feat(backend/security): Enterprise Role-Based Access Control (RBAC) & Fine-Grained Resource Permission Middleware

[Diwakar-odds]

What the issue is & Problem Statement

Admin endpoints (app/api/admin/*) and resource actions rely on basic boolean role flags (Role.ADMIN), lacking granular permission scoping. This creates risk of privilege escalation, IDOR vulnerabilities, and unauthorized access across multi-tenant admin capabilities.

Files to be Changed / Created

• prisma/schema.prisma — Add Permission and RolePermission relational database models.
• lib/rbac/permissions.ts (NEW) — Centralized permission matrix definition.
• lib/rbac/rbacMiddleware.ts (NEW) — Authorization context extractor and policy evaluator.
• app/api/admin/users/route.ts — Protected user management route with permission enforcement.
• app/api/admin/verify-user/route.ts — Admin verification route authorization guard.
• app/api/links/[id]/route.ts — IDOR protection resource ownership validator.

Proposed Solution

1. Declarative Permission Matrix: Define granular permissions (USER_READ, USER_WRITE, LINK_DELETE, ADMIN_VERIFY) mapped to custom roles.
2. Authorization Guards: Build middleware to evaluate request session tokens against required resource permissions before route execution.
3. IDOR Ownership Validation: Implement strict resource-level ownership verification ensuring users can only modify their own resources unless explicit administrative permission is granted.

Impact & Effect

• Protects API routes against IDOR attacks, unauthorized privilege escalations, and broken access controls.

Benefit

• Establishes enterprise-grade access control architecture compliant with SOC2 least-privilege standards.