SecureBananaLabs/bug-bounty: Admin routes lack role-based access control — any authenticated user can access admin endpoints

The gap in what exists

The gap is the immediate, well-defined security vulnerability in the existing codebase that requires a specific code fix.

Wedge to win

Deliver a precise, tested code fix that addresses the bounty's requirements directly and efficiently.

Reputation value (worth doing free for proof) — 50/100

Successfully solving a bug bounty issue for a public project builds credibility for security-conscious development work and rapid problem-solving.

Likely monetization

fixed-price bounty

You are an expert full-stack Node.js developer. I need you to implement a fix for a bug bounty issue in the `SecureBananaLabs/bug-bounty` repository. The issue is that the `/api/admin` routes lack role-based access control, allowing any authenticated user to access them. Your task is to implement an `adminMiddleware` that checks if `req.user.role === "admin"` and applies it to the admin routes. Use standard Node.js/Express.js practices.

Here's the plan:
1.  **Fork the repository**: Ensure you have a local clone of `SecureBananaLabs/bug-bounty`.
2.  **Locate `adminRoutes.js`**: The file is `apps/api/src/routes/adminRoutes.js`.
3.  **Create `adminMiddleware`**: Create a new middleware function, potentially in a new file like `apps/api/src/middlewares/adminMiddleware.js`. This middleware should:
    *   Check `req.user` for a `role` property.
    *   If `req.user.role !== 'admin'`, send a 403 Forbidden response.
    *   Otherwise, call `next()`.
4.  **Integrate middleware**: In `adminRoutes.js`, import `adminMiddleware` and insert it into the route handler chain for `/api/admin` routes, ensuring it runs *after* `authMiddleware`.
    ```javascript
    // Example of integration
    const authMiddleware = require('../../middlewares/authMiddleware'); // Assuming path
    const adminMiddleware = require('../../middlewares/adminMiddleware'); // New middleware

    adminRoutes.use(authMiddleware);
    adminRoutes.use(adminMiddleware); // Apply after authMiddleware
    adminRoutes.get('/metrics', metrics);
    ```
5.  **Develop unit tests**: Create a test file (e.g., `apps/api/src/routes/adminRoutes.test.js` or similar if tests exist) that specifically tests this new middleware. 
    *   Test cases should include: an admin user accessing an admin route (should pass) and a non-admin authenticated user accessing an admin route (should return 403).
    *   Use `jest` or `mocha` if already configured in the project; otherwise, suggest a simple testing approach using `supertest` for API endpoints.
6.  **Verify**: Confirm the new middleware correctly blocks non-admin users from admin routes while allowing admin users. Provide the new middleware code, the modified `adminRoutes.js`, and the test code. Explain how to run the tests and verify the fix.