Files

rikrdo 546971280f feat(F-006): users profile, addresses and RBAC

- users module: profile + address CRUD behind use cases (users_profiles,
  users_addresses)
- roles customer/admin on identity_users; role resolved from DB per request
- shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin)
  injected from composition root; users never imports identity
- authorization runs before existence checks; address SQL scoped by user_id
- @fastify/cookie registered once at app root (cross-module)
- migrations 003_identity_roles + 004_users (reversible)
- no new npm dependencies; tests: unit 52, integration 22

Gates: reviewer/security/qa APPROVED; verify.sh green

2026-08-15 09:28:15 +02:00

1.2 KiB

Raw Blame History

SPEC — F-006 Users: profile, addresses, RBAC

Problem

Authenticated users need profile data, addresses, and clear roles.

Goal

Users module with profile + address CRUD behind use cases, and customer/admin roles enforced by an RBAC guard on the API layer. The server decides ownership and role — the frontend is never trusted.

Scope IN

src/modules/users (hexagonal) owning users_profiles + users_addresses
Profile + address CRUD behind use cases
Roles customer/admin; role column on identity_users
Session authenticator exported by identity, injected into users by the composition root
Owner-or-admin authorization; admin-only list endpoint

Scope OUT

No fine-grained permissions (only role + ownership)
No admin UI
No profile auto-creation at register (profiles are created on demand)

Acceptance criteria

Given user A When A requests user B profile Then HTTP 403.
Given customer role When admin-only endpoint called Then HTTP 403.
Given admin role When admin-only endpoint called Then HTTP 200.
Address CRUD works end to end for own addresses.
./scripts/verify.sh green.

Dependencies added

None. Reuses pg, zod, @fastify/cookie.

1.2 KiB Raw Blame History