Enterprise-grade multi-tenant platform for tracking IT assets with RFID technology
π‘ Real-Time Tracking | π¨ Instant Alerts | π’ Multi-Tenant | π Complete Audit Trail
- Overview
- Key Features
- System Architecture
- Technology Stack
- Project Structure
- Getting Started
- Backend Setup
- Frontend Setup
- RFID Integration
- API Documentation
- Database Schema
- Development
- Deployment
- Contributing
- Roadmap
AssetTrackPro is a production-ready, enterprise-grade RFID-based real-time asset tracking system designed to monitor the physical movement of company assets (laptops, tablets, phones) as they transit through zones and gates within organizational buildings.
ER Diagram
Use Case Diagram
Flow Chart
DATABASE SCHEMA (Relational, production-ready)
ORGANIZATION organization_id (PK) name industry_type created_at
BRANCH branch_id (PK) organization_id (FK) name city status
BUILDING building_id (PK) branch_id (FK) name
ZONE zone_id (PK) building_id (FK) zone_name zone_type (STORAGE, OFFICE, EXIT, SECURE)
GATE gate_id (PK) zone_id (FK) gate_name direction (ENTRY, EXIT, BOTH)
EMPLOYEE employee_id (PK) organization_id (FK) employee_code name status (ACTIVE, RESIGNED)
ASSET asset_id (PK) organization_id (FK) asset_tag_uid (RFID EPC / UUID) asset_type (LAPTOP, TABLET, PHONE) status (ACTIVE, LOST, RECOVERED) last_seen_zone_id (FK) last_seen_time
ASSET_ASSIGNMENT (history matters) assignment_id (PK) asset_id (FK) employee_id (FK) assigned_at returned_at (nullable)
MOVEMENT_EVENT (heart of the system) event_id (PK) asset_id (FK) gate_id (FK) zone_from_id (FK) zone_to_id (FK) event_type (ENTER, EXIT) event_time trigger_source (RFID, SIMULATED)
Append-only. Never update. Never delete.
ALERT / INCIDENT alert_id (PK) asset_id (FK) event_id (FK) alert_type (UNAUTHORIZED_EXIT, OVERDUE_RETURN) severity created_at resolved_at
Unlike traditional inventory management systems that require manual check-in/check-out, AssetTrackPro provides:
β
Real-time location tracking via RFID gates
β
Unauthorized exit detection and alerting (< 1 second latency)
β
Immutable movement audit trail (append-only event log)
β
Multi-tenant architecture (one system, many organizations)
β
Hierarchical location model (Organization β Branch β Building β Zone β Gate)
β
Production-ready scale (10,000+ assets, 100,000+ events/day)
π IT Asset Security: Prevent unauthorized removal of company laptops/devices
π Compliance & Audit: Complete immutable trail of who had what, when
π¨ Loss Prevention: Real-time alerts when assets exit buildings unexpectedly
π Utilization Tracking: Analytics on asset movement patterns
π Inventory Management: Always know where every asset is located
- RFID-Tagged Assets: Each asset has unique RFID tag (EPC Gen2 UHF)
- Hierarchical Locations: Organization β Branch β Building β Zone β Gate
- Asset Assignment: Track who has what asset at any time
- Asset Status: ACTIVE, LOST, RECOVERED, RETIRED
- Asset Types: LAPTOP, TABLET, PHONE, MONITOR, etc.
