Spike: Define a role/admin model for privileged endpoints

[meshackyaro]

Description

Several endpoints across the backend are documented or clearly intended to be privileged but have no actual role enforcement today, because no role/admin concept exists anywhere in the auth layer: UserProfileController.verifyUser() (src/user-profile/user-profile.controller.ts) is doc'd 'Admin only' but only requires JwtAuthGuard; MigrationController (src/migration/migration.controller.ts) lets any authenticated user trigger/roll back schema migrations; DisputeSagaController.assignJurors() (src/dispute/dispute-saga.controller.ts) lets any authenticated user assign arbitrary juror addresses to a dispute. JwtPayload (src/auth/jwt.strategy.ts) currently carries only { address, sub, iat, exp } — no role/permission claim at all. This spike should scope the actual design: where do roles live (issued in the JWT at login time vs. looked up server-side per request), what roles exist (e.g. admin, juror-pool-manager), and how does it interact with the wallet-signature auth flow in AuthService.

Component

Backend

Difficulty

Spike

Tasks

• Survey every endpoint in the codebase that is documented as privileged or that mutates cross-user state without an obvious ownership check
• Evaluate at least two design options (JWT-embedded role claim vs. server-side role lookup keyed by wallet address) with tradeoffs for revocation, auditability, and implementation cost
• Produce a short design doc/recommendation and file follow-up implementation issues for the endpoints identified

Acceptance Criteria

• A written recommendation exists covering: where roles are stored, how they're assigned/revoked, and which existing endpoints need to adopt the new guard
• Follow-up issues are filed for at least verifyUser, migration execution, and juror assignment

Estimated Time

2-3 days