[Ticket] Role model & permissions (Admin/Mod/Registered/Guest + RSI-Verified badge) #112

🧾 Title

Role model & permissions

🧠 Summary

Define and enforce the MusterDeck account role ladder and the badge modifiers, from the 2026-06-09 IA spec. This is the prerequisite — it blocks #110 (Admin Portal) and #111 (Moderator page); do it first.

📦 Scope

• Five roles: Super Admin ▸ Admin ▸ Moderator ▸ Registered User ▸ Guest User
• Super Admin = Blair + Christoph only, HARD-CODED to the project (decision confirmed 2026-06-09 — not a flag anyone can be granted). Super Admin is the only tier that can assign/revoke Admin.
• Permission checks per role across the app (what each can see/do), server-enforced
• Badge modifiers (orthogonal to role, not access levels): ◆ RSI Verified (from RSI handle verification flow #12) + the three Patreon tiers Captain / Admiral / Praetorian (from Patreon supporter tiers + badges (Captain / Admiral / Praetorian)  #103)
• Data model + enforcement (likely Supabase RLS / policies)

🚫 Out of Scope

• The Admin Portal and Moderator page UIs (Admin Portal — moderation and system tooling  #110/Moderator role & page  #111 — they consume this)
• RSI handle verification flow itself (RSI handle verification flow #12) and Patreon integration (Patreon supporter tiers + badges (Captain / Admiral / Praetorian)  #103) — this only consumes their resulting state for badges

✅ Acceptance Criteria

• Five roles stored and assignable; default new accounts = Registered User; signed-out = Guest
• Permission checks enforced server-side (not just UI hiding)
• Badges derive from source state: RSI-Verified (RSI handle verification flow #12) + Patreon Captain/Admiral/Praetorian (Patreon supporter tiers + badges (Captain / Admiral / Praetorian)  #103)
• Super Admin is hard-coded to Blair + Christoph and is the only tier that can assign/revoke Admin
• Admins can manage moderators but cannot grant Admin or self-escalate

🧪 Testing / Validation

• Each role is limited to its permitted actions (server-enforced)
• A non-super-admin cannot grant themselves admin

🧰 Implementation Notes

Auth/permissions/RLS are higher-risk — Blair reviews before merge per the operating model.

🧰 Notes / Links

• Part of the Access, Roles & Admin epic. Blocks Admin Portal — moderation and system tooling  #110 and Moderator role & page  #111. Related: RSI handle verification flow #12 RSI handle verification, Patreon supporter tiers + badges (Captain / Admiral / Praetorian)  #103 Patreon badges.

✅ Addendum: Bugs Found/Fixed

⏳ Addendum: Pending

Part of #109