feat: implement role based access control rbac

[vtotalova]

Description

Implements role-based access control (RBAC) across the full stack. Introduces an ADMIN role stored in the database, enforced on the backend via Spring Security, and surfaced in the frontend through protected routes and a dedicated Admin Panel with four sections: Moderation, Import, Roles, and Export.

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📝 Documentation update
• 🎨 Style/formatting changes (no functional changes)
• ♻️ Code refactoring (no functional changes)
• ⚡ Performance improvements
• 🔧 Configuration changes
• 🧪 Test additions or modifications
• 🚀 Deployment/DevOps changes

Related Issues

• Fixes feat: implement role-based access control (RBAC) #40
• Related to security: implement secure authentication flows #36

Changes Made

• Client:

  • Added AdminRoute component — redirects non-admins away from /admin/*
  • Added Admin Panel at /admin with four sections: Moderation, Import, Roles, Export
  • Moderation page: inline editing of competency/resource titles and descriptions, vote count and creation date displayed, search bar
  • Import page: bulk-import competencies from JSON or CSV file
  • Roles page: view all users (anonymous IDs only), toggle USER ↔ ADMIN role without exposing personal data
  • Export page: placeholder for future data export functionality
  • Navbar shows Admin link conditionally when role === 'ADMIN'
  • AuthContext fetches and stores the user's role from /api/auth/me on login

• Server:

  • DbRoleJwtAuthenticationConverter — resolves the user's role from the database on every authenticated request and injects it into Spring Security context
  • SecurityConfig — admin-only endpoints protected with hasRole('ADMIN')
  • AdminController — bulk competency import endpoints (JSON and CSV)
  • AuthController — fast-fail with 403 if email domain not in allowlist
  • MemoProperties — configurable allowed email domains

• Database:

  • V9__update_users_for_keycloak_auth.sql — extends user ID column to 36 chars for Keycloak UUIDs, adds role column defaulting to USER

Testing

Test Cases

• Existing functionality still works
• New functionality works as expected
• Edge cases handled appropriately

Manual Testing

• Tested in development environment
• Tested with different user roles/permissions (if applicable)
  • demo@memo.local (USER): no Admin link visible, /admin redirects to dashboard, admin API endpoints return 403
  • admin@memo.local (ADMIN): Admin link visible in navbar, all four admin sections accessible, role toggle and inline edits persist to the database

[github-actions]

🔍 Code Quality Report

📊 Code Statistics

🚨 Potential Issues

✅ No console statements found
⚠️ Found 'any' or 'unknown' types - consider using more specific types

[Copilot]

Pull request overview

Implements role-based access control (RBAC) end-to-end by introducing Keycloak-based authentication, backend role enforcement via Spring Security, and an admin UI (panel + protected routes) in the React client.

Changes:

• Add Keycloak auth bootstrap + AuthProvider, and protect app/admin routes based on authentication + DB-backed role.
• Add admin UI surface area (Admin Panel + Moderation/Import/Roles/Export pages) and supporting client APIs.
• Enforce admin-only backend endpoints and add admin competency bulk-import endpoints + allowed email-domain gating.

