Authorization & Role-Based Access Control Refactor

User Stories

As a mentor, I want to only see the mentoring dashboard section, so that I cannot accidentally access or modify officer-only data #TBD
As a Primary Officer, I want to be the only one who can add/edit/remove officers and positions, so that officer management is properly gated #TBD
As a user, I want my profile to be private and only viewable by me, so that my personal information is not exposed to anyone #TBD
As a signed-in user, I want to be able to RSVP to events, so that attendance is tracked accurately #TBD
As a signed-in user, I want to be able to submit QDB quotes and mentor applications, so that participation is open to all members #TBD
As a Primary Officer, I want headcount imports to be restricted to me, so that data integrity is maintained #TBD
As a developer, I want all API routes to be registered in the auth middleware, so that no endpoint is accidentally left unprotected #TBD
As a developer, I want dashboard pages to enforce auth server-side, so that client-side-only checks cannot be bypassed #TBD

Technical Requirements

Add primaryOfficerVerifier to next/lib/middlewares/authentication.ts using isPrimary from AuthLevel
Update ROUTES entries for officer, officer-positions, handover, headcount-import to use primaryOfficerVerifier
Update eventVerifier to require isUser for attendance endpoints
Update ROUTES.quotes to use a signedInVerifier for POST; keep officer-only for PUT/DELETE with self-delete exception
Register ~13 currently absent routes in ROUTES with correct verifiers
Scope dashboard/layout.tsx to redirect mentor-only users away from non-mentoring sections
Add server-side session checks to dashboard layouts
Gate /profile/[id] page and /api/user/search behind owner/officer auth

# Authorization & Role-Based Access Control Refactor ## User Stories - [ ] As a mentor, I want to only see the mentoring dashboard section, so that I cannot accidentally access or modify officer-only data #TBD - [ ] As a Primary Officer, I want to be the only one who can add/edit/remove officers and positions, so that officer management is properly gated #TBD - [ ] As a user, I want my profile to be private and only viewable by me, so that my personal information is not exposed to anyone #TBD - [ ] As a signed-in user, I want to be able to RSVP to events, so that attendance is tracked accurately #TBD - [ ] As a signed-in user, I want to be able to submit QDB quotes and mentor applications, so that participation is open to all members #TBD - [ ] As a Primary Officer, I want headcount imports to be restricted to me, so that data integrity is maintained #TBD - [ ] As a developer, I want all API routes to be registered in the auth middleware, so that no endpoint is accidentally left unprotected #TBD - [ ] As a developer, I want dashboard pages to enforce auth server-side, so that client-side-only checks cannot be bypassed #TBD ## Technical Requirements - [ ] Add `primaryOfficerVerifier` to `next/lib/middlewares/authentication.ts` using `isPrimary` from `AuthLevel` - [ ] Update `ROUTES` entries for `officer`, `officer-positions`, `handover`, `headcount-import` to use `primaryOfficerVerifier` - [ ] Update `eventVerifier` to require `isUser` for attendance endpoints - [ ] Update `ROUTES.quotes` to use a `signedInVerifier` for POST; keep officer-only for PUT/DELETE with self-delete exception - [ ] Register ~13 currently absent routes in `ROUTES` with correct verifiers - [ ] Scope `dashboard/layout.tsx` to redirect mentor-only users away from non-mentoring sections - [ ] Add server-side session checks to dashboard layouts - [ ] Gate `/profile/[id]` page and `/api/user/search` behind owner/officer auth

Rows
Columns

Epic: Authorization & Role-Based Access Control Refactor #331

Authorization & Role-Based Access Control Refactor

User Stories

Technical Requirements