# TASKS — F-006 Users: profile, addresses, RBAC

- [ ] TASK-001 migrations: 003_identity_roles.js (role column) + 004_users.js (profiles + addresses), reversible
- [ ] TASK-002 shared/auth.ts: Role, CurrentUser, Authenticate, requireRole
- [ ] TASK-003 identity: session-authenticator (cookie -> CurrentUser) + export from index + role in login response
- [ ] TASK-004 users domain: profile.ts, address.ts, errors.ts, ports.ts
- [ ] TASK-005 users application: profile get/update/list + address list/create/update/delete (owner-or-admin checks)
- [ ] TASK-006 users infrastructure: pg repos (parameterized)
- [ ] TASK-007 users api: users.routes.ts (parseJson, error mapping)
- [ ] TASK-008 users index.ts public API
- [ ] TASK-009 build-app wiring: authenticate injection
- [ ] TASK-010 unit tests (module-scoped)
- [ ] TASK-011 integration tests (app-scoped itest, AC1-AC4)
- [ ] TASK-012 lint + boundaries + typecheck + build + test + test:integration + verify.sh