From Legacy CodeIgniter to a Secure React + NestJS Admin Panel

Building an admin panel is a common requirement for almost every serious web application.

Whether we are building an e-commerce platform, CRM, ERP, matrimonial website, or internal business system, we need a secure place to manage users, permissions, roles, login activity, and future business modules.

I recently rebuilt a legacy CodeIgniter user-management admin panel into a modern TypeScript application using React, NestJS, MySQL, and TypeORM.

The result is CIAS Admin Panel: a reusable foundation for future business applications.

GitHub Repository:
https://github.com/kishor10d/Admin-Panel-User-Management-using-React-NodeJS

Why rebuild the old project?

The original CodeIgniter project already included useful basic functionality:

• Login and logout

• User management

• Role management

• Permission control

• Password reset

• Login history

• AdminLTE-based interface

But modern applications need a stronger foundation.

Instead of continuing to extend a legacy PHP application, I decided to rebuild it with a modular architecture, modern frontend tooling, API-based authorization, database migrations, and stronger security controls.

The goal was not only to create another admin panel. The goal was to create a reusable boilerplate that can grow with real products.

Technology stack

The new project uses a pnpm monorepo structure.

Frontend:

• React 19

• TypeScript

• Vite

• AdminLTE 4

• TanStack Query

• Redux Toolkit

• React Hook Form

• Zod

• Axios

Backend:

• NestJS

• TypeScript

• MySQL

• TypeORM

• TypeORM migrations

• JWT-based cookie authentication

This structure keeps the frontend and API separate while allowing them to evolve together in one repository.

User management with account types

The application supports three user types:

• Regular User — access is based on assigned roles and permissions.

• System Administrator — has unrestricted system access.

• Service Account — reserved for future integrations, automated jobs, and API-based processes.

The System Administrator type is enforced at the API level. It is not based only on a role name in the database or a hidden frontend button.

This is important because frontend restrictions alone are never enough for access control.

Role-based access control

Role and permission management is one of the most important parts of an administration panel.

In this project, administrators can create roles with a simple name and description. Permissions are managed separately on a dedicated Role Details page.

The permission page displays a readable, module-wise matrix where an administrator can assign or remove actions such as view, create, update, and delete.

The frontend hides navigation links and action buttons when a user does not have permission. More importantly, the NestJS API checks permissions on every protected route.

That means the backend remains secure even if someone manually tries to call an API endpoint.

Better administration tables

User lists, role lists, and login-history lists include reusable table features:

• Debounced search

• Server-side pagination

• Numbered page navigation

• Page-size selection

• Column sorting

• Loading states

• Empty states

These may look like small features, but they are necessary when an application grows from a few records to thousands of users, roles, or audit events.

Authentication and password flows

The project includes complete authentication-related flows:

• Login

• Logout

• Profile updates

• Change password

• Forgot password

• Reset password

• SMTP-based password-reset email delivery

• Login-history records

Passwords follow a shared validation policy. A password must contain at least eight characters, including a letter, number, and special character.

Security improvements

Security was treated as part of the core foundation, not as a future add-on.

The current implementation includes:

• Password hashing with bcrypt

• HTTP-only authentication cookies

• Short-lived access tokens

• Rotated refresh-token sessions

• Hashed refresh tokens stored in the database

• CSRF protection for write operations

• Login and password-reset rate limiting

• Account locking after repeated failed login attempts

• Hashed, single-use password-reset tokens

• Session revocation after logout and password reset

• Server-side request validation

• API-level role and permission enforcement

This does not mean that every deployment is automatically production-ready. Production systems still need HTTPS, secure server configuration, monitoring, backups, logging, testing, and deployment procedures.

However, the project starts from a much safer base than a simple login-and-user-management boilerplate.

Useful for many business applications

This admin panel is designed to become the foundation for larger systems.

For an e-commerce platform, it can later support:

• Products

• Categories

• Inventory

• Orders

• Vendors

• Coupons

For a CRM, it can support:

• Leads

• Customers

• Follow-ups

• Sales pipelines

• Activities

• Reports

For an ERP, it can support:

• Employees

• Departments

• Payroll

• Accounts

• Purchase workflows

• Inventory

Every new module can reuse the same layout, permissions, API structure, validation approach, authentication system, and table components.

What comes next?

The next areas of work include:

• End-to-end browser testing

• API and React component tests

• Structured audit logging

• CI and code-quality checks

• Deployment documentation

• Monitoring and backup strategy

• More reusable UI components for future modules

The intention is to keep improving this project into a reliable foundation for real-world applications.

You can explore the repository here:

https://github.com/kishor10d/Admin-Panel-User-Management-using-React-NodeJS

If you are building a CRM, ERP, e-commerce system, or any application that needs a secure admin area, this project may provide a useful starting point.