SPEC — F-006 Users: profile, addresses, RBAC

Problem

Authenticated users need profile data, addresses, and clear roles.

Goal

Users module with profile + address CRUD behind use cases, and customer/admin roles enforced by an RBAC guard on the API layer. The server decides ownership and role — the frontend is never trusted.

Scope IN

src/modules/users (hexagonal) owning users_profiles + users_addresses
Profile + address CRUD behind use cases
Roles customer/admin; role column on identity_users
Session authenticator exported by identity, injected into users by the composition root
Owner-or-admin authorization; admin-only list endpoint

Scope OUT

No fine-grained permissions (only role + ownership)
No admin UI
No profile auto-creation at register (profiles are created on demand)

Acceptance criteria

Given user A When A requests user B profile Then HTTP 403.
Given customer role When admin-only endpoint called Then HTTP 403.
Given admin role When admin-only endpoint called Then HTTP 200.
Address CRUD works end to end for own addresses.
./scripts/verify.sh green.

Dependencies added

None. Reuses pg, zod, @fastify/cookie.

1.2 KiB Raw Blame History