Fix: Guard Profiles page failing to load (403 errors) — FE 001

[josephmoorman]

Root cause

Employers got 403s ("Insufficient role" → "Insufficient permissions") loading Guard Profiles. Root cause was a data issue, not a code bug: the seeded employer Role doc in MongoDB was missing user:read. The RBAC logic was working correctly just with incomplete data.

The fix

• Added "user:read" to the employer role in src/scripts/seedRoles.js.
• Ran the script to apply it.

⚠️ Merging this alone won't fix local DB. See action required below.*** ⚠️

Also fixed (not root cause)

• user.routes.js: /guards route referenced ROLES.EMPLOYEE, which doesn't exist (only EMPLOYER does) dead code, removed.
• rbac.js: getEffectivePermissions() let an empty DB permissions array silently override in-code defaults. Added a guard so defaults are used unless the DB array is non-empty.
• rbac.js: authorizeRoles() now normalizes case/whitespace on role checks (defensive only — ruled out as the cause here).

Action required

• Anyone with an existing local DB, run after pulling: docker exec -it secureshift-backend node -r dotenv/config ./src/scripts/seedRoles.js
• We might need to consider auto-running the seed script on backend startup.

Testing

Reproduced by removing user:read from the local employer doc → confirmed 403. Re-ran seed script → confirmed Guard Profiles loads end-to-end for an Employer account.