- Automatic Detection: RFID readers detect tags as assets move through gates
- Movement Events: Every gate crossing creates an immutable event record
- Last Seen Location: Real-time tracking of asset current zone
- Movement History: Complete audit trail of all asset movements
- Event Volume: Handles 100,000+ events/day per organization
- Unauthorized Exit Detection: Alert when assets leave without authorization
- Overdue Return Alerts: Notify when assets not returned on time
- Lost Asset Detection: Flag assets not seen for 30+ days
- Zone Violation Alerts: Detect assets entering restricted areas
- Tampered Tag Detection: Alert on damaged/removed RFID tags
- Organization Isolation: Complete data separation between tenants
- Row-Level Security: Database-enforced tenant isolation (PostgreSQL RLS)
- Per-Organization Users: Role-based access control (admin, manager, security, viewer)
- Scalable: Supports thousands of organizations on single infrastructure
- Real-Time Dashboard: Live asset locations and alert status
- Movement Analytics: Track busiest zones, gates, assets
- Utilization Reports: Identify underutilized assets
- Compliance Reports: Generate audit trails for specific time periods
- Zone Occupancy: View current assets per zone in real-time
ββββββββββββββββ
β Clients β (Web Browser / Mobile App)
β (React UI) β
ββββββββ¬ββββββββ
β HTTPS/REST API
βΌ
ββββββββββββββββ
β Express.js β (Node.js Backend - Port 5000)
β Backend β β’ JWT Authentication
ββββββββ¬ββββββββ β’ Multi-tenant filtering
β SQL β’ Alert rules engine
βΌ
ββββββββββββββββ
β PostgreSQL β (10-table production schema)
β Database β β’ Hierarchical location model
ββββββββββββββββ β’ Append-only movement_event table
β²
β RFID Events
β
ββββββββββββββββ
β RFID β (Impinj ItemSense Middleware)
β Middleware β β’ Event aggregation
ββββββββ¬ββββββββ β’ Webhook to backend
β
βΌ
ββββββββββββββββ
β RFID Readers β (Impinj R700, Zebra FX, etc.)
β at Gates β β’ Detect tags as assets pass
ββββββββββββββββ β’ 1-10 meter read range
π Detailed Architecture: See docs/Architecture-Diagram.md
- React 19.2.0: Modern UI library with hooks
- Vite 7.2.4: Lightning-fast build tool and dev server
- Axios: HTTP client for API calls
- React Router: Client-side routing
- CSS3/Tailwind: Responsive styling
- Node.js 18+ LTS: JavaScript runtime
- Express.js 5.2.1: Web framework (ES Modules)
- JWT: Token-based authentication
- bcrypt: Password hashing
- Winston/Pino: Structured logging
- Joi: Request validation
- PostgreSQL 14+ (Recommended):
- Row-level security (RLS) for multi-tenancy
- Table partitioning for
movement_event(millions of rows) - JSONB for flexible metadata
- Advanced indexing (B-tree, GiST)
- MySQL 8+ (Alternative): InnoDB with proper indexing
- RFID Readers: Impinj R700/R420, Zebra FX9600
- RFID Tags: EPC Gen2 (ISO 18000-6C) passive UHF tags
- Frequency: 860-960 MHz (region-dependent)
- Read Range: 1-10 meters (tag and power dependent)
- Middleware: Impinj ItemSense or Zebra Savanna
- Git/GitHub: Version control
- ESLint/Prettier: Code quality
- Docker: Containerization (optional)
- Jest/Mocha: Unit testing
- Cypress: E2E testing
AssetTrackPro/
βββ backend/ # Backend API server (ES Modules)
β βββ src/
β β βββ config/ # Configuration files
β β β βββ database.js # DB connection pool
β β βββ controllers/ # Request handlers
β β β βββ assetController.js
β β β βββ movementEventController.js
β β β βββ rfidWebhookController.js β (RFID integration)
β β β βββ alertController.js
β β β βββ zoneController.js
β β βββ middleware/ # Custom middleware
β β β βββ auth.js # JWT verification
