helpyourneighbour/issues/5.md

# Issue #5: Implement Role-Based Access Control (RBAC) for API Endpoints

## Description

Implement role-based access control (RBAC) for all API endpoints to ensure that users can only perform actions permitted by their role (`user`, `moderator`, `admin`).

This includes:
- Middleware to check user roles for each endpoint
- Integration with existing JWT authentication
- Audit logging for sensitive actions
- Unit tests for role checks

## Acceptance Criteria

- [ ] JWT middleware extracts user role from token claims
- [ ] Middleware `requireRole([...])` is implemented and used for all protected endpoints
- [ ] Role checks are enforced for all API endpoints (auth, requests, offers, deals, contacts, disputes)
- [ ] Audit logging is implemented for sensitive actions (e.g., user suspension, dispute decisions)
- [ ] Unit tests cover role-based access control logic
- [ ] Documentation updated with RBAC implementation details

## Tasks

1. Implement `requireRole` middleware in `backend/middleware/role.middleware.js`
2. Integrate role checking into existing API routes
3. Add audit logging for sensitive actions
4. Write unit tests for role checks
5. Update documentation (`docs/roles-and-permissions.md`)