Users and Organization

Overview

My Account (Self-Service)

Each logged-in user can access My Account (/dashboard/account) through the Avatar Menu (top right):

• Profile: Adjust display name (email and role are read-only).
• Password: Change it yourself using the current password; requirements are according to the system password policy (length, upper/lowercase letters, number, special characters).
• Forgot Password: Log out and use Forgot Password? on the login page (email with reset link).

Settings in the same menu are not the user profile—they lead admins to the organization hub and are hidden for roles such as Content Editor or Tenant.

API (logged-in user): GET / PATCH /api/users/me, POST /api/users/me/change-password.

---

Under Settings → Users & Roles, administrators can create new accounts and edit existing ones. For organization-wide roles, the Organization is stored with the user (User.organizationId). This makes the same session see all shopping centers of this organization (see getCenterIdsForUser / Center filter in APIs).

Which Roles Require an Organization?

• Center Administrator (Organization) (CENTER_ADMIN)
• Marketing Manager (ORG_MARKETING_MANAGER)

Without a chosen organization, such a user cannot be created or saved.

Who Can Set What?

• Super Admin: Can select any organization from the list (in the case of multiple tenants, a dropdown).
• Center Administrator: Only sees their own organization; the ID is always set server-side to this organization. Another organization cannot be assigned.

Center Assignments

For organization-wide roles, Center Assignments are optional—access comes primarily through the organization. You can still use assignments if you plan to implement finer models later or need documentation for editors.

For roles like Tenant or Center Manager, Center Assignments remain relevant to clarify which centers the account refers to.

Roles Tab – Module Configuration per Role

In the Roles tab, super admins can enable or disable individual product modules per role using a toggle:

• Toggle List: All non-core modules with current release status. Green background = active. (Override) = manually set (DB table role_module_configs).
• Logic: DB overrides take precedence; if an override is missing, the code value from ROLE_PERMISSIONS applies (apps/dashboard/src/lib/permissions.ts). Core modules cannot be disabled.
• Immediate Effect: use-navigation.ts considers overrides; the sidebar updates on the next navigation.
• API: GET /api/role-module-config – Super Admin: full matrix; other roles (e.g. Center Admin, Org Marketing): only their own role (for sidebar/navigation, no 403). PUT / DELETE only for Super Admin ({ role, moduleId, isEnabled }).

Three Levels at a Glance

Level	Location	Effect
Tenant-wide	Settings → Modules	Activates areas for all roles
Per Role	Settings → Users → Roles Tab	Override which modules a role can see
Per User	Edit User	Select the role + Center Assignments

There is no separate module override screen for each individual user (technically possible via ModuleConfig.userId, but no standard UI flow).

Editing

When switching from one organization-wide role to another role, organizationId is automatically cleared upon saving. When switching to an organization-wide role, you must choose an organization again (or the one visible organization applies).

API

POST /api/users and PUT /api/users optionally accept organizationId. The server logic validates the combination of role and permissions of the currently logged-in administrator.

Module Overrides: PUT /api/role-module-config (only Super Admin).