β β β βββ tenantScope.js β # Multi-tenant filtering
β β β βββ errorHandler.js
β β βββ models/ # Data models (10 tables)
β β β βββ Organization.js # Tenant root
β β β βββ Branch.js # Office locations
β β β βββ Building.js
β β β βββ Zone.js # STORAGE, OFFICE, EXIT, SECURE
β β β βββ Gate.js π‘ # RFID reader locations
β β β βββ Employee.js
β β β βββ Asset.js π·οΈ # RFID-tagged devices
β β β βββ AssetAssignment.js
β β β βββ MovementEvent.js β # Immutable event log
β β β βββ Alert.js π¨
β β βββ routes/ # API routes
β β β βββ assetRoutes.js
β β β βββ movementEventRoutes.js
β β β βββ rfidWebhookRoutes.js β
β β β βββ alertRoutes.js
β β β βββ zoneRoutes.js
β β β βββ analyticsRoutes.js
β β βββ services/ # Business services
β β β βββ alertRulesEngine.js β # Violation detection
β β β βββ rfidEventProcessor.js # Event normalization
β β β βββ notificationService.js # Email, SMS, push
β β β βββ cacheService.js # Redis (optional)
β β βββ utils/ # Utilities
β β β βββ helpers.js
β β β βββ logger.js
β β β βββ validators.js
β β βββ migrations/ # Database schema
β β β βββ 001_create_organization_branch_building.sql
β β β βββ 002_create_zone_gate.sql
β β β βββ 003_create_employee_asset.sql
β β β βββ 004_create_movement_event.sql β
β β β βββ 005_create_alert.sql
β β β βββ 006_add_indexes_and_constraints.sql
β β βββ app.js # Express app setup
β β βββ server.js # Server entry point
β βββ .env.example
β βββ .gitignore
β βββ package.json
β
βββ frontend/ # React frontend
β βββ public/ # Static files
β βββ src/
β β βββ assets/ # Images, fonts, etc.
β β βββ components/ # Reusable components
β β β βββ layout/ # Header, Footer, Nav
β β β βββ assets/ # Asset components
β β β βββ rfid/ β # RFID-specific UI
β β β β βββ ZoneViewer.jsx
β β β β βββ GateStatus.jsx
β β β β βββ RFIDTagScanner.jsx
β β β βββ alerts/ # Alert panel, list
β β β βββ movements/ # Movement history, heatmap
β β β βββ zones/ # Zone list, occupancy
β β βββ hooks/ # Custom React hooks
β β β βββ useFetch.js
β β β βββ useAssets.js
β β β βββ useAlerts.js
β β β βββ useRealtime.js # WebSocket (Phase 2)
β β β βββ useZones.js
β β βββ pages/ # Page components
β β β βββ Home/
β β β βββ Dashboard/ # Real-time dashboard
β β β βββ Assets/
β β β βββ Zones/
β β β βββ Alerts/
β β β βββ Analytics/
β β β βββ Settings/
β β βββ services/ # API service layer
β β β βββ api.js # Axios config + JWT interceptor
β β β βββ assetService.js
β β β βββ movementService.js
β β β βββ alertService.js
β β β βββ zoneService.js
β β β βββ rfidService.js β
β β βββ utils/ # Utility functions
β β β βββ helpers.js
β β β βββ constants.js
β β β βββ dateFormatter.js
β β β βββ rfidParser.js β # Parse RFID tag formats
β β βββ App.jsx # Main app component
β β βββ App.css
β β βββ main.jsx # Entry point
β β βββ index.css
β βββ .env.example
β βββ eslint.config.js
β βββ index.html
β βββ package.json
β βββ vite.config.js
β βββ README.md
β
βββ docs/ # Documentation
β βββ Database-Schema.md β # Complete SQL schema (946 lines)
β βββ Architecture-Diagram.md # System architecture diagrams
β βββ Notes.txt # Technical documentation
β βββ README.md # Documentation index
β
βββ presentation/ # Presentation materials
β βββ README.md # Presentation guide
β
βββ README.md # This file
Before you begin, ensure you have:
- Node.js v18+ LTS
- npm or yarn
- Git
- PostgreSQL 14+ (or MySQL 8+)
- RFID Hardware (optional for development - can simulate)
# Clone repository
git clone https://github.com/kawdoco/AssetTrackPro.git
cd AssetTrackPro
# Setup backend
cd backend
npm install
copy .env.example .env
# Edit .env with your database credentials
npm start
