Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/Edfermachado/proyectoSistemas/llms.txt

Use this file to discover all available pages before exploring further.

UniEvents uses a role-based access control (RBAC) model with five distinct roles. Each role determines which portal the user can access, which tenants’ data they can see, and which operations they can perform. Superadmin accounts manage the full user directory from /admin/users, while faculty admins create and manage their own sub-team from /faculty-admin/managers.

​
User Roles

The role column on the users table is a plain varchar. The five supported values are:
RoleScopePortal
superadminFull access to all universities, tenants, users, and settings. tenantId is null./admin
tenant_adminFull access to their assigned faculty tenant — spaces, events, managers, and reports./faculty-admin
event_managerCan create and manage events within their tenant./faculty-admin
access_controlCan scan QR tickets and validate attendees at event entrances./faculty-admin
userEnd-user account. Can browse events, register, and manage their own tickets./ (public portal)
The tenantId foreign key in the users table links tenant_admin, event_manager, and access_control accounts to a specific faculty. It is null for superadmin and typically null for user accounts as well.

​
User Personal Information

The schema for the users table stores the following personal fields: 
// src/db/schema.ts
export const users = pgTable('users', {
  id:             uuid('id').primaryKey().defaultRandom(),
  email:          varchar('email',         { length: 255 }).notNull().unique(),
  passwordHash:   varchar('password_hash', { length: 255 }).notNull(),
  name:           varchar('name',          { length: 255 }),
  lastName:       varchar('last_name',     { length: 255 }),
  documentId:     varchar('document_id',   { length: 50  }),
  phone:          varchar('phone',         { length: 50  }),
  role:           varchar('role',          { length: 50  }).notNull().default('user'),
  tenantId:       uuid('tenant_id').references(() => tenants.id),
  organizerLevel: organizerLevelEnum('organizer_level').default('academico'),
  createdAt:      timestamp('created_at').defaultNow(),
});
The organizerLevel enum has three values: academico, amateur, and registrado.
Passwords are never stored in plain text. The UsersService.createUser and UsersService.updateUser methods hash the incoming password with bcrypt at cost factor 10 before writing to the database. The same applies to the /api/users/managers endpoint.

​
Creating Users (Superadmin)

Superadmins can create accounts of any role from the admin portal.
1

Navigate to /admin/users

Open the Users directory from the admin dashboard or sidebar.
2

Click Nuevo Administrador

Click the Nuevo Administrador button (top-right). This navigates to /admin/users/new.
3

Fill in user details

All users require:
  • Email — must be unique across the platform.
  • Password — will be hashed before storage.
  • Role — one of the five role values above.
  • Tenant (required for tenant_admin, event_manager, access_control) — the faculty this user belongs to.
When creating a tenant_admin, the following personal information fields are required (enforced by the API):
  • Name (name)
  • Last Name (lastName)
  • Document ID (documentId)
  • Phone (phone)
4

Submit

The form calls POST /api/users. On success, the new user appears at the top of the directory table.

​
API — Create a User

POST /api/users
Content-Type: application/json

{
  "email": "admin.ingenieria@ucv.edu.ve",
  "passwordHash": "SecureP@ss123",
  "role": "tenant_admin",
  "tenantId": "c9d8e7f6-...",
  "name": "María",
  "lastName": "González",
  "documentId": "V-12345678",
  "phone": "+58 414 555 0100"
}
Response 201 Created: 
{
  "id": "d1e2f3a4-...",
  "email": "admin.ingenieria@ucv.edu.ve",
  "role": "tenant_admin",
  "tenantId": "c9d8e7f6-...",
  "name": "María",
  "lastName": "González",
  "documentId": "V-12345678",
  "phone": "+58 414 555 0100",
  "organizerLevel": "academico",
  "createdAt": "2024-08-17T14:00:00.000Z"
}
The POST /api/users endpoint validates that name, lastName, documentId, and phone are present when role is tenant_admin. Sending an incomplete body for that role returns 400 with the message: “Personal information (name, lastName, documentId, phone) is required for tenant administrators.”
Listing all users requires a tenantId query parameter: 
GET /api/users?tenantId={tenantId}

​
Creating Managers (Faculty Admin)

Faculty admins (tenant_admin) create event_manager and access_control accounts for their own tenant from /faculty-admin/managers/new. This calls the dedicated managers endpoint: 
POST /api/users/managers
Content-Type: application/json
Authorization: session cookie (tenant_admin or superadmin)

{
  "email": "gestor.eventos@ingenieria.ucv.edu.ve",
  "passwordHash": "ManagerPass!99",
  "role": "event_manager",
  "name": "Carlos",
  "lastName": "Mendoza",
  "documentId": "V-87654321",
  "phone": "+58 412 555 0200"
}
Response 201 Created — returns the created user object. The POST /api/users/managers endpoint:
  • Reads the caller’s tenantId directly from the session cookie — the manager is automatically assigned to the admin’s tenant.
  • Only allows event_manager and access_control as valid roles (any other value defaults to event_manager).
  • Requires an active session with role tenant_admin or superadmin and a non-null tenantId.
Listing managers for a tenant: 
GET /api/users/managers                        # Returns event_manager accounts for the session's tenant
GET /api/users/managers?role=access_control    # Filter by role

​
Editing Users

Update any mutable user field by sending a PUT request with the fields to change. If a new passwordHash value is included, it is re-hashed automatically. 
PUT /api/users/{id}
Content-Type: application/json

{
  "phone": "+58 414 555 0199"
}
Response 200 OK — returns the full updated user object.

​
All API Endpoints

# Global user management (superadmin portal)
GET    /api/users?tenantId={id}    # List users scoped to a tenant
POST   /api/users                  # Create any user (validates tenant_admin fields)
GET    /api/users/{id}             # Get a single user by UUID
PUT    /api/users/{id}             # Update user fields (password is re-hashed)
DELETE /api/users/{id}             # Delete user (returns 204)

# Manager management (faculty-admin portal)
GET    /api/users/managers         # List event_manager accounts for the session tenant
GET    /api/users/managers?role=access_control  # Filter by role
POST   /api/users/managers         # Create event_manager or access_control; tenantId set from session

Build docs developers (and LLMs) love

Get started for freeTalk to us