User Management
:::info Status
Implemented. Source: fastapi-backend/api/v1/endpoints/users.py.
:::
The users table and its self-service/superadmin API. See
Authentication for how a user gets a
session in the first place, and
Authorization for role/permission checks.
Self-service (/users/me)
| Endpoint | Purpose |
|---|---|
GET /users/me | Current user's profile |
PATCH /users/me | Update own profile fields |
DELETE /users/me | Delete own account — requires password confirmation if the account has a password set |
POST /users/me/voip-token | Register/refresh the iOS PushKit VoIP token (used for azaan CallKit push, bypassing Expo) |
POST /users/me/fcm-token | Register/refresh the Firebase Cloud Messaging token (Android + iOS); must come from the Firebase SDK for the azan360-app project — Expo push tokens (ExponentPushToken[...]) are explicitly rejected; send null to clear |
POST /users/me/apns-token | Register/clear the raw APNs device token for direct alert push (iOS); send null to clear |
Pre-auth lookup
GET /users/lookup?identifier=... checks whether an account exists for an
email or phone without exposing profile data — used by client-side
sign-in flows to decide "sign in" vs. "sign up." Hardened:
- In-process sliding-window rate limit: 10 requests / 60s / IP.
- A 50ms floor on response time regardless of whether the account exists — a timing side-channel would otherwise leak existence.
- The identifier is masked in the response (
j***n@example.com,+91 ●●●●● 7890), never echoed back in full.
Superadmin operations
All gated by security.require_role(["superadmin"]) at the route level:
| Endpoint | Purpose |
|---|---|
GET /users | List/search/filter users |
POST /users | Create a user directly (email and/or phone; password optional, hashed via the same SHA-256-prehash + bcrypt scheme as superadmin login) |
GET /users/{id} | User detail, including which mosques they administer |
PATCH /users/{id} | Update any user, including resetting their password |
DELETE /users/{id} | Delete a user — a superadmin cannot delete their own account through this endpoint |
Full request/response schemas: API Reference.