Feature/Project Proposal
Refactor the application into a decoupled 3-tier architecture (Router -> Controller -> Service) and implement granular Role-Based Access Control (RBAC).
Problem Statement
PrepPilot currently has monolithic controllers handling both business logic and HTTP request formatting. Furthermore, there is no granular Role-Based Access Control (RBAC) architecture to safely manage administrative actions (e.g., curating question banks, managing sheets), posing a security risk as the platform scales.
Proposed Solution
- Extract core business logic from controllers into dedicated
services/ (e.g., questionService.js), making logic testable and reusable.
- Update
models/User.js to support an array of roles (enum: ['user', 'moderator', 'admin']).
- Develop a generic
rbacMiddleware.js that intercepts requests, checks the JWT payload for role permissions, and dynamically blocks unauthorized access to specific routes.
- Apply RBAC to all sensitive endpoints in
questionRoutes and resumeRoutes.
Alternatives Considered
We could just add an isAdmin boolean to the User model, but a dedicated Role-Based approach allows for granular scaling like adding moderators, content-editors, etc., without altering the DB schema repeatedly.
Benefits
Massively improves code maintainability and testability, while preventing privilege escalation attacks and securing administrative functionalities.
Priority
High
Additional Context
N/A
Checklist
Feature/Project Proposal
Refactor the application into a decoupled 3-tier architecture (Router -> Controller -> Service) and implement granular Role-Based Access Control (RBAC).
Problem Statement
PrepPilot currently has monolithic controllers handling both business logic and HTTP request formatting. Furthermore, there is no granular Role-Based Access Control (RBAC) architecture to safely manage administrative actions (e.g., curating question banks, managing sheets), posing a security risk as the platform scales.
Proposed Solution
services/(e.g.,questionService.js), making logic testable and reusable.models/User.jsto support an array of roles (enum: ['user', 'moderator', 'admin']).rbacMiddleware.jsthat intercepts requests, checks the JWT payload for role permissions, and dynamically blocks unauthorized access to specific routes.questionRoutesandresumeRoutes.Alternatives Considered
We could just add an
isAdminboolean to the User model, but a dedicated Role-Based approach allows for granular scaling like adding moderators, content-editors, etc., without altering the DB schema repeatedly.Benefits
Massively improves code maintainability and testability, while preventing privilege escalation attacks and securing administrative functionalities.
Priority
High
Additional Context
N/A
Checklist