Openfront Law Firm

Source · Live site · Catalog

Openfront Law Firm is an open-source app for running a law practice. Staff handle intake, conflict checks, matters, dockets, deadlines, documents, messages, time, billing, retainers, and trust records in one dashboard. Visitors can read about the firm, browse practice areas and attorneys, open an account, and request a consultation. Clients can see items the firm shares with them in a portal.

To install it, see Getting started.

Concepts

Stack

Next.js 16 (App Router) with React 19, Keystone 6 with a GraphQL API, Prisma with PostgreSQL, Tailwind CSS 4, and shadcn/ui. Sign-in uses Keystone password auth with stateless session cookies.

Source layout

schema.graphql and schema.prisma are generated from the models.

Tenancy and access

Firm is the tenant. Every firm-owned list carries a firm relationship. Shared hooks set the active firm on create and reject links to records from another firm. Lists with a lifecycle check each status change against a fixed transition table.

Staff access comes from an active FirmMembership and that firm's Role. A role has 39 can* flags, for example canManageIntake, canRunConflictChecks, canResolveConflicts, canManageMatters, canManageEthicalWalls, canManageBilling, canManageTrust, canManagePortal, canManageRetention, canManageIntegrations, canManageAgents, and canViewAudit.

Matter-scoped lists add three more checks:

• team membership on the matter, with canEdit, canBill, and canAccessRestricted;
• ethical walls, which can block a user from a matter;
• authorizedUsers and blockedUsers on Matter, which are maintained by the team and wall mutations and cannot be written directly.

A firm administrator does not silently pass an ethical wall.

Data model

Money is stored as integer minor units with a currency code. Document versions, trust entries, matter status events, signature events, audit events, and agent action events are append-only. Trust postings are corrected with reversing transactions, not edits.

Key lifecycles:

• Intake: new → screening → conflict_review → consultation → decision → converted, declined, or withdrawn.
• Conflict check: requested → running → review_required → cleared or conflict_found.
• Matter: proposed → pending_conflict → open, on_hold, closing, closed; or declined.
• Consultation: requested → scheduled → completed, cancelled, or no_show.
• Invoice: draft → approved → issued → partially_paid → paid; also overdue and void.
• Refund: requested → approved → processing → succeeded or failed.

Workflows

1. Onboarding. completeFirmOnboarding creates the firm, first office, administrator role, four standard roles, your membership, and a default practice area. See Getting started.
2. Publish the site. Publish a PublicSitePolicy (privacy notice, first-contact notice, about text, accounts and booking switches), mark practice areas public with a slug, fee, and length, and publish attorney profiles.
3. Online booking. A visitor creates an account (registerConsultationAccount) and books a slot (bookClientConsultation). This creates a contact, an intake with a submission, a consultation in requested, and a conflict check when an opposing party is named. Slots are 9:00 to 17:00 on weekdays. Staff confirm or change it with scheduleConsultation and transitionConsultation. The customer can cancel with cancelOwnConsultation.
4. Intake to matter. startClientIntake, addIntakeParticipant, conflict search terms and matches, recordConflictDisposition, finalizeConflictCheck, then convertIntakeToMatter, which creates the matter, parties, and team.
5. Matter administration. setMatterTeamAccess, addMatterParty, changeMatterParty, transitionEthicalWall, setEthicalWallMember, changeMatterConfidentiality, transitionMatter.
6. Courts and deadlines. Courts and dockets, recordDocketEntry, verifyDocketEntry, deadlines (reviseDraftDeadline, transitionDeadline), and tasks (transitionLegalTask).
7. Documents. ingestDocumentVersion uploads to the S3 bucket, setDocumentCurrentVersion, then prepareSignatureRequest and addDocumentSigner.
8. Messages. Threads, addCommunicationParticipant, a draft message, prepareCommunicationDeliveries (email only), then queueCommunicationMessage. The outbox worker sends email through SMTP.
9. Time to cash. Rate cards and rules, time entries and expenses (transitionTimeEntry, transitionExpense), assembleDraftInvoice, transitionInvoice, recordManualPayment, allocatePayment, reversePaymentAllocation, requestRefund, reviewRefund. Retainers use prepareRetainerAgreement and transitionRetainerAgreement.
10. Trust. Trust accounts and client or matter ledgers, postTrustTransaction (balanced, idempotent, serializable), and three-way reconciliation with prepareTrustReconciliation, reviseTrustReconciliation, transitionTrustReconciliation.
11. Client portal. recordPortalDiscoveryPolicy, invitePortalAccount, acceptPortalInvitation, executePortalGrant, sharePortalResource (document, invoice, or thread), revokePortalGrant.
12. People. inviteFirmMember, changeFirmMemberAccess, updateFirmRoleAuthority.
13. Governance. transitionRetentionPolicy, assignDocumentRetentionPolicy, placeRetentionHold, releaseRetentionHold, disposeRetainedDocument.
14. Data. previewContactImport and applyContactImport for contacts from CSV; preparePracticeExport for contacts, matters, invoices, time entries, or audit events (up to 500 rows).

Status, money, access indexes, credentials, and evidence fields are not writable through generic list updates on these lists. Changes go through the named mutations, which use a serializable transaction, an advisory lock, an idempotency key where money or access moves, and an audit event.

Named GraphQL operations

Custom queries in features/keystone/mutations/index.ts:

• Public and customer: consultationCatalog, consultationCatalogPage, consultationService, consultationAvailability, customerConsultations, customerConsultationPage, customerConsultation, portalSharedResource.
• Staff: practiceOverview, practiceWorkspace(category), previewContactImport, portalPolicyWorkspace.
• Viewer checks: redirectToInit, viewerCanAccessDashboard, viewerCanRunConflictChecks, viewerCanResolveConflicts, viewerNeedsFirmOnboarding.

Custom mutations, grouped:

The dashboard calls these through named documents in features/platform (for example CompleteFirmOnboarding, ConvertIntake, PostTrustTransaction, PracticeWorkspace).

GraphQL boundary

/api/graphql (in pages/api/graphql.ts) accepts POST only. It requires JSON, or multipart from the same origin for uploads. Bodies are capped at 1 MB and uploads at 10 MB and 5 files. Lists return at most 100 items per query. Query depth and fragment expansion are limited. Introspection and the playground are off, and internal error details are removed. Bearer tokens (API keys, OAuth access tokens, agent credentials) are accepted and checked against their scopes and the current owner's permissions.

Integrations

More

• Getting started
• External dashboards
• External storefronts