Ontology Manager

A comprehensive Graph Security & Ontology Management platform designed to define, secure, and manage data hierarchies with fine-grained access control (ABAC/ReBAC).

🚀 Overview

Ontology Manager provides a visual interface and powerful backend engine for modeling complex data domains alongside robust security policies. It unifies:

• Ontology Design: defining classes, properties, and relationships.
• Identity & Access Management (IAM): Managing users, roles (ABAC), and relationship-based policies (ReBAC).
• Security Impact Analysis: Simulating policy changes and visualizing access graphs.

🏗 Architecture

The project is built as a modern full-stack application:

• Frontend:
  • Framework: React 18 (Vite)
  • Routing: TanStack Router (File-based routing)
  • Styling: TailwindCSS & Shadcn UI
  • State/Query: TanStack Query
• Backend:
  • Language: Rust
  • Framework: Axum (High-performance async web framework)
  • Database: PostgreSQL (via SQLx)
  • Authentication: JWT-based stateless auth

✨ Key Features

1. Ontology Engine

• Class Management: Create and version ontology classes (e.g., Patient, Doctor, Appointment).
• Relationship Types: Define directed edges between classes (e.g., Treats, Owns, ReportsTo).
• Graph Explorer: Visual node-link diagrams to explore the data model.

2. Advanced Access Control

• ABAC (Attribute-Based Access Control): Define roles with granular permissions (e.g., READ_SENSITIVE on PatientRecords).
• ReBAC (Relationship-Based Access Control): Define policies like "Users can access documents owned by their Department".
• Impact Analysis: Simulate "What happens if I give Role X to User Y?" before applying changes.

3. User & Role Management

• Role Designer: specialized UI for constructing role definitions.
• User Management: Lifecycle management for system users.
• Security Dashboard: Real-time metrics on policy denials, active sessions, and ontology growth.

🛠 Getting Started

Prerequisites

• Docker (for PostgreSQL)
• Node.js 20+
• Rust (Stable)

Installation

1. Database: Start the PostgreSQL container.

   docker-compose up -d db

2. Backend:

   cd backend
   cargo run

   The server will start on http://localhost:5300. It will automatically run migrations and seed initial system data.

3. Frontend:

   cd frontend
   npm install
   npm run dev

   Access the UI at http://localhost:5373.

📦 Project Structure

├── backend/            # Rust Axum API
│   ├── src/features/   # Domain modules (abac, rebac, ontology, users)
│   ├── migrations/     # SQLx database migrations
│   └── config/         # App configuration
├── frontend/           # React Application
│   ├── src/routes/     # Page routes (Tanstack Router)
│   ├── src/features/   # Frontend feature modules
│   └── src/components/ # Shared UI components
├── database/           # Docker database context
└── docker-compose.yml  # Service orchestration

🔒 Security

Status: Security Sprint Phase 1 Complete (70% risk reduction achieved)

• Safe Defaults: All endpoints require authentication unless explicitly public.
• CSRF Protection: Double-submit cookie pattern implemented.
• Input Validation: Strictly typed schemas using Serde (Backend) and Zod (Frontend).
• JWT Security: RS256 with 90-day key rotation, refresh token rotation.
• MFA Support: TOTP-based two-factor authentication with backup codes.
• Password Reset: Secure flow with single-use tokens and session revocation.

Security Status:

• ✅ Phase 1: Critical fixes complete (CVE-001, CVE-002, CVE-005)
• 🟡 Phase 2: High-priority fixes in progress (rate limiting, user enumeration)
• ⏳ Phases 3-5: Detection & monitoring (planned)

See STATUS.md for security roadmap and docs/SECURITY_AUDIT.md for complete vulnerability analysis.

🧪 Testing

Test Coverage

Category	Tests	Coverage	Status
Backend Security	19	100%	✅
Backend Auth	33	86%	✅
Backend Password Reset	11	100%	✅
Backend MFA	9	100%	✅
Backend Projects	18	100%	✅
ReBAC Service	15	85%	⏳
ABAC Service	10	90%	⏳
Monitoring System	61	90%	✅
Frontend Unit	18	90%	✅
E2E Tests	10	Ready	✅
TOTAL	204	~90%	✅

Backend Tests

Run all backend tests:

cd backend
export DATABASE_URL=postgres://app:app_password@localhost:5301/app_db
cargo test

End-to-End Tests (Playwright)

E2E tests cover auth flows, ontology roles, and monitoring.

Prerequisites: Backend running on http://localhost:5300, Frontend on http://localhost:5373.

cd frontend
npm run test:e2e

Test Coverage:

• e2e-auth.spec.ts: Register and login flows
• e2e-password-reset.spec.ts: Password reset flow
• e2e-mfa.spec.ts: MFA authentication
• e2e-ontology-roles.spec.ts: ABAC/ReBAC role verification
• e2e-monitoring.spec.ts: Monitoring dashboard

See STATUS.md for detailed test status and coverage analysis.

🤝 Contributing

1. Fork the repository
2. Create your feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add some amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

📚 Documentation

Core Documentation

• STATUS.md: Current project status, roadmap, and metrics
• BACKLOG.md: Detailed task backlog and progress tracking
• CHANGELOG.md: Version history and release notes
• AGENTS.md: Development guidelines, coding standards, and commands

Feature Documentation

• docs/FEATURES_AUTH.md: Authentication & security features (JWT, MFA, password reset)
• docs/FEATURES_AUTHORIZATION.md: ABAC & ReBAC access control
• docs/FEATURES_ONTOLOGY.md: Ontology engine and management
• docs/FEATURES_MONITORING.md: Monitoring, analytics, and alerting

Security Documentation

• docs/SECURITY_AUDIT.md: Complete security audit (12 CVEs identified)
• docs/SECURITY_TASKS.md: 110 security implementation tasks (5 phases)
• docs/SECURITY_QUICKSTART.md: Quick security fixes guide

Product Documentation

• docs/PRD.md: Product requirements document

Documentation Index

Document	Purpose	Last Updated
STATUS.md	Project status & roadmap	2026-01-18
BACKLOG.md	Task tracking	2026-01-18
docs/FEATURES_AUTH.md	Authentication & security	2026-01-18
docs/FEATURES_AUTHORIZATION.md	ABAC/ReBAC	2026-01-18
docs/FEATURES_ONTOLOGY.md	Ontology engine	2026-01-18
docs/FEATURES_MONITORING.md	Monitoring system	2026-01-18
docs/SECURITY_AUDIT.md	Security vulnerability analysis	2026-01-18
docs/SECURITY_TASKS.md	Security implementation plan	2026-01-18

📊 Project Status

Current Version: 1.0.1
Production Readiness: 95% (Security Phase 2-5 pending)
Test Coverage: 90% (204 tests)
Risk Level: 🟡 LOW (70% reduction achieved)

Key Achievements (2026-01-18):

• ✅ Technical MVP complete (42+ backend tests)
• ✅ Password Reset & MFA integration (81 tests)
• ✅ Security audit complete (12 CVEs, 37 security tests)
• ✅ Monitoring system complete (10,619 lines, 24 endpoints)
• ✅ Test coverage: 30 → 204 tests (+580%)

Next Priority: Security Sprint Phase 2 (rate limiting, user enumeration, immutable backups)

See STATUS.md for complete roadmap and metrics.