Who people are, which workspaces they belong to, and what they are allowed to do.
Every other part of Kern asks this service those questions. It also holds the things that do not belong to any one feature: your notification inbox, uploaded files, search across everything, and the audit log.
It hosts feature modules too. A module only needs its own service for a runtime reason. Chat holds a websocket per person. Mail holds open IMAP connections. Everything else runs here, including the issue tracker.
Goal: start core on your own machine and see its API.
You need:
- Node 24 and pnpm 10.
- A Postgres 18 database.
Most people should run the whole platform from the
umbrella repository instead. There, pnpm setup && pnpm infra && pnpm dev starts core with everything it talks to.
pnpm install
cp .env.example .envSet DATABASE_URL in .env to your Postgres database.
pnpm devCore creates its own database tables the first time it starts.
Expected result: migrations applied, then core API listening on port 4000.
Open http://localhost:4000/api/docs.
Expected result: a browsable reference for every endpoint core serves.
A deployment usually applies migrations before it starts anything:
pnpm db:migrateExpected result: migrations applied, then migrations complete.
| Path | What answers there |
|---|---|
/api/core/* |
Accounts, workspaces, members, roles, permissions, notifications, files, search |
/api/auth/* |
Sign-in, sign-up, sessions, passkeys, two-factor, single sign-on |
/api/tracker/* |
The issue tracker, which this service hosts |
/api/docs |
The API reference |
Every module this service hosts adds its own /api/<module> prefix and its own OpenAPI document at
/api/<module>/openapi.json.
- Permissions are checked twice. Every procedure checks that the caller may do the thing. Then Postgres row-level security checks it again, so a mistake in the first layer does not leak another workspace's data.
- A workspace can switch a module off. Its routes then answer 403, its jobs stop, and it disappears from the interface.
- Adding a module here is one line. Add the dependency, then add it to
featureModulesinsrc/service.ts. The runtime does the rest: migrations, routes, permissions, jobs. src/tests/hosted-modules.test.tsuses each hosted module through this service, so a module this service claims to host has to actually work.
Read CONTRIBUTING.md and CLAUDE.md.
AGPL-3.0-only. This repository is part of the Kern product. The Kern framework you build modules against is Apache-2.0 — see LICENSING.md.
Kern — one place for your team's work: issues, conversations, documents and people. Open source, self-hosted. kernaio.com · github.com/KernAIO