Skip to main content

User Management (Internal)

This module is intended for system administrators (Admins) and provides full control over all users in the system.

Multi-Tenancy Architecture​

The system is built as a multi-tenant SaaS, where each "user" is essentially a separate Tenant (synagogue). Each user's data is logically separated in the database using the userId field.

Data Isolation Mechanism​

  • Middleware: Every Prisma query goes through Middleware that automatically adds a filter where: { userId: currentUserId }.
  • Importance: This prevents data leakage between different synagogues.

Admin Operations​

1. Creating a New User​

Required information:

  • Synagogue / Gabbai name.
  • Email (used as login username).
  • Initial password (user will be prompted to change).
  • Role.

2. Assigning Roles​

You can change a user's role through the management interface or directly via API (PATCH /users/:id/assign-role).

3. Impersonation​

System administrators can "step into the shoes" of a user to see the system exactly as they see it (for technical support purposes).

  • How does it work? The client sends a special header in the request: 
    x-customer-context: <TargetUserID>
  • The server detects the header (authorized only for Admins) and activates the TenantInterceptor with the target user's ID.
  • In this mode, all queries are filtered by the target user, and the admin sees their data.
Security

During impersonation, the isAdmin flag in Context becomes false to prevent bypassing the regular user's business logic constraints.