# README

## Overview

The User Management module provides identity and access control capabilities for the ERP system. It manages user accounts through their lifecycle (creation, activation, deactivation) and implements Role-Based Access Control (RBAC) for authorization.

This module serves as a foundational component that other modules depend on for user identity and authorization checks.

## Key Features

- **User Account Lifecycle**: Create, update, activate, deactivate, and reactivate user accounts with clear status transitions (PENDING, ACTIVE, INACTIVE)
- **Self-Service Profile Update**: Users can update their own profile (name, email) via a dedicated command that implicitly targets the calling user
- **Email Uniqueness**: Enforce unique email addresses across all user accounts
- **Role-Based Access Control**: Define roles, grant permissions to roles, and assign roles to users for scalable authorization
- **Role Lifecycle Management**: Deactivate and reactivate roles with status-based transitions (ACTIVE, INACTIVE), including pre-deactivation checks and permission recomputation
- **Role Permission Management**: Grant and revoke permission keys on roles. An executor recomputes effective permissions for affected users

## Module Scope

### In Scope

- User CRUD operations with status management (PENDING, ACTIVE, INACTIVE)
- Role definitions and role-to-user assignments
- Role permission management (granting/revoking permission keys on roles)
- Status-based access restrictions (e.g., only active users can be assigned roles)

### Out of Scope

- External identity provider integration (SAML, OIDC, OAuth)
- Multi-factor authentication (MFA)
- Single sign-on (SSO) federation
- Fine-grained attribute-based access control (ABAC)
- Password storage and authentication mechanisms
- Session management

### Scope Decision Rationale

User-management is strictly scoped to **application login accounts and their access control**. A "user" in this module represents a login identity — someone who can sign in and be authorized via roles and permissions. It does not represent an employee, a customer, or any other business domain entity.

Employee profiles, organizational hierarchy, department assignments, and HR-related attributes belong to separate domain modules (e.g., HR/employee-management). A single employee may or may not have a login account, and conversely a user account may not correspond to an employee (e.g., external partners, system accounts). Mixing these concerns would couple authentication/authorization logic to business domain models that evolve independently.

Authentication mechanisms (passwords, MFA, SSO) are excluded because the Tailor Platform handles authentication at the infrastructure level. This module only manages the user entity and its authorization data, not how users prove their identity.

## Module Dependencies

- None (this is a foundational module)