Skip to content

IAM - User management

Purpose

Tenant administrators and team managers can manage member accounts within their tenant workspace: list all workspace users, add new users, update user information or access status, and remove users who have left the organization.

Users and permissions

A super admin or admin can view, edit, and delete the staff list. A tenant owner or user receives 403. An active user cannot delete their own account.

Requirements

ID Priority Requirement
USM-01 Must The system lists all users in the tenant workspace with their ID, email, full name, status (active or locked), and creation timestamp.
USM-02 Must Adding a user accepts email, full name, password, and optional status (default active). Password strength rules match registration (REG-03). A duplicate email returns a 409 Conflict.
USM-03 Must An existing user can be retrieved by their ID. Requesting a non-existent ID returns 404 Not Found.
USM-04 Must Editing a user allows updating full name, email, status (active or locked), and optionally resetting their password. Changing to an existing email belonging to another user returns 409 Conflict.
USM-05 Must Deleting a user removes their record from the database and terminates all active sessions. A user cannot delete their own account (returns 400 Bad Request).
USM-06 Must All user management endpoints require a valid tenant user session. Unauthenticated calls return 401 Unauthorized.
USM-07 Must A user receives 403 on every user-management call. A tenant_owner and platform operators (super_admin, admin, support) may list and manage staff. A tenant owner or operator can delete another user (not themselves).

Screens

The tenant web app provides a user management screen at /users:

  • Header: Displays page title "Quản lý người dùng", total user count badge, and a "Thêm người dùng" (Add User) button.
  • Search bar: Real-time client-side filter by full name or email address.
  • Users table: Shows Name, Email, Role (user or tenant_owner), Status badge (Green "Hoạt động", Gray/Destructive "Đã khóa"), and an Action column with outline icons: lock/unlock, black pencil (Edit), red trash (Delete).
  • Add user dialog: Form with Email, Full Name, Password, and Status fields with inline error validation.
  • Edit user dialog: Pre-filled form allowing edits to Full Name, Email, Role (user or tenant_owner; changing role ends that member's sessions — PRM-12), Status, and an optional new password.
  • Delete confirmation dialog: Asks for confirmation before permanent deletion and shows an error if attempting self-deletion.

Business rules

  • Email is trimmed and converted to lower case.
  • Password requirements: minimum 8 characters, at least one letter, one number, and one uppercase letter.
  • Setting status to locked prevents that user from logging in via sign-in (IAM-02).
  • Deleting a user cascades to deleting all their active sessions in sessions table.
  • Self-deletion is prohibited to prevent tenant workspace lockout.

Acceptance criteria

  • USM-01: Given an unauthenticated request to /api/users, then the response is 401. Given a super admin or admin, then the response is 200 with the list of workspace users.
  • USM-02: Given valid email, full name, and password, when creating a user, then 201 is returned with the new public user record. If email already exists, 409 is returned.
  • USM-03: Given a valid user ID, when requested at /api/users/:id, then 200 is returned. If ID does not exist, 404 is returned.
  • USM-04: Given an existing user, when updating their full name and status to locked, then 200 is returned with updated values.
  • USM-05: Given a user ID different from the caller, when deleting /api/users/:id, then 200 is returned and that user can no longer be retrieved. When attempting to delete self, 400 is returned.
  • USM-06: Given the /users screen, a table of users is rendered with Add plus Action icons (lock/unlock, black pencil Edit, red trash Delete) functioning smoothly.
  • USM-07: A user receives 403 on the staff list. A tenant owner and an admin can list staff; an admin can delete another user.

Not yet implemented

None.

Out of scope

  • Assigning rbac:manage from this screen. Role menus are fixed in the customer portal.
  • Email invitation onboarding links (users are created directly with initial credentials).
  • Bulk CSV user import.

Open questions

None.