User Management
Relevant source files
The following files were used as context for generating this wiki page:
The User Management system in the Outmanage API provides a robust framework for handling user identities, authentication, and Role-Based Access Control (RBAC). It encompasses user lifecycle operations, integration with warehouse assignments, and comprehensive audit logging to track administrative changes.
This module serves as the foundation for security, ensuring that logistics operations such as weighing and shipment management are performed by authorized personnel with appropriate permissions.
Sources: CLAUDE.md:31-33, comprehensive-swagger-api.json:11-14
Architecture and Data Flow
The system follows a controller-service-repository pattern using Express.js and Prisma ORM. Requests are validated via Joi schemas before processing through the service layer, which interacts with the MySQL database.
System Components
- Controllers: Handle HTTP request parsing, input validation using Joi, and structured response generation.
- Services: Contain business logic, including password hashing, transaction management, and logging triggers.
- Prisma/Database: Manages data persistence and relationships between users, roles, and warehouses.
- Audit Logging: A dedicated service that captures snapshots of data before and after updates.
Sources: src/controllers/userController.ts:1-20, src/services/userService.ts:7-10, CLAUDE.md:38-41
User-Role-Warehouse Relationship
Users are linked to exactly one Role for permissions and can optionally be assigned to a specific Warehouse to restrict their operational scope.
User Lifecycle Management
Registration and Creation
User creation requires an email, name, password, and roleId. Passwords are hashed before storage using bcrypt. The system enforces email uniqueness and validates foreign key constraints for roles and warehouses.
Sources: src/controllers/userController.ts:98-124, src/services/userService.ts:113-138
Soft Deletion and Archiving
The system implements soft deletion by setting a deletedAt timestamp instead of removing records. This allows for data recovery (unarchiving) and maintains referential integrity for historical audit logs.
Sources: src/services/userService.ts:258-292, src/controllers/userController.ts:241-267
| Feature | Description | Implementation |
|---|---|---|
| Active Users | Users where deletedAt is NULL | prisma.user.findMany({ where: { deletedAt: null } }) |
| Archived Users | Users with a deletedAt timestamp | prisma.user.findMany({ where: { deletedAt: { not: null } } }) |
| Restoration | Reverting a soft delete | Sets deletedAt back to NULL |
| Sources: src/services/userService.ts:18-20, src/services/userService.ts:77-80, src/services/userService.ts:227-230 |
RBAC and Permissions
Permissions are defined as a combination of a resource (e.g., shipment, warehouse) and an action (e.g., CREATE, WEIGH, VERIFY_PLATE).
Role Configuration
A role acts as a container for these permissions. The default seed data creates a "Pemilik" (Owner) role with full access to all resources.
Sources: prisma/seed.ts:31-35, prisma/seed.ts:149-160
Security Schema
| Endpoint | Method | Permission Required | Description |
|---|---|---|---|
/api/users | GET | user:READ | List all active users |
/api/users | POST | user:CREATE | Register a new user |
/api/users/{id} | PUT | user:UPDATE | Update user profile/role |
/api/users/{id} | DELETE | user:DELETE | Soft delete a user |
/api/users/archived | GET | user:READ_ARCHIVED | View deleted users |
| Sources: comprehensive-swagger-api.json:444-460, comprehensive-swagger-api.json:1095-1100, prisma/seed.ts:60-70 |
Audit Logging System
Every significant change to a user record is recorded in userLog. This includes:
- Creation: Records who created the user.
- Updates: Captures a diff between
oldDataandnewData. - Deletion/Restoration: Tracks who archived or restored the account.
Sources: src/services/userService.ts:133, src/services/userService.ts:205-212, src/services/userService.ts:253
Integration with Warehouses
Users can be assigned to warehouses to define their operational context.
- When a user is assigned to a warehouse, the
warehouseIdis updated in the User table. - A warehouse cannot be deleted if it is still assigned to active users.
- Role deletion is blocked if the role is currently assigned to active users to prevent orphaned permissions.
Sources: src/controllers/warehouseController.ts:246-253, src/services/roleService.ts:109-115, src/controllers/userController.ts:114-124
Summary
User Management in Outmanage provides a secure and traceable environment for logistics operations. By combining soft deletion, granular RBAC permissions, and automated audit logging, the system ensures that all administrative actions are validated and documented. The multi-layered validation (Joi schema at the controller and Prisma constraints at the database) provides defense-in-depth against invalid data entry.
Sources: CLAUDE.md:31-33, src/controllers/userController.ts:128-150