Reviewed changes

Copilot reviewed 42 out of 43 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
src/pages/SessionPage.tsx	Switch to /api/auth/me user lookup
src/pages/RolesPage.tsx	New roles management UI
src/pages/OnboardingPage.tsx	Integrate auth state + domain denial UX
src/pages/ModerationPage.tsx	New moderation UI w/ inline edits
src/pages/ImportPage.tsx	New admin import UI (JSON/CSV)
src/pages/HomePage.tsx	Start CTA now uses auth-aware navigation
src/pages/ExportPage.tsx	New export placeholder page
src/pages/DashboardPage.tsx	Load stats using authenticated userId
src/pages/AdminPage.tsx	New admin landing panel
src/lib/auth/keycloak.ts	Keycloak client config + init
src/lib/api/types.ts	Add degree + import result types
src/lib/api/session-helpers.ts	Add getCurrentUserAction() via /api/auth/me
src/lib/api/client.ts	Attach Keycloak bearer token via interceptor
src/lib/api/admin.ts	Add admin import API client
src/index.css	Expand exposed CSS variables
src/contexts/useAuth.ts	New useAuth() hook wrapper
src/contexts/AuthContext.tsx	New auth provider/state sync
src/contexts/auth-context.ts	Define auth context types
src/components/ProtectedRoute.tsx	Require auth + handle domain denial
src/components/navbar.tsx	Show sign-in/out + conditional Admin link
src/components/AdminRoute.tsx	Admin-only route guard
src/App.tsx	Wire AuthProvider + protected/admin routes
server/src/main/resources/db/migration/V9__update_users_for_keycloak_auth.sql	DB changes for Keycloak UUID subjects
server/src/main/resources/application.yml	Configure OAuth2 resource server + uploads + allowlist
server/src/main/java/de/tum/cit/memo/service/UserService.java	Find-or-create user by subject
server/src/main/java/de/tum/cit/memo/service/CompetencyService.java	Bulk competency import service
server/src/main/java/de/tum/cit/memo/security/SecurityConfig.java	Enforce RBAC + resource server JWT
server/src/main/java/de/tum/cit/memo/security/DbRoleJwtAuthenticationConverter.java	Load role from DB into authorities
server/src/main/java/de/tum/cit/memo/repository/CompetencyRepository.java	Add existsByTitle
server/src/main/java/de/tum/cit/memo/MemoApiApplication.java	Enable configuration properties scan
server/src/main/java/de/tum/cit/memo/entity/User.java	Adjust user fields for Keycloak flow
server/src/main/java/de/tum/cit/memo/dto/ImportResult.java	Import result DTO
server/src/main/java/de/tum/cit/memo/dto/CompetencyImportRow.java	Import row DTO + validation
server/src/main/java/de/tum/cit/memo/controller/AuthController.java	/api/auth/me sync + domain allowlist
server/src/main/java/de/tum/cit/memo/controller/AdminController.java	Admin import endpoints (JSON/CSV/file)
server/src/main/java/de/tum/cit/memo/config/MemoProperties.java	Allowed email domains properties
server/docker/keycloak/memo-realm.json	Realm tweaks (email claim mapper, SMTP, etc.)
server/docker-compose.yml	Add Mailpit + Keycloak/server env updates
server/build.gradle	Add OAuth2 resource server dependency
public/silent-check-sso.html	Keycloak silent SSO support page
postcss.config.mjs	Remove redundant PostCSS config
auth-flow.svg	Document updated auth flow (diagram)
auth-flow.mmd	Document updated auth flow (source)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

🔍 Code Quality Report

📊 Code Statistics

🚨 Potential Issues

✅ No console statements found
⚠️ Found 'any' or 'unknown' types - consider using more specific types

[github-actions]

🔍 Code Quality Report

📊 Code Statistics

🚨 Potential Issues

✅ No console statements found
⚠️ Found 'any' or 'unknown' types - consider using more specific types

[github-actions]

🔍 Code Quality Report

📊 Code Statistics

🚨 Potential Issues

✅ No console statements found
⚠️ Found 'any' or 'unknown' types - consider using more specific types

[markstockhausen]

Looks good to me! Could you take a look at Copilot's suggestions and resolve the merge conflict?

[github-actions]

🔍 Code Quality Report

📊 Code Statistics

🚨 Potential Issues

✅ No console statements found
⚠️ Found 'any' or 'unknown' types - consider using more specific types

[github-actions]

🔍 Code Quality Report

📊 Code Statistics

🚨 Potential Issues

✅ No console statements found
⚠️ Found 'any' or 'unknown' types - consider using more specific types

[github-actions]

🔍 Code Quality Report

📊 Code Statistics

🚨 Potential Issues

✅ No console statements found
⚠️ Found 'any' or 'unknown' types - consider using more specific types