# Setup frontend (in new terminal)
cd ../frontend
npm install
copy .env.example .env
npm run dev
# Access application
# Frontend: http://localhost:5173
# Backend: http://localhost:5000cd backendnpm installCreate .env file:
# Server Configuration
PORT=5000
NODE_ENV=development
# Database Configuration (PostgreSQL)
DB_HOST=localhost
DB_PORT=5432
DB_NAME=assettrackpro_dev
DB_USER=postgres
DB_PASSWORD=yourpassword
# JWT Configuration
JWT_SECRET=your_super_secret_jwt_key_change_in_production
JWT_EXPIRE=24h
# CORS Configuration
CORS_ORIGIN=http://localhost:5173
# RFID Integration
API_KEY_RFID_MIDDLEWARE=your_rfid_middleware_api_key
# Notifications (Optional)
SMTP_HOST=smtp.sendgrid.net
SMTP_PORT=587
SMTP_USER=apikey
SMTP_PASS=your_sendgrid_api_key
TWILIO_ACCOUNT_SID=your_twilio_sid
TWILIO_AUTH_TOKEN=your_twilio_token
TWILIO_PHONE_NUMBER=+1234567890
# Redis (Optional - Phase 2)
REDIS_URL=redis://localhost:6379# Create database
createdb assettrackpro_dev
# Run migrations
npm run migrate
# Seed test data (optional)
npm run seed# Development (with hot reload)
npm run dev
# Production
npm startBackend API: http://localhost:5000
cd frontendnpm installCreate .env file:
VITE_API_URL=http://localhost:5000/apinpm run devFrontend: http://localhost:5173
npm run build
npm run preview-
Install RFID Readers at strategic gates (entries/exits)
- Main building exits
- Storage room doors
- Secure server room access points
- Office floor transitions
-
Configure RFID Middleware (Impinj ItemSense):
{ "webhookUrl": "http://your-backend.com/api/rfid-webhook/movement-event", "headers": { "X-API-Key": "your_rfid_middleware_api_key" }, "aggregation": { "enabled": true, "timeWindow": 3000, "method": "logical" } } -
Attach RFID Tags to assets:
- Laptops: adhesive label on bottom
- Tablets: case-integrated or back adhesive
- Phones: SIM tray sticker
For development without physical RFID hardware:
# Send test RFID event
POST http://localhost:5000/api/rfid-webhook/movement-event
Content-Type: application/json
X-API-Key: your_rfid_middleware_api_key
{
"reader_id": "READER-001",
"gate_id": "<gate-uuid>",
"asset_tag_uid": "RFID-E200-34161B5A8C7D",
"event_type": "EXIT",
"event_time": "2026-02-13T14:30:45Z",
"signal_strength": -45,
"zone_from": "<zone-storage-uuid>",
"zone_to": "<zone-exit-uuid>"
}Or use the included test script:
npm run test:rfid-eventhttp://localhost:5000/api
All endpoints (except RFID webhook) require JWT authentication:
Authorization: Bearer <jwt_token>
| Method | Endpoint | Description |
|---|---|---|
| GET | /assets |
List all assets (filtered by organization) |
| GET | /assets/:id |
Get asset details |
| GET | /assets/tag/:rfid_tag β |
Get asset by RFID tag UID |
| GET | /assets/:id/location |
Get current location hierarchy |
| GET | /assets/:id/history |
Get movement history |
| POST | /assets |
Register new asset |
| PUT | /assets/:id |
Update asset |
| POST | /assets/:id/assign |
Assign to employee |
| POST | /assets/:id/return |
Mark as returned |
| Method | Endpoint | Description |
|---|---|---|
| POST | /rfid-webhook/movement-event β |
Receive RFID events |
| GET | /movement-events |
List events (paginated) |
| GET | /movement-events/:id |
Get event details |
| POST | /movement-events/simulate |
Create test event |
| Method | Endpoint | Description |
|---|---|---|
| GET | /alerts |
List alerts |
| GET | /alerts/unresolved |
Active alerts only |
| GET | /alerts/:id |
Get alert details |
| POST | /alerts/:id/resolve |
Mark alert resolved |
| POST | /alerts/:id/escalate |
Increase alert severity |
| Method | Endpoint | Description |
