[FEATURE] API: Role-Based Access Control (RBAC) authorization middleware (#62)

[KevinMB0220]

📋 Feature Description

Clear and concise description of the feature:
Create a middleware that enforces Role-Based Access Control (RBAC) across Express REST endpoints. Supported roles: Admin, Manager, Operator, Auditor.

🎯 Motivation

Why is this feature needed? What problem does it solve?
Roadmap item #62. Organizations need scoped access policies to prevent operators from performing administrative actions (e.g. key deletion).

💡 Proposed Solution

How should this feature work? Include technical details:
Middleware intercepts requests, decodes auth claims, and matches required endpoint scopes.

🔧 Technical Implementation

Implementation details for AI/developers:

Files to Create/Modify

• packages/api/rest/src/middleware/rbac.ts

Dependencies

• None

API Changes

export function requireRole(roles: string[]): RequestHandler;

✅ Acceptance Criteria

• Request gets rejected with 403 if role is insufficient.
• Request passes to handler if role is matching.
• Full coverage unit tests.

📚 Additional Context

None.

🔗 Related Issues

• N/A

🏷️ Labels

Phase: phase-4
Component: api
Priority: critical

---

[EmannuellaO]

@EmannuellaO has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi! I've carefully reviewed the entire task description and fully understand the requirements and expected outcome.
I have experience working on similar tasks and I'm confident I can complete this within about an hour. I'd be happy to take ownership of this issue and submit a clean, well-tested solution promptly.
If it's available, please assign it to me. Thank you!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @EmannuellaO to this issue.

[mariocodecr]

@mariocodecr has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi! I’m a backend engineer with experience building secure APIs using Node.js, Express, and TypeScript. I’ve worked on authentication and authorization systems including RBAC, JWT-based access control, and middleware-based security layers for multi-role applications.

For this issue, I’d implement a reusable requireRole(roles: string[]) middleware in packages/api/rest/src/middleware/rbac.ts that validates the authenticated user’s role against the allowed endpoint roles. The middleware would:

• extract auth claims from the request context/token
• validate the user role
• return 403 Forbidden for insufficient permissions
• allow the request to continue when authorization succeeds

I would also ensure the implementation remains extensible for future permission/scope-based authorization beyond simple role matching.

Additionally, I’d add comprehensive unit tests covering:

• authorized requests
• unauthorized requests
• missing auth claims
• malformed payloads
• multiple allowed roles
• edge cases

Why I’m a good fit:

• Strong experience with Express middleware architecture
• Experience implementing RBAC systems in production APIs
• Solid TypeScript and backend testing practices
• Familiarity with secure API design and centralized authorization patterns

I also care about maintainability and developer experience, so I’d aim to keep the middleware clean, strongly typed, and easy to integrate across route handlers. Since this is a critical roadmap item, I’d prioritize reliability, readability, and test coverage to make it a solid long-term foundation for API security.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @mariocodecr to this issue.

[Thosine-01]

@Thosine-01 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi! I’d love to take charge of implementing the Role-Based Access Control (RBAC) authorization middleware under issue #62. Hardcoding role validation directly within individual endpoint controllers leads to massive security drift and makes audit logs difficult to maintain. I have extensive experience building bulletproof, type-safe security middleware for Express REST APIs, setting up granular authorization systems, and writing full-coverage test configurations.

I will create the requireRole middleware factory function inside packages/api/rest/src/middleware/rbac.ts following your exact specifications. It will cleanly inspect active authentication claims from the request context, mapping authorization checks against your supported roles: Admin, Manager, Operator, and Auditor. If a request has insufficient permissions, it will immediately halt processing and return a clean, standard 403 Forbidden error response; matching profiles will pass right through to your controller handlers. Finally, I will wrap the codebase in a comprehensive unit-test suite to secure 100% coverage across all success and failure branches.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Thosine-01 to this issue.