546971280f
- users module: profile + address CRUD behind use cases (users_profiles, users_addresses) - roles customer/admin on identity_users; role resolved from DB per request - shared auth contract (Authenticate, requireRole, requireOwnerOrAdmin) injected from composition root; users never imports identity - authorization runs before existence checks; address SQL scoped by user_id - @fastify/cookie registered once at app root (cross-module) - migrations 003_identity_roles + 004_users (reversible) - no new npm dependencies; tests: unit 52, integration 22 Gates: reviewer/security/qa APPROVED; verify.sh green
32 lines
1.2 KiB
Markdown
32 lines
1.2 KiB
Markdown
# SPEC — F-006 Users: profile, addresses, RBAC
|
|
|
|
## Problem
|
|
Authenticated users need profile data, addresses, and clear roles.
|
|
|
|
## Goal
|
|
Users module with profile + address CRUD behind use cases, and customer/admin roles
|
|
enforced by an RBAC guard on the API layer. The server decides ownership and role —
|
|
the frontend is never trusted.
|
|
|
|
## Scope IN
|
|
- `src/modules/users` (hexagonal) owning `users_profiles` + `users_addresses`
|
|
- Profile + address CRUD behind use cases
|
|
- Roles customer/admin; `role` column on `identity_users`
|
|
- Session authenticator exported by identity, injected into users by the composition root
|
|
- Owner-or-admin authorization; admin-only list endpoint
|
|
|
|
## Scope OUT
|
|
- No fine-grained permissions (only role + ownership)
|
|
- No admin UI
|
|
- No profile auto-creation at register (profiles are created on demand)
|
|
|
|
## Acceptance criteria
|
|
1. Given user A When A requests user B profile Then HTTP 403.
|
|
2. Given customer role When admin-only endpoint called Then HTTP 403.
|
|
3. Given admin role When admin-only endpoint called Then HTTP 200.
|
|
4. Address CRUD works end to end for own addresses.
|
|
5. `./scripts/verify.sh` green.
|
|
|
|
## Dependencies added
|
|
- None. Reuses pg, zod, @fastify/cookie.
|