• Flexible Authentication: Natively supports both legacy Active Directory / LDAP and modern Enterprise SSO (OpenID Connect via Google, Keycloak, Auth0) out-of-the-box using a simple AUTH_MODE toggle.
• Role-Based Access Control (RBAC): Users are systematically classified strictly as REQUESTER or APPROVER dynamically via whitelist environment constraints.
• Request Collections (Templates): High-density management of reusable request blueprints. Supports direct template creation, custom visibility (Global/Private), and full feature parity with the main dashboard (Auth, Params, Headers).
• Granular Payload Construction: Full GUI support for mapping URL search parameters, Header key-values (with dynamic Basic/Bearer Auth injection), and raw JSON bodies.
• Audit Transparency: Detailed audit trails for all request lifecycles. Rejections now capture rejectedBy and rejectedAt metadata for full accountability.
• Structured JSON Logs: A zero-dependency metadata flattening logger outputs strictly formatted non-nested JSON strings natively to stdout—perfect for Datadog, ELK, or Loki.
• Request Cloning: Easily clone and mutate existing/historical requests into new drafts natively from the dashboard.
• Execution Telemetry: Permanent attachment of raw response data and network latency (mapped via performance.now()) to executed tickets.

• Framework: Next.js 16 (App Router + React)
• Styling: Tailwind CSS
• Database: Prisma ORM with SQLite backend (Easily swappable to PostgreSQL/MySQL)
• Authentication: Dual-mode engine utilizing ldap-authentication for Active Directory and vanilla fetch() + jose for pure natively validated OAuth2 (OIDC) JSON Web Tokens.

1. Install Dependencies

   npm install

2. Configure Environment Copy .env.example to .env (or create a .env file natively) and populate your database architecture alongside your AD/LDAP variables:

   # Database Configuration
   DATABASE_URL="file:./dev.db"
   
   # Flexible Environment Toggles
   AUTH_MODE="LDAP"  # Choose strictly "LDAP" or "SSO"
   
   # LDAP / Authentication Configuration
   MOCK_LDAP="true"  # Set to false to bind to real LDAP instances
   LDAP_URL="ldap://your-server:389"
   LDAP_SEARCH_FILTER="(|(sAMAccountName=%s)(userPrincipalName=%s))"
   
   # OIDC Configuration (If AUTH_MODE="SSO")
   OAUTH_CLIENT_ID="your-client-id"
   OAUTH_CLIENT_SECRET="your-client-secret"
   OAUTH_AUTH_URL="https://accounts.google.com/o/oauth2/v2/auth"
   OAUTH_TOKEN_URL="https://oauth2.googleapis.com/token"
   OAUTH_REDIRECT_URI="http://localhost:3000/api/auth/callback"
   
   # Security Roles
   APPROVERS="admin,supervisor.name"

3. Sync Database Architecture

   npx prisma db push

4. Launch Application

   npm run dev

Heimdall is designed for zero-config local development with SQLite, but supports MySQL and PostgreSQL for production scalability.

1. Verify your database server is running and you have a database created.
2. Switch the project configuration:

   npm run db:mysql     # For MySQL
   npm run db:postgres  # For PostgreSQL

3. Update DATABASE_URL in .env to your connection string (see .env.example).
4. Apply the schema and generate the client:

   npx prisma migrate dev --name init

1. Run the switch script:

   npm run db:sqlite

2. Update DATABASE_URL in .env to file:./dev.db.
3. Sync the database:

   npx prisma db push

The repository contains a fully structured Dockerfile to seamlessly host the server on any infrastructure without local dependencies.

1. Build the container

   For SQLite (Default):

   docker build -t heimdall-platform .

   For MySQL:

   docker build -t heimdall-platform --build-arg DATABASE_PROVIDER=mysql .

2. Run the secure instance

   docker run -p 3000:3000 --env-file .env -d heimdall-platform

• Session Integrity: The system securely manages stateless session cookies globally.
• Environment Strictness: Unless FORCE_HTTPS=true is set, development setups natively bypass the "Secure" flag on cookies allowing local infrastructure hosting across IP networks.
• HMR Strictness: Turbopack inherently isolates socket headers. If you are developing over a network, next.config.ts dynamically scans node hardware IP paths internally to allow hot-reloading anywhere on the VM array natively.