ (Module Orchestrator / Dependency Wiring) │
├───────────────────────┬─────────────────────────────────┤
│ auth/ │ workspace/ │
│ module │ module │
├───────────────────────┴─────────────────────────────────┤
│ shared/ (Shared Kernel) │
│ events │ errors │ context │ uow │ validation │ i18n │
├─────────────────────────────────────────────────────────┤
│ PostgreSQL │ Redis │ S3/Local │
└─────────────────────────────────────────────────────────┘
- Modular Monolith with Go Workspaces: Bounded contexts are separated into independent Go modules (
auth,workspace,platform,common). Compiler-enforced boundaries (internal/packages) prevent unapproved cross-module coupling. - Workspace-as-Tenant Multi-Tenancy: Workspace is the fundamental tenant isolation unit. Every API request context and SQL query MUST filter by
workspace_id. - Hexagonal Architecture (Ports & Adapters): Domain logic remains pure, zero-dependency Go code isolated from HTTP, SQL, or external drivers.
- API Version Management (
/v1,/v2): Strict URL versioning paired with RFC 8594 Sunset/Deprecation headers and OpenAPI 3.0 spec synchronization. - Autonomous Agentic Integration: Built-in rules and custom skills (
.agents/skills/) enabling autonomous AI pair programming.
- Go:
1.26+ - Docker & Docker Compose: For PostgreSQL 16, Redis 7, and local development infrastructure.
- golang-migrate: For database schema migrations.
# 1. Clone repository & configure environment
git clone git@github.com:open-saas/platform.git
cd platform
cp .env.example .env
# 2. Synchronize Go Workspace modules
go work sync
# 3. Spin up local infrastructure (PostgreSQL, Redis, MailHog)
docker-compose up -d
# 4. Run database migrations
migrate -path docs/database/migrations -database "postgres://platform:platform_dev@localhost:5432/platform?sslmode=disable" up
# 5. Run test suite across all workspace modules
go test -v ./...| Specification | Document | Description |
|---|---|---|
| Frontend Architecture | docs/frontend-architecture.md | Next.js 16+ App Router, TypeScript strict mode, TanStack Query, Zustand, and Glassmorphism design. |
| System Architecture | ARCHITECTURE.md / docs/architecture.md | High-level overview and comprehensive 4,000+ line specification. |
| API Documentation | API_DOCUMENTATION.md / docs/api/openapi.yaml | API integration reference, JWT auth, tenant headers, and OpenAPI 3.0 spec. |
| Database Blueprint | docs/database/erd.md | Entity-Relationship Diagrams, table definitions, foreign keys, and indexes. |
| Deployment Guide | DEPLOYMENT_GUIDE.md | Production & staging manual (Docker, Kubernetes, Helm, Vercel, Terraform). |
| Security Policy | SECURITY.md | Vulnerability disclosure policy, response SLAs, and security contacts. |
| Contributing Guide | CONTRIBUTING.md | Contributor workflow, Developer Certificate of Origin (DCO), and PR checklist. |
| Code of Conduct | CODE_OF_CONDUCT.md | Contributor Covenant 2.1 team standards. |
| OpenSaaS License | LICENSE.md | Apache 2.0 Community Core + Commercial Enterprise Framework. |
| Product Roadmap | ROADMAP.md | Phase 1, Phase 2, and Phase 3 platform engineering roadmap. |
| Version Changelog | CHANGELOG.md | Release history following Keep a Changelog. |
| Feature Flags Spec | docs/feature-flags.md / docs/adr/004-feature-flags.md | Mandatory feature flag standards, naming conventions, canary rollouts, and Redis caching. |
| Troubleshooting | TROUBLESHOOTING.md | Solutions for Postgres migrations, Redis, and Go workspace errors. |
| System FAQ | FAQ.md | Frequently asked questions on multi-tenancy, RBAC/PBAC, and modules. |
| Topic | Document | Description |
|---|---|---|
| AI Agent Guidelines | AGENTS.md | Non-negotiable rules, verification steps, and safety guardrails for AI coding agents. |
| Agentic Manual | docs/agentic-development.md | Deep dive into prompt engineering, context windowing, and 5-Phase protocol. |
| ADR Index | docs/adr/ | Architectural Decision Records detailing technology and design choices. |
- nextjs-typescript-frontend: Next.js 16+ App Router, TypeScript strict typing, type-safe API SDK generation, and aesthetic UI standards.
- modular-monolith-go: Go Workspace module development, Hexagonal Ports & Adapters, and contract-only inter-module communication.
- workspace-tenant-security: Multi-tenant workspace isolation, high-speed Redis policy caching, RBAC/PBAC permission checks, and rate limiting.
- api-versioning-openapi: API Version Management (
/v1,/v2), OpenAPI spec synchronization, deprecation headers (Sunset), and backward compatibility. - feature-flag-management: Mandatory feature flag wrapping, key naming standards (
<module>:<subsystem>:<feature_name>), and fallback rules for all new features.
.
├── apps/
│ └── web/ # Next.js 16+ TypeScript App Router Frontend Application
│ ├── app/ # App router pages, layouts, Edge middleware
│ ├── components/ # UI primitives, workspace managers, auth forms
│ ├── lib/api/ # Auto-generated TypeScript API SDK from openapi.yaml
│ └── store/ # Zustand client state stores
│
├── auth/ # Identity, Authentication, JWT, MFA, Verification & Password Reset
├── workspace/ # Workspace Management, Membership, Invitations, Settings
├── platform/ # Feature Flags, System Settings, Audit Logging
└── common/ # Shared Kernel (Event Bus, Error Handling, Validation, Value Objects)
Dual-licensed under the Apache License 2.0 for Community Core and Commercial Enterprise Framework. See LICENSE.md for details.