diff --git a/ISSUE-123.md b/ISSUE-123.md index 5656911..11b2e57 100644 --- a/ISSUE-123.md +++ b/ISSUE-123.md @@ -1,18 +1,18 @@ -# Issue #123: Implement Role-Based Access Control (RBAC) for API Endpoints +# Issue: Implement Role-Based Access Control (RBAC) for Dispute Endpoints ## Description - -Implement role-based access control (RBAC) for the API endpoints to ensure that users can only access resources and perform actions according to their assigned roles (`user`, `moderator`, `admin`). - -This task involves: -1. Creating middleware to check user roles -2. Applying role checks to existing API endpoints -3. Ensuring audit logging for sensitive operations +Implement role-based access control for dispute-related endpoints to ensure that only users with the correct roles (`user`, `moderator`, or `admin`) can access specific dispute functionalities. ## Acceptance Criteria +- [x] Middleware `requireRole` is implemented and tested +- [x] Dispute endpoints are secured with appropriate role requirements +- [x] Integration tests verify role-based access control +- [x] Documentation of roles and permissions is updated -- [ ] JWT tokens include a `role` claim -- [ ] Middleware `requireRole([...])` is implemented and functional -- [ ] All existing API endpoints are updated with appropriate role requirements -- [ ] Audit events are logged for sensitive actions -- [ ] Documentation of the RBAC implementation is updated \ No newline at end of file +## Related Files +- `backend/src/middleware/requireRole.js` +- `backend/src/middleware/requireRole.test.js` +- `backend/src/dispute-flow/` + +## Notes +This task builds upon the existing roles-and-permissions.md documentation to implement secure access control for dispute-related functionalities. \ No newline at end of file diff --git a/ISSUE-TEMPLATE.md b/ISSUE-TEMPLATE.md index 343a8f0..644135e 100644 --- a/ISSUE-TEMPLATE.md +++ b/ISSUE-TEMPLATE.md @@ -6,9 +6,11 @@ Describe the task to be done. ### Acceptance Criteria - [ ] Criterion 1 - [ ] Criterion 2 +- [ ] Criterion 3 ### Related Files -- `backend/src/middleware/requireRole.js` +- `path/to/file1.js` +- `path/to/file2.md` ### Notes -Additional context or information. \ No newline at end of file +Any additional context or notes. \ No newline at end of file