fix: bootstrap initial admin for RBAC role system

[Imran2210]

Overview

This PR fixes the RBAC bootstrap deadlock: after a fresh deploy, no user had the admin role, so POST /v1/roles could never be called successfully. The fix seeds an initial admin from INITIAL_ADMIN_USER_ID, adds a first-admin bootstrap path when the role map is empty, and wires RBAC middleware into protected routes so the role system is no longer dead code.

Related Issue

Changes

🚀 Initial Admin Bootstrapping

• [ADD] src/config.ts

  • Adds initialAdminUserId parsed from INITIAL_ADMIN_USER_ID.
  • Empty value disables startup seeding for deployments that opt out.

• [ADD] src/lib/roles.ts

  • Exports seedInitialAdmin(userId) which calls assignRole(userId, "admin") only when no admin exists.
  • Exports hasRole(userId, role) so middleware and routes share one role-map lookup.

• [MODIFY] src/index.ts

  • Calls seedInitialAdmin(config.initialAdminUserId) during app startup so a fresh deploy has an admin user.

• [MODIFY] src/routes/roles.ts

  • Allows POST /v1/roles to succeed when listRoles().length === 0, even without an existing admin.
  • All later role mutations still require requireRole("admin").

🔐 RBAC Middleware Enforcement

• [MODIFY] src/middleware/rbac.ts

  • identifyUser populates the current user from the auth token.
  • requireAuth returns 401 for missing or invalid credentials.
  • requireRole("admin") returns 403 when the identified user lacks the required role.

• [MODIFY] src/index.ts / src/routes/roles.ts

  • Applies the RBAC middleware stack to protected endpoints so the role checks are no longer dead code.

📄 Configuration Docs

• [MODIFY] .env.example
  • Documents INITIAL_ADMIN_USER_ID with a placeholder value for fresh deployments.

Verification Results

# Fresh deploy with bootstrap admin:
INITIAL_ADMIN_USER_ID=admin-1 npm start

# POST /v1/roles with empty role map:
curl -s -o /dev/null -w "%{http_code}" -X POST /v1/roles \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"userId":"user-2","role":"viewer"}'
201

# Subsequent non-admin assignment attempt:
curl -s -o /dev/null -w "%{http_code}" -X POST /v1/roles \
  -H "Authorization: Bearer <non-admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"userId":"user-3","role":"admin"}'
403

Acceptance Criteria	Status
Fresh deploy can bootstrap an initial admin	✅ INITIAL_ADMIN_USER_ID is seeded into the role map at startup
POST /v1/roles can be called successfully after fresh deploy	✅ Bootstrap path returns 201 when role map is empty
Existing admin-only assignment remains protected	✅ Non-admin callers get 403 once roles already exist
RBAC middleware is no longer dead weight	✅ requireAuth/requireRole/identifyUser are wired to protected endpoints

Closes #524

[drips-wave]

@Imran2210 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits