Missing role-based access control (RBAC) enforcement

[chonilius]

Problem

The README states that role-based authorization guards are not yet implemented:

Add role-based authorization guards (currently JWT-authenticated but not role-scoped) to maintainer/sponsor-only endpoints.

Impact

Currently, any authenticated user can access admin-only endpoints like:

• Bounty approval/rejection
• Milestone budget allocation
• Escrow release/refund operations
• Maintenance pool fund assignment

Solution

Implement NestJS guards to enforce role checks:

@UseGuards(RolesGuard)
@Roles('maintainer')
@Post('bounties/:id/approve')
async approveBounty() { ... }

Priority

High - Critical for production security

[Akinloluwa20]

@Akinloluwa20 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I would love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Akinloluwa20 to this issue.

[nasirudeenbadirudeen87-cloud]

@nasirudeenbadirudeen87-cloud has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi Maintainer, reviewed the issue in detail. Full stack background with solid experience relevant to this task. No blockers on my end — I'm ready to submit a PR shortly. Please assign.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @nasirudeenbadirudeen87-cloud to this issue.

[TheFaith-Code]

@TheFaith-Code has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, I'd like to work on this issue.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @TheFaith-Code to this issue.

[D-Bluemoon]

@D-Bluemoon has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hey maintainer, I’d love to take ownership of this RBAC implementation. Leaving critical operations like escrow releases and budget allocations open to any authenticated user is a massive security risk, so I completely understand the high priority here.

I'm very comfortable working with NestJS and can quickly implement the RolesGuard and custom decorators (like @Roles()) to properly scope the existing JWT authentication for those maintainer and sponsor endpoints. I'll also make sure to write robust tests to guarantee the access control is locked down tight. Let me know if I can jump on this!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @D-Bluemoon to this issue.

[drips-wave]

Congratulations, @D-Bluemoon! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @D-Bluemoon: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox!

@D-Bluemoon's PR #248 was approved and merged by @chonilius.

🏆 @D-Bluemoon: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (704 total points). Track your full progress on GrantFox.

👏 Great work, @D-Bluemoon! Keep contributing to MergeFi.