critical: admin audit-log endpoints have no role gate — any authenticated wallet can read full audit trail

[EmeditWeb]

Problem

AuditController (src/modules/admin/audit.controller.ts) is protected by @UseGuards(JwtAuthGuard) only (line 12). There is no RolesGuard, no role decorator, and no admin allowlist anywhere on the /admin controller. The JwtAuthGuard (src/common/guards/jwt-auth.guard.ts) merely validates the JWT signature and returns { wallet } — it performs zero authorization.

Consequence: any user who completes wallet sign-in once can call GET /admin/audit-logs and read the entire immutable audit trail: every actor wallet, every action, every resource touched across the platform. Audit logs exist precisely to record sensitive administrative activity; exposing them to all authenticated users is both an information-disclosure incident and a reconnaissance goldmine for attackers mapping internal actions before escalating.

The same gap applies to anything else mounted under src/modules/admin — the guard is on the class, not the capability.

Ground Rules

This issue must be solved according to StepFi's established engineering standards. Before writing any code:

1. Read context/architecture-context.md in full
2. Read context/code-standards.md in full
3. Read context/progress-tracker.md to understand what has already been built and why, so you do not duplicate or contradict recent work
4. Read src/modules/auth/auth.service.ts (generateTokens, lines 160–184) to understand how the role claim enters the JWT
5. Read src/auth/guards/roles.guard.ts and src/common/guards/jwt-auth.guard.ts

Your PR will be rejected regardless of whether CI passes if it conflicts with anything in these files or introduces patterns inconsistent with what already exists.

What To Build

1. Create an AdminGuard that authorizes against the server-side user record (fetch role/status fresh from Supabase by req.user.wallet) rather than trusting the JWT role claim alone — tokens minted before a role grant/revoke stay valid until refresh.
2. Apply it to the entire /admin controller tree.
3. Deny by default: users whose role is not explicitly admin (and status !== 'blocked') receive ForbiddenException with a structured code such as ADMIN_FORBIDDEN.
4. Log denied attempts through the existing audit interceptor so brute-force probing is visible.
5. Tests: non-admin wallet gets 403; admin wallet gets 200; blocked admin gets 401/403; unauthenticated gets 401; stale-token-with-role-claim-but-revoked-user gets 403.

Files To Touch

• src/modules/admin/admin.module.ts
• new src/modules/admin/admin.guard.ts
• src/modules/admin/audit.controller.ts
• test files under the repo's established test layout
• context/progress-tracker.md equivalent documentation if present in this repo's docs

Acceptance Criteria

• No /admin/* route is reachable without explicit server-side admin authorization
• Authorization does not rely solely on JWT claims
• Denied attempts are auditable
• All existing tests still pass; new tests cover every rejection branch

Mandatory Checks Before Opening PR

• Code follows existing NestJS conventions in this repo exactly
• Build passes (npm run build) and lint passes
• New tests written; suite green
• PR template filled out completely
• PR references this issue number exactly

PRs that fail any check above will be closed without review. This is a Grantfox-funded, quality-first project.

[bobo-24]

Hi! I came across this issue and would love to work on it. I have experience with similar tasks and I'm confident I can investigate, implement a clean solution, and thoroughly test it before submitting a PR. If the issue is still open, I would appreciate it if you could assign it to me. I’ll prioritize this immediately and ensure a reliable solution is delivered as soon as possible. Thank you!

[bobo-24]

Hi! I came across this issue and would love to work on it. I have experience with similar tasks and I'm confident I can investigate, implement a clean solution, and thoroughly test it before submitting a PR. If the issue is still open, I would appreciate it if you could assign it to me. I’ll prioritize this immediately and ensure a reliable solution is delivered as soon as possible. Thank you!

[Jumongweb]

Hi maintainer, i will like to solve this issue

[Marvelg256]

Hi! I'd like to work on this issue. I've reviewed the requirements and believe I have a good understanding of what's needed. I'm confident I can implement a clean solution, test it thoroughly, and submit a PR within 48 hours. If assigned, I'll keep the issue updated with my progress.

[grantfox-oss]

🦊 GrantFox — @Jumongweb has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #115)
2. Your PR will be reviewed by the StepFi-app maintainers

Good luck! Track your progress on GrantFox.