feat: RBAC for the admin-api

[k9ert]

Problem

The admin panel only have an all or nothing authorisation concept. We need a more sophisticated authorisation.

Solution

On the admin-API, we group all the endpoints to specific access-rights. We have:

• VIEW_ACCOUNTS
• VIEW_MERCHANTS
• LOCK_ACCOUNT
• APPROVE_MERCHANT
• CHANGECONTACTS_ACCOUNT
• CHANGELEVEL_ACCOUNT
• DELETE_ACCOUNTS
• VIEW_TRANSACTIONS
• SEND_NOTIFICATIONS
• SYSTEM_CONFIG

If a request wants to call any of the endpoints (which need auth), that token need to have the corresponding access-right in its token.scope.

How do we achieve that?

We'll configure a ROLE_USER_MAPPING env var for the admin-panel which maps user to roles. Basic roles are for now:

• ADMIN : can do everything
• SUPPORTLV2 : advanced support operations (includes all SUPPORTLV1 + contact changes)
• SUPPORTLV1 : basic support operations (view accounts/merchants, lock accounts, level_changes, approve merchants)
• MARKETING : can send notifications only
• VIEWER: can only view accounts and transactions

One user can have many roles.

The admin-panel then maps those roles to a list of access-rights like this:

Role Hierarchy:

• VIEWER: VIEW_ACCOUNTS, VIEW_TRANSACTIONS, VIEW_MERCHANTS
• MARKETING: SEND_NOTIFICATIONS
• SUPPORTLV1: VIEW_ACCOUNTS, VIEW_TRANSACTIONS, VIEW_MERCHANTS, LOCK_ACCOUNT, APPROVE_MERCHANT,CHANGELEVEL_ACCOUNT
• SUPPORTLV2: All SUPPORTLV1 rights + CHANGECONTACTS_ACCOUNT,
• ADMIN: All permissions including DELETE_ACCOUNTS, SYSTEM_CONFIG

Here is a table:

Access Right	VIEWER	MARKETING	SUPPORTLV1	SUPPORTLV2	ADMIN
VIEW_ACCOUNTS	✅	❌	✅	✅	✅
VIEW_TRANSACTIONS	✅	❌	✅	✅	✅
VIEW_MERCHANTS	✅	❌	✅	✅	✅
LOCK_ACCOUNT	❌	❌	✅	✅	✅
APPROVE_MERCHANT	❌	❌	✅	✅	✅
CHANGECONTACTS_ACCOUNT	❌	❌	❌	✅	✅
CHANGELEVEL_ACCOUNT	❌	❌	✅	✅	✅
SEND_NOTIFICATIONS	❌	✅	❌	❌	✅
DELETE_ACCOUNTS	❌	❌	❌	❌	✅
SYSTEM_CONFIG	❌	❌	❌	❌	✅

Legend:

• ✅ = Permission granted
• ❌ = Permission denied

This list is then attached to the token.scope (as stringified JSON).

[openoms]

Looks good as discussed.

[dolcalmi]

did you test with unkown?

[k9ert]

Doesn't seem so as this was a seemless change!
Update: seems to have broken the build. A local pnpm tsc suceeds but the GithubAction does not.

[k9ert]

See here what the issue exactly is:
https://github.com/blinkbitcoin/blink/actions/runs/18918407319/job/54007782495#step:7:439

[dolcalmi]

same here