|---|---|---|
| GET | /zones |
List all zones |
| GET | /zones/:id/assets |
List assets in zone |
| GET | /gates |
List all gates |
| GET | /gates/:id/recent-events |
Recent gate crossings |
| Method | Endpoint | Description |
|---|---|---|
| GET | /analytics/dashboard |
Dashboard summary stats |
| GET | /analytics/movement-heatmap |
Busiest gates/zones |
| GET | /analytics/zone-occupancy |
Current assets per zone |
| GET | /reports/audit-trail |
Generate audit report |
{
"success": true,
"data": {
"asset_id": "a7b39d2e-1234-5678-abcd-ef1234567890",
"asset_tag_uid": "RFID-E200-34161B5A8C7D",
"asset_type": "LAPTOP",
"model": "MacBook Pro 16",
"status": "ACTIVE",
"last_seen_zone_id": "zone-storage-floor-1",
"last_seen_time": "2026-02-13T14:30:45Z"
},
"timestamp": "2026-02-13T14:35:00Z"
}π Full API Documentation: See docs/Notes.txt - Section 5
The system uses a 10-table production-ready schema:
- organization: Multi-tenant root (organization_id on all top-level entities)
- branch: Office locations (city, address)
- building: Physical buildings within branches
- zone: Logical areas (STORAGE, OFFICE, EXIT, SECURE)
- gate: RFID reader locations (direction: ENTRY, EXIT, BOTH)
- employee: Staff members (can have asset assignments)
- asset: RFID-tagged devices (unique
asset_tag_uidπ·οΈ) - asset_assignment: Who has what (assigned_at, returned_at)
- movement_event β: Immutable event log (NEVER update/delete!)
- alert: Security incidents (UNAUTHORIZED_EXIT, LOST_ASSET, etc.)
organization (1) β branches (N) β buildings (N) β zones (N) β gates (N)
organization (1) β employees (N)
organization (1) β assets (N) β movement_events (MILLIONS) β
asset (1) β asset_assignments (N)
asset (1) β alerts (N)
movement_event (1) β alerts (N)
asset.asset_tag_uid(UNIQUE B-tree) β RFID lookup < 1msmovement_event (asset_id, event_time DESC)β Most common querymovement_event (gate_id, event_time DESC)alert (severity, resolved_at)
π Complete Schema: See docs/Database-Schema.md (946 lines, comprehensive)
npm start # Start server (production mode)
npm run dev # Start with nodemon (hot reload)
npm run migrate # Run database migrations
npm run seed # Seed test data
npm test # Run unit tests
npm run test:coverage # Test coverage report
npm run lint # Run ESLint
npm run lint:fix # Fix ESLint errorsnpm run dev # Start dev server (hot reload)
npm run build # Build for production
npm run preview # Preview production build
npm run lint # Run ESLint
npm run test # Run unit tests (Vitest)
npm run test:e2e # Run E2E tests (Cypress)- ES Modules: Backend uses
"type": "module"- always useimport/export - File Extensions: Include
.jsin imports:import Asset from './models/Asset.js' - Multi-Tenant Aware: All queries MUST filter by
organization_id - Append-Only Events: NEVER update/delete
movement_eventrecords - Async/Await: Use async/await for all async operations (no callbacks)
- Error Handling: Use try-catch in all controllers
- Validation: Validate all user inputs with Joi/express-validator
- Logging: Use Winston/Pino for structured logging
Located in backend/src/services/alertRulesEngine.js:
// Example: Unauthorized Exit Detection
if (zone_to.zone_type === 'EXIT' && event_type === 'EXIT') {
const assignment = await getActiveAssignment(asset_id);
if (!assignment || isOverdue(assignment)) {
await createAlert({
type: 'UNAUTHORIZED_EXIT',
severity: 'HIGH',
asset_id,
event_id
});
}
}- Set strong
JWT_SECRET(64+ random characters) - Set strong
API_KEY_RFID_MIDDLEWARE - Configure PostgreSQL with proper indexes and partitioning
- Enable database backups (daily minimum)
