System Enforces Role-Based Access Control on Proxy Registration Routes
Proxy and bulk registration routes are guarded at the Flutter navigation layer: only users with coordinator or admin roles can navigate to these screens. The Activity Delegation Service performs a secondary role check at the service layer before processing any proxy insert. At the database layer, Supabase RLS policies evaluate the acting user's role claim in the JWT before permitting inserts that specify a different user_id as the activity owner. All three enforcement points must pass for a submission to succeed, providing defense-in-depth against privilege escalation.
User Story
Acceptance Criteria
- Given a user with peer_mentor role is authenticated, when they attempt to navigate to the Proxy Registration Screen URL directly, then the navigation guard redirects them to the no-access screen
- Given a coordinator submits a proxy registration, when the Activity Delegation Service processes the request, then it verifies the acting user's role before invoking the insert — if the role check fails, the service returns an authorization error
- Given a coordinator's JWT contains a valid coordinator role claim, when the Supabase RLS policy evaluates the insert, then the policy permits the insert on behalf of the specified peer mentor user_id
- Given a user without coordinator role somehow bypasses the Flutter navigation layer, when the RLS policy evaluates the insert, then the insert is rejected at the database layer with a policy violation error
- Given the coordinator's session token expires mid-submission, when the proxy insert is attempted, then authentication is re-requested and the submission does not proceed with an invalid token
Business Value
Proxy registration allows one user to create activity records attributed to another user, which is a significant privilege that must be tightly controlled. Without multi-layer enforcement, a single bypass at the UI layer would allow any authenticated user to submit activities on behalf of others, corrupting the activity log, falsifying reporting data, and potentially enabling grant fraud. Defense-in-depth (navigation + service + RLS) ensures no single point of failure can compromise the integrity of delegated submissions.