-

user/internal/config/config.go

@@ -0,0 +1,166 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/joho/godotenv"
+)
+
+// ConfigProvider defines the interface for configuration operations
+type ConfigProvider interface {
+	GetString(key string) string
+	GetInt(key string) int
+	GetBool(key string) bool
+	GetDuration(key string) time.Duration
+	IsSet(key string) bool
+	Validate() error
+	GetDatabaseDSN() string
+	GetDatabaseDSNForLogging() string
+	GetServerAddress() string
+	IsProduction() bool
+}
+
+// Config implements the ConfigProvider interface
+type Config struct {
+	defaults map[string]string
+}
+
+// NewConfig creates a new configuration instance
+func NewConfig() ConfigProvider {
+	// Load .env file if it exists
+	_ = godotenv.Load()
+
+	return &Config{
+		defaults: map[string]string{
+			"SERVER_HOST":            "0.0.0.0",
+			"SERVER_PORT":            "8090",
+			"SERVER_READ_TIMEOUT":    "30s",
+			"SERVER_WRITE_TIMEOUT":   "30s",
+			"SERVER_IDLE_TIMEOUT":    "60s",
+			"DB_HOST":                "localhost",
+			"DB_PORT":                "5432",
+			"DB_NAME":                "users",
+			"DB_USER":                "postgres",
+			"DB_PASSWORD":            "postgres",
+			"DB_SSLMODE":             "disable",
+			"DB_MAX_OPEN_CONNS":      "25",
+			"DB_MAX_IDLE_CONNS":      "5",
+			"DB_CONN_MAX_LIFETIME":   "5m",
+			"APP_ENV":                "development",
+			"APP_VERSION":            "1.0.0",
+			"LOG_LEVEL":              "debug",
+			"RATE_LIMIT_ENABLED":     "true",
+			"RATE_LIMIT_RPS":         "100",
+			"RATE_LIMIT_BURST":       "200",
+			"AUTH_PROVIDER":          "header",
+			"AUTH_HEADER_USER_EMAIL": "X-User-Email",
+		},
+	}
+}
+
+func (c *Config) GetString(key string) string {
+	if value := os.Getenv(key); value != "" {
+		return value
+	}
+	return c.defaults[key]
+}
+
+func (c *Config) GetInt(key string) int {
+	value := c.GetString(key)
+	if value == "" {
+		return 0
+	}
+
+	intVal, err := strconv.Atoi(value)
+	if err != nil {
+		return 0
+	}
+	return intVal
+}
+
+func (c *Config) GetBool(key string) bool {
+	value := strings.ToLower(c.GetString(key))
+	return value == "true" || value == "1"
+}
+
+func (c *Config) GetDuration(key string) time.Duration {
+	value := c.GetString(key)
+	if value == "" {
+		return 0
+	}
+
+	duration, err := time.ParseDuration(value)
+	if err != nil {
+		return 0
+	}
+	return duration
+}
+
+func (c *Config) IsSet(key string) bool {
+	return os.Getenv(key) != "" || c.defaults[key] != ""
+}
+
+func (c *Config) Validate() error {
+	required := []string{
+		"SERVER_HOST",
+		"SERVER_PORT",
+		"DB_HOST",
+		"DB_PORT",
+		"DB_NAME",
+		"DB_USER",
+		"DB_PASSWORD",
+	}
+
+	var missing []string
+	for _, key := range required {
+		if c.GetString(key) == "" {
+			missing = append(missing, key)
+		}
+	}
+
+	if len(missing) > 0 {
+		return fmt.Errorf("missing required configuration keys: %s", strings.Join(missing, ", "))
+	}
+
+	return nil
+}
+
+func (c *Config) GetDatabaseDSN() string {
+	host := c.GetString("DB_HOST")
+	port := c.GetString("DB_PORT")
+	user := c.GetString("DB_USER")
+	password := c.GetString("DB_PASSWORD")
+	dbname := c.GetString("DB_NAME")
+	sslmode := c.GetString("DB_SSLMODE")
+
+	// Debug logging to see what values we're getting
+	// fmt.Printf("DEBUG DSN VALUES: host=%s port=%s user=%s password=%s dbname=%s sslmode=%s\n",
+	// 	host, port, user, password, dbname, sslmode)
+
+	dsn := fmt.Sprintf("host=%s port=%s user=%s password=%s dbname=%s sslmode=%s",
+		host, port, user, password, dbname, sslmode)
+
+	return dsn
+}
+
+func (c *Config) GetDatabaseDSNForLogging() string {
+	return fmt.Sprintf("host=%s port=%s user=%s dbname=%s sslmode=%s",
+		c.GetString("DB_HOST"),
+		c.GetString("DB_PORT"),
+		c.GetString("DB_USER"),
+		c.GetString("DB_NAME"),
+		c.GetString("DB_SSLMODE"),
+	)
+}
+
+func (c *Config) GetServerAddress() string {
+	return fmt.Sprintf("%s:%s", c.GetString("SERVER_HOST"), c.GetString("SERVER_PORT"))
+}
+
+func (c *Config) IsProduction() bool {
+	return strings.ToLower(c.GetString("APP_ENV")) == "production"
+}

