# SPEC — F-006 Users: profile, addresses, RBAC

## Problem
Authenticated users need profile data, addresses, and clear roles.

## Goal
Users module with profile + address CRUD behind use cases, and customer/admin roles
enforced by an RBAC guard on the API layer. The server decides ownership and role —
the frontend is never trusted.

## Scope IN
- `src/modules/users` (hexagonal) owning `users_profiles` + `users_addresses`
- Profile + address CRUD behind use cases
- Roles customer/admin; `role` column on `identity_users`
- Session authenticator exported by identity, injected into users by the composition root
- Owner-or-admin authorization; admin-only list endpoint

## Scope OUT
- No fine-grained permissions (only role + ownership)
- No admin UI
- No profile auto-creation at register (profiles are created on demand)

## Acceptance criteria
1. Given user A When A requests user B profile Then HTTP 403.
2. Given customer role When admin-only endpoint called Then HTTP 403.
3. Given admin role When admin-only endpoint called Then HTTP 200.
4. Address CRUD works end to end for own addresses.
5. `./scripts/verify.sh` green.

## Dependencies added
- None. Reuses pg, zod, @fastify/cookie.