Delete Authorised Users¶

Milestone: M2 — Platform and Client Admin SOW Reference: FR6 Requirement Clarity: ✅ Clear Dev Status: 🟢 Prototyped in POC

Overview¶

Let a Staffing Company Admin manage the other users in their organisation — add, modify, disable/delete — as distinct from managing their own profile (see M2-06).

Backend Tasks¶

Confirm CompanyAdminUserService (app/backend/src/admin/services/company-admin-user.service.ts) covers create/update/deactivate for org users, including the Auth0-side user + org membership creation
Confirm OrganizationController (app/backend/src/admin/controllers/organization.controller.ts) exposes the corresponding endpoints with @Roles(UserRole.ORG_ADMIN) guards
Decide fate of the legacy, unguarded UsersController (app/backend/src/users/users.controller.ts) flagged in the earlier codebase review — either lock it down with RolesGuard or remove it if superseded by CompanyAdminUserService

Frontend Tasks¶

Confirm the org admin "Users" page (app/frontend/src/pages/admin/users.tsx) supports add/edit/disable flows end-to-end
Add delete/deactivate confirmation UX

Dependencies¶

M2-00 overview — org-users.controller.ts endpoints originally spec'd there.
M2-09 RBAC — role assignment on user creation.

Acceptance Criteria¶

Admin can create users
Admin can modify users
Admin can disable/delete users (per SOW Appendix 3, FR6 acceptance criteria)

Existing Reference Material¶

Blockers & Risks¶

Security: the unguarded UsersController should be resolved as part of this task, not left as an open security defect into later milestones.