# F-154 — Documentation

## Summary
Separated storefront customers from internal/backoffice users in the admin panel.

## API behavior change
- `GET /users` (admin): now returns **storefront customers only** (`identity_users.role = 'customer'`).
  Previously returned all users. Used by the Customers page (`/api/users`).
- `GET /admin/users` (admin): now returns **internal/backoffice users only** (`role <> 'customer'`),
  narrowed by optional `?role=admin|editor`. Previously returned all users when no `?role=`.
  `?role=customer` returns an empty list (never leaks customers). Used by the Users page (`/api/admin/users`).
- No change to `GET /users/:id`, `PATCH /users/:id`, `/users/:id/addresses*`, or `/admin/users/:id`.
  Response shapes unchanged (`CustomerSummary` and admin user list both include `id, email, role, createdAt`).

## Frontend
- Users page: removed the "Customer" option from the role filter dropdown (backend already
  enforces internal-only; the page lists `/admin/users` staff). Customers page unchanged.

## Notes
- No migration (`identity_users.role` already exists).
- The role filter is a code constant (SQL literal), not user input — no injection surface.