Skip to main content

User Service 👤

The User Service is responsible for managing user profiles and addresses in the ShopVerse platform.
It acts as the single source of truth for user-related data and is consumed by other services such as Auth Service and Order Service.

🎯 Responsibilities​

The User Service handles:

  • User profile creation and management
  • Secure storage of user credentials (hashed passwords)
  • Address management (CRUD)
  • Providing user details to Auth Service (internal APIs)
  • Enforcing ownership and access control for user data

🧠 Why a Separate User Service?​

Separating user management from authentication ensures:

  • Clear separation between identity and authentication
  • Reduced security risk
  • Easier data evolution (profile fields, addresses, preferences)
  • Independent scaling of user-related workloads

Auth Service does not own user data — it only authenticates.

🏗️ High-Level Architecture​

🔐 Security Model​

  • Requests come through API Gateway

  • Gateway injects trusted headers:

    • X-User-Email
    • X-User-Role

  • User Service authenticates requests using a custom filter

  • Authorization enforced via RBAC

No JWT parsing happens inside the User Service.

🔁 User Creation Flow​

🗄️ Data Model​

User Entity​

  • id
  • fullName
  • email (unique)
  • phoneNo
  • password (BCrypt hashed)
  • role (ADMIN / CUSTOMER)
  • createdAt
  • updatedAt

Address Entity​

  • id
  • userId
  • street
  • city
  • state
  • pincode
  • createdAt

Each user can have multiple addresses.

📡 Internal APIs (Used by Auth Service)​

MethodEndpointDescription
GET/api/internal/users/auth/{email}Fetch user for authentication

These endpoints are not exposed to clients.

🌐 Public APIs (via Gateway)​

MethodEndpointRoleDescription
GET/api/users/meUSERGet current user profile
PUT/api/users/meUSERUpdate profile
GET/api/usersADMINGet all users
DELETE/api/users/{id}ADMINDelete user

🏠 Address Management APIs​

MethodEndpointDescription
POST/api/users/addressesAdd address
GET/api/users/addressesList addresses
PUT/api/users/addresses/{id}Update address
DELETE/api/users/addresses/{id}Delete address

Ownership is strictly enforced using X-User-Email.

🛡️ Authorization Rules​

  • Users can only access their own data
  • Admins can access all users
  • Address operations are ownership-validated
  • Unauthorized access returns 403 Forbidden

⚙️ Key Components​

  • UserController – User profile APIs
  • AddressController – Address APIs
  • UserService – Core business logic
  • AddressService – Address ownership logic
  • UserRepository – JPA repository
  • GatewayHeaderAuthenticationFilter – Security filter
  • GlobalExceptionHandler – Standardized error responses

⚠️ Failure Scenarios​

❌ User Not Found​

  • Returns 404 Not Found

❌ Unauthorized Access​

  • Returns 403 Forbidden

❌ Duplicate Email​

  • Prevented at DB & service layer

📈 Scalability Considerations​

  • Stateless service
  • Database indexed on email
  • Can be horizontally scaled
  • Independent of Auth token logic

🧪 Testing Strategy​

  • Unit tests for service logic
  • Integration tests for ownership checks
  • Security tests for role validation
  • Negative tests for unauthorized access

📌 Summary​

The User Service ensures:

  • Clean separation of user data and authentication
  • Secure ownership enforcement
  • Centralized user management
  • Scalability and maintainability

It plays a critical role in ShopVerse’s security and data consistency.