[Security] Feature flags admin endpoint lacks role-based authorization

[RUKAYAT-CODER]

Overview

src/app/api/admin/feature-flags/route.ts handles GET and POST requests for managing feature flags but does not check whether the requester has an ADMIN role. Any authenticated user (including students) can create, read, and modify feature flags, potentially enabling or disabling functionality across the platform.

Specifications

Features:

• Feature flag management requires ADMIN role
• Non-admin authenticated requests return HTTP 403

Tasks:

• Add requireAuth() at the top of both GET and POST handlers
• Add if (!hasPermission(user, 'ADMIN')) return forbidden() after authentication
• Write tests covering student and instructor role attempts returning 403

Impacted Files:

• src/app/api/admin/feature-flags/route.ts
• src/app/api/admin/feature-flags/[id]/route.ts
• src/lib/authMiddleware.ts

Acceptance Criteria

• GET and POST requests without ADMIN role return HTTP 403
• Admin-role requests succeed
• Audit log records the actor for all flag mutations

[Ivenkili]

@Ivenkili has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hey maintainer,
I would love to work on this issue kindly assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Ivenkili to this issue.

[Muhamadmust]

@Muhamadmust has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi maintainer
I gave reviewed this issue and would love to work on it, PR 1day

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Muhamadmust to this issue.

[lekanay2005-coder]

@lekanay2005-coder has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

pls i will like

ℹ️ Repo Maintainers: To accept this application, review their application or assign @lekanay2005-coder to this issue.

[drips-wave]

Congratulations, @Muhamadmust! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @Muhamadmust: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