## Purpose

Mengelola profil pribadi dan akun aplikasi dengan akses yang sesuai role, tanpa menghilangkan histori kegiatan pengguna.

## ADDED Requirements

### Requirement: Atomic personal profile update
The system SHALL expose GET /api/v1/auth/me and PATCH /api/v1/settings/profile for the authenticated account. Profile writes SHALL accept name, email, nullable position and optional currentPassword/newPassword/confirmPassword, and commit profile and password together. Role and active status SHALL NOT be writable through this endpoint.

#### Scenario: Save profile without password change
- **WHEN** a user submits valid profile fields with no password fields
- **THEN** the profile is saved, the password is unchanged, and the response contains only public account fields

#### Scenario: Invalid password or duplicate email
- **WHEN** the old password is incorrect, password fields are incomplete or mismatched, or normalized email belongs to another user
- **THEN** the entire save fails with a stable Indonesian error and no partial profile update

#### Scenario: Invalid or forbidden input
- **WHEN** a request contains blank name, invalid email, oversized fields or role/isActive changes
- **THEN** the request is rejected without changing the account

### Requirement: Password and session behavior
The system SHALL verify the existing password for a password change, accept new passwords of 8-128 characters, and never expose passwords or hashes in responses, logs or audit payloads. Existing JWT expiry and account-state checks SHALL remain unchanged; this feature SHALL NOT claim to revoke other sessions.

#### Scenario: Successful password change
- **WHEN** a valid password change completes
- **THEN** login accepts the new password and rejects the old one, and existing signed sessions retain their existing validity rules

### Requirement: Administrator user management
Only ADMIN SHALL list, create and update users through GET/POST /api/v1/settings/users and PATCH /api/v1/settings/users/:id. Creation SHALL require name, normalized unique email, initial password and a supported role. Updates SHALL allow name, email, position, role and isActive, without password reset or hard deletion.

#### Scenario: Create and list accounts
- **WHEN** an ADMIN creates a valid account and requests the user list
- **THEN** the active account appears with its role and status in a paginated list supporting search, role and active-status filters, without its password hash

#### Scenario: Unauthorized administration
- **WHEN** a SUPERVISOR, TECHNICIAN or VIEWER calls user administration endpoints
- **THEN** access is denied even if the request bypasses the frontend

#### Scenario: Deactivate an account with history
- **WHEN** an ADMIN deactivates another eligible account
- **THEN** its history remains associated with that account and subsequent authenticated requests from that account are rejected

### Requirement: Administrator continuity
The system SHALL prevent self-deactivation and self-role changes through user administration and SHALL preserve at least one active ADMIN under concurrent requests. Administrative authorization SHALL be checked against current account state when applying a mutation.

#### Scenario: Concurrent administrator changes
- **WHEN** concurrent changes would remove all active ADMIN accounts
- **THEN** at least one change is rejected and one active ADMIN remains

### Requirement: Settings interaction and audit
The frontend SHALL load real account data, preserve unsaved form input during refetch/failure, provide initial loading/error/retry states, disable duplicate submission, and refresh relevant account/list caches after success. Successful account mutations SHALL have an attributable audit record committed with the mutation.

#### Scenario: Save and discard
- **WHEN** a profile save succeeds or the user chooses Discard
- **THEN** successful saves update displayed account identity; Discard restores the last fetched profile and clears password inputs without a write

#### Scenario: User switches accounts
- **WHEN** a different account logs in
- **THEN** private Settings data from the previous account is not displayed