Web dashboard: role-based access control — moderator vs admin permissions

[BillChirico]

Part of #27

Currently the dashboard is admin-only (guild owner or Administrator permission). Moderators with Manage Messages, Kick Members, or Ban Members permissions can't access the dashboard at all.

Subtasks

• Define permission tiers:
  • Viewer — analytics, public pages (no mutations)
  • Moderator — + moderation panel, member warnings, case management
  • Admin — + config editor, member XP adjustment, audit log
  • Owner — + danger zone (reset config, purge data)
• Backend middleware: requireRole('moderator' | 'admin' | 'owner') middleware that checks Discord permissions
• Frontend route guards: Redirect unauthorized users, hide nav items they can't access
• API permission checks: Each mutating endpoint checks the required role
• Permission mapping: Map Discord permissions to dashboard roles:
  • ADMINISTRATOR → Admin
  • MANAGE_GUILD → Admin
  • MANAGE_MESSAGES + KICK_MEMBERS → Moderator
  • VIEW_CHANNEL → Viewer
• Dashboard UI indicator: Show current user's role in sidebar footer
• Tests: Permission check tests for each API endpoint

Technical Notes

• Current auth: requireGuildAdmin in src/api/middleware/auth.js — extend, don't replace
• Discord permissions are bitfields — use PermissionFlagsBits from discord.js
• Guild member permissions fetched during OAuth flow and cached in session

Acceptance Criteria

• Moderators can access moderation panel but not config editor
• Viewers see analytics but can't mutate anything
• Unauthorized access returns 403 with clear message
• Nav items hidden based on role (not just disabled)

[coderabbitai]

🔗 Related PRs

#100 - feat: add starboard, permissions, memory, and rate limit config sections to web dashboard [merged]
#111 - feat: /profile command with engagement tracking [merged]
#113 - feat: /showcase project showcase with upvotes (#50) [merged]
#115 - feat: daily coding challenge system (#52) [merged]
#120 - feat: public community page — leaderboards, showcases, and stats [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[puppy-engineer]

I will do this