Web: Role-Based Access Control (RBAC) Migration to Zanzibar Model

[wagmiiii]

Repo context. accensa-app is the off-chain half of Accensa — the merchant back-office for x402 sellers on Stellar. Three workspace packages matter: apps/web (Next.js dashboard and the indexer at src/app/api/sync), packages/sdk (@accensa/sdk), and apps/demo-merchant. The Soroban contracts live in accensa-contracts.

🟢 Unblocked. Independent backend architecture change.

Problem

The current RBAC implementation in apps/web is hardcoded and inflexible, preventing enterprise merchants from creating custom roles. We need a massively scalable authorization architecture.

What to build

Replace the legacy permissions system with a Google Zanzibar-inspired centralized authorization service (e.g., Authzed/SpiceDB). Implement fine-grained permission checks at the edge and in all Next.js API routes.

Acceptance criteria

• SpiceDB cluster deployed and integrated.
• All API routes protected with fine-grained authorization checks.
• UI for merchants to define custom roles and permissions.

Contact & Support

• Telegram
• Discord
• SUPPORT.md — contribution help, Wave process, and the full list of channels

[Meemlahsabi]

@Meemlahsabi has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi Maintainer, I’m eager to contribute to this project by resolving this issue. Kindly assign it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Meemlahsabi to this issue.

[matteorossi-codes]

@matteorossi-codes has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, kindly assign me this issue please

ℹ️ Repo Maintainers: To accept this application, review their application or assign @matteorossi-codes to this issue.

[drips-wave]

Congratulations, @matteorossi-codes! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @matteorossi-codes: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