- Set up monitoring (New Relic, Datadog, or Sentry)
- Configure SSL/TLS for all endpoints
- Set up load balancing for backend (if needed)
- Configure SMTP/SendGrid for email notifications
- Set rate limiting on API endpoints
- Enable CORS only for trusted domains
- Review database RLS policies
- Test RFID event ingestion at scale
Frontend: Vercel, Netlify, or AWS CloudFront
Backend: Heroku, Railway, or AWS EC2/ECS
Database: AWS RDS (PostgreSQL), DigitalOcean Managed DB, Azure Database
Monitoring: New Relic, Datadog
Error Tracking: Sentry
# Build images
docker-compose build
# Start services
docker-compose up -d
# View logs
docker-compose logs -f
# Stop services
docker-compose down- Fork the repository
- Create feature branch:
git checkout -b feature/rfid-dashboard-improvements - Make changes and commit:
git commit -m "Add: Real-time zone occupancy heatmap" - Push to branch:
git push origin feature/rfid-dashboard-improvements - Create Pull Request with description of changes
- ESLint: Follow project ESLint rules (auto-fix:
npm run lint:fix) - Naming: Use camelCase for variables/functions, PascalCase for classes/components
- Comments: Add JSDoc comments for all functions
- Commits: Use conventional commits:
feat:,fix:,docs:,refactor:,test: - Tests: Write tests for new features (aim for >80% coverage)
Use GitHub Issues with:
- Clear title: "RFID webhook fails with invalid gate_id"
- Steps to reproduce
- Expected vs actual behavior
- Environment: Node.js version, database, OS
β
10-table production database schema
β
Multi-tenant architecture with RLS
β
RFID webhook integration
β
Alert rules engine
β
Movement event tracking (append-only)
β
Comprehensive documentation (946 lines)
- Real-time WebSocket dashboard (< 1 second latency)
- Mobile app (React Native) with push notifications
- Advanced analytics with ML anomaly detection
- PDF/CSV export for reports
- Bulk RFID tag registration
- HR system integration (auto-sync employees)
- Procurement system integration (auto-import assets)
- Geo-fencing for assets outside buildings
- Maintenance scheduling & reminders
- Asset depreciation tracking
- AI-powered insights & predictions
- Blockchain audit trail (high-security option)
- IoT sensor integration (temp, humidity, shock)
- Cross-organization asset transfers
- Advanced role-based permissions (ABAC)
This project is licensed under the ISC License.
Project: AssetTrackPro
Version: 2.0.0 (RFID Production-Ready)
Last Updated: February 13, 2026
For questions, support, or contributions:
- GitHub: https://github.com/kawdoco/AssetTrackPro
- Documentation: See
docs/folder - Issues: https://github.com/kawdoco/AssetTrackPro/issues
This project demonstrates:
β
Production-Ready Database Design: 10-table normalized schema (3NF) with proper constraints
β
Multi-Tenant Architecture: Row-level security and organization_id isolation
β
Append-Only Event Log: Immutable movement_event table for compliance
β
Hierarchical Data Model: Organization β Branch β Building β Zone β Gate
β
RFID Integration: Real-world IoT/hardware integration
β
Alert Rules Engine: Complex business logic with event-driven architecture
β
Performance Optimization: Strategic indexing, partitioning, caching strategy
β
Security: JWT authentication, RLS, input validation, API key protection
β
Scalability: Handles 10,000+ assets, 100,000+ events/day
β
Documentation: Comprehensive (946-line schema docs, architecture diagrams)
Key Learning Outcomes: Full-stack development, database design, real-time systems, multi-tenancy, IoT integration, production deployment
π Happy Tracking!


