feat(ADM-018): completed feature

legacy/specs-old/F-006-users-rbac/SPEC.md

@@ -0,0 +1,31 @@
+# SPEC — F-006 Users: profile, addresses, RBAC
+
+## Problem
+Authenticated users need profile data, addresses, and clear roles.
+
+## Goal
+Users module with profile + address CRUD behind use cases, and customer/admin roles
+enforced by an RBAC guard on the API layer. The server decides ownership and role —
+the frontend is never trusted.
+
+## Scope IN
+- `src/modules/users` (hexagonal) owning `users_profiles` + `users_addresses`
+- Profile + address CRUD behind use cases
+- Roles customer/admin; `role` column on `identity_users`
+- Session authenticator exported by identity, injected into users by the composition root
+- Owner-or-admin authorization; admin-only list endpoint
+
+## Scope OUT
+- No fine-grained permissions (only role + ownership)
+- No admin UI
+- No profile auto-creation at register (profiles are created on demand)
+
+## Acceptance criteria
+1. Given user A When A requests user B profile Then HTTP 403.
+2. Given customer role When admin-only endpoint called Then HTTP 403.
+3. Given admin role When admin-only endpoint called Then HTTP 200.
+4. Address CRUD works end to end for own addresses.
+5. `./scripts/verify.sh` green.
+
+## Dependencies added
+- None. Reuses pg, zod, @fastify/cookie.