user/internal/database/database.go

@@ -0,0 +1,34 @@
+package database
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/jmoiron/sqlx"
+	_ "github.com/lib/pq" // PostgreSQL driver
+)
+
+// NewPostgresProvider creates a new PostgreSQL database connection
+func NewPostgresProvider(dsn string, maxOpenConns, maxIdleConns int, maxLifetime string) (*sqlx.DB, error) {
+	db, err := sqlx.Connect("postgres", dsn)
+	if err != nil {
+		return nil, fmt.Errorf("failed to connect to database: %w", err)
+	}
+
+	// Set connection pool settings
+	db.SetMaxOpenConns(maxOpenConns)
+	db.SetMaxIdleConns(maxIdleConns)
+	
+	if maxLifetime != "" {
+		if lifetime, err := time.ParseDuration(maxLifetime); err == nil {
+			db.SetConnMaxLifetime(lifetime)
+		}
+	}
+
+	// Test connection
+	if err := db.Ping(); err != nil {
+		return nil, fmt.Errorf("failed to ping database: %w", err)
+	}
+
+	return db, nil
+}

user/internal/domain/models.go

@@ -0,0 +1,130 @@
+package domain
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// UserStatus represents the status of a user account
+type UserStatus string
+
+const (
+	UserStatusActive    UserStatus = "active"
+	UserStatusInactive  UserStatus = "inactive"
+	UserStatusSuspended UserStatus = "suspended"
+	UserStatusPending   UserStatus = "pending"
+)
+
+// UserRole represents the role of a user
+type UserRole string
+
+const (
+	UserRoleAdmin     UserRole = "admin"
+	UserRoleUser      UserRole = "user"
+	UserRoleModerator UserRole = "moderator"
+	UserRoleViewer    UserRole = "viewer"
+)
+
+// User represents a user in the system
+type User struct {
+	ID          uuid.UUID `json:"id" db:"id"`
+	Email       string    `json:"email" validate:"required,email,max=255" db:"email"`
+	FirstName   string    `json:"first_name" validate:"required,min=1,max=100" db:"first_name"`
+	LastName    string    `json:"last_name" validate:"required,min=1,max=100" db:"last_name"`
+	DisplayName string    `json:"display_name" validate:"omitempty,max=200" db:"display_name"`
+	Avatar      string    `json:"avatar,omitempty" validate:"omitempty,url,max=500" db:"avatar"`
+	Role        UserRole  `json:"role" validate:"required,oneof=admin user moderator viewer" db:"role"`
+	Status      UserStatus `json:"status" validate:"required,oneof=active inactive suspended pending" db:"status"`
+	LastLoginAt *time.Time `json:"last_login_at,omitempty" db:"last_login_at"`
+	CreatedAt   time.Time `json:"created_at" db:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at" db:"updated_at"`
+	CreatedBy   string    `json:"created_by" validate:"required" db:"created_by"`
+	UpdatedBy   string    `json:"updated_by" validate:"required" db:"updated_by"`
+}
+
+// UserProfile represents extended user profile information
+type UserProfile struct {
+	UserID      uuid.UUID              `json:"user_id" db:"user_id"`
+	Bio         string                 `json:"bio,omitempty" validate:"omitempty,max=1000" db:"bio"`
+	Location    string                 `json:"location,omitempty" validate:"omitempty,max=200" db:"location"`
+	Website     string                 `json:"website,omitempty" validate:"omitempty,url,max=500" db:"website"`
+	Timezone    string                 `json:"timezone,omitempty" validate:"omitempty,max=50" db:"timezone"`
+	Language    string                 `json:"language,omitempty" validate:"omitempty,max=10" db:"language"`
+	Preferences map[string]interface{} `json:"preferences,omitempty" db:"preferences"`
+	CreatedAt   time.Time              `json:"created_at" db:"created_at"`
+	UpdatedAt   time.Time              `json:"updated_at" db:"updated_at"`
+}
+
+// UserSession represents a user session
+type UserSession struct {
+	ID        uuid.UUID `json:"id" db:"id"`
+	UserID    uuid.UUID `json:"user_id" validate:"required" db:"user_id"`
+	Token     string    `json:"-" db:"token"` // Hidden from JSON
+	IPAddress string    `json:"ip_address" validate:"required" db:"ip_address"`
+	UserAgent string    `json:"user_agent" validate:"required" db:"user_agent"`
+	ExpiresAt time.Time `json:"expires_at" db:"expires_at"`
+	CreatedAt time.Time `json:"created_at" db:"created_at"`
+	LastUsedAt time.Time `json:"last_used_at" db:"last_used_at"`
+}
+
+// CreateUserRequest represents a request to create a new user
+type CreateUserRequest struct {
+	Email       string   `json:"email" validate:"required,email,max=255"`
+	FirstName   string   `json:"first_name" validate:"required,min=1,max=100"`
+	LastName    string   `json:"last_name" validate:"required,min=1,max=100"`
+	DisplayName string   `json:"display_name,omitempty" validate:"omitempty,max=200"`
+	Avatar      string   `json:"avatar,omitempty" validate:"omitempty,url,max=500"`
+	Role        UserRole `json:"role" validate:"required,oneof=admin user moderator viewer"`
+	Status      UserStatus `json:"status" validate:"omitempty,oneof=active inactive suspended pending"`
+}
+
+// UpdateUserRequest represents a request to update an existing user
+type UpdateUserRequest struct {
+	Email       *string     `json:"email,omitempty" validate:"omitempty,email,max=255"`
+	FirstName   *string     `json:"first_name,omitempty" validate:"omitempty,min=1,max=100"`
+	LastName    *string     `json:"last_name,omitempty" validate:"omitempty,min=1,max=100"`
+	DisplayName *string     `json:"display_name,omitempty" validate:"omitempty,max=200"`
+	Avatar      *string     `json:"avatar,omitempty" validate:"omitempty,url,max=500"`
+	Role        *UserRole   `json:"role,omitempty" validate:"omitempty,oneof=admin user moderator viewer"`
+	Status      *UserStatus `json:"status,omitempty" validate:"omitempty,oneof=active inactive suspended pending"`
+}
+
+// UpdateUserProfileRequest represents a request to update user profile
+type UpdateUserProfileRequest struct {
+	Bio         *string                 `json:"bio,omitempty" validate:"omitempty,max=1000"`
+	Location    *string                 `json:"location,omitempty" validate:"omitempty,max=200"`
+	Website     *string                 `json:"website,omitempty" validate:"omitempty,url,max=500"`
+	Timezone    *string                 `json:"timezone,omitempty" validate:"omitempty,max=50"`
+	Language    *string                 `json:"language,omitempty" validate:"omitempty,max=10"`
+	Preferences *map[string]interface{} `json:"preferences,omitempty"`
+}
+
+// ListUsersRequest represents a request to list users with filters
+type ListUsersRequest struct {
+	Status   *UserStatus `json:"status,omitempty" validate:"omitempty,oneof=active inactive suspended pending"`
+	Role     *UserRole   `json:"role,omitempty" validate:"omitempty,oneof=admin user moderator viewer"`
+	Search   string      `json:"search,omitempty" validate:"omitempty,max=255"`
+	Limit    int         `json:"limit,omitempty" validate:"omitempty,min=1,max=100"`
+	Offset   int         `json:"offset,omitempty" validate:"omitempty,min=0"`
+	OrderBy  string      `json:"order_by,omitempty" validate:"omitempty,oneof=created_at updated_at email first_name last_name"`
+	OrderDir string      `json:"order_dir,omitempty" validate:"omitempty,oneof=asc desc"`
+}
+
+// ListUsersResponse represents a response for listing users
+type ListUsersResponse struct {
+	Users      []User `json:"users"`
+	Total      int    `json:"total"`
+	Limit      int    `json:"limit"`
+	Offset     int    `json:"offset"`
+	HasMore    bool   `json:"has_more"`
+}
+
+// AuthContext represents the authentication context for a request
+type AuthContext struct {
+	UserID      string            `json:"user_id"`
+	Email       string            `json:"email"`
+	Role        UserRole          `json:"role"`
+	Permissions []string          `json:"permissions"`
+	Claims      map[string]string `json:"claims"`
+}

user/internal/handlers/health_handler.go

@@ -0,0 +1,52 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jmoiron/sqlx"
+	"go.uber.org/zap"
+)
+
+// HealthHandler handles health check requests
+type HealthHandler struct