Implemented Incident Management API with RBAC and Attachment Support

[Arshdeep225615024]

Overview:-

Implemented the Incident Management module for the SecureShift project, enabling guards to report incidents, employers to view them, and admins to manage them with role-based access control.

Features Implemented:-

• Create incident (guard-only, assigned shift validation)
• Update incident (guard ownership enforced)
• Get single incident with role-based access
• List incidents with filtering (shift, severity, status, date range)
• Soft delete incident (admin-controlled)
• Upload attachments using Multer
• Download attachments securely
• RBAC integration using permission-based middleware

Role-Based Access Control:-

• Guards can create, view, and update their own incidents
• Employers can view incidents related to their shifts
• Admins can view, update, and soft-delete all incidents

Technical Details
Implemented RESTful APIs using Express.js
Used MongoDB with Mongoose for data modeling
Integrated JWT-based authentication
Applied RBAC using permission-based middleware (authorizePermissions)
Handled file uploads with Multer and local storage
Implemented soft delete using isDeleted flag

Testing
Tested all endpoints using Postman:
Guard workflow (apply → accept → create incident)
Employer workflow (create shift → approve guard → view incidents)
Admin permissions (update/delete)
Verified attachment upload and download functionality

[uppalkrish]

Please swagger documentations for your API's

[Arshdeep225615024]

Added swagger docs

[uppalkrish]

also share screenshot

[Arshdeep225615024]

[Arshdeep225615024]

[LoopyB]

Nice work on this - the incident flow, RBAC integration, and Swagger all look solid.

Just a couple of things to tighten before merge:

1. In updateIncident, it looks like guards can update fields like severity and status, and employers aren’t scoped to their own shifts here.
2. In uploadAttachment, I couldn’t see an ownership / employer check — so it might allow uploads to incidents outside the user’s scope.

Once those are tightened, this should be good to go 👍

[LoopyB]

This needs tighter field-level and role-level checks.

Right now guards appear able to update severity and status on their own incidents because both fields are included in allowedFields, and employers do not seem to be scoped here to incidents belonging to shifts they created.

Could we restrict:

• guards to their own incident + limited fields (for example description only), and
• employers to incidents on their own shifts before allowing update?

[LoopyB]

Can we add the same ownership / employer-scope checks here as well?

At the moment this checks that the incident exists, but I’m not seeing a guard ownership check or an employer “owns the related shift” check before the attachment is added. Since the route only requires incident:update, this looks like it could allow cross-incident uploads if someone has a valid incident ID.

[uppalkrish]

@Arshdeep225615024 when can you fix this?

[Arshdeep225615024]

I will finish this by tomorrow.

[Arshdeep225615024]

I have made the required changes, can you please check once?