22 lines
1.2 KiB
Markdown
22 lines
1.2 KiB
Markdown
# F-154 — Documentation
|
|
|
|
## Summary
|
|
Separated storefront customers from internal/backoffice users in the admin panel.
|
|
|
|
## API behavior change
|
|
- `GET /users` (admin): now returns **storefront customers only** (`identity_users.role = 'customer'`).
|
|
Previously returned all users. Used by the Customers page (`/api/users`).
|
|
- `GET /admin/users` (admin): now returns **internal/backoffice users only** (`role <> 'customer'`),
|
|
narrowed by optional `?role=admin|editor`. Previously returned all users when no `?role=`.
|
|
`?role=customer` returns an empty list (never leaks customers). Used by the Users page (`/api/admin/users`).
|
|
- No change to `GET /users/:id`, `PATCH /users/:id`, `/users/:id/addresses*`, or `/admin/users/:id`.
|
|
Response shapes unchanged (`CustomerSummary` and admin user list both include `id, email, role, createdAt`).
|
|
|
|
## Frontend
|
|
- Users page: removed the "Customer" option from the role filter dropdown (backend already
|
|
enforces internal-only; the page lists `/admin/users` staff). Customers page unchanged.
|
|
|
|
## Notes
|
|
- No migration (`identity_users.role` already exists).
|
|
- The role filter is a code constant (SQL literal), not user input — no injection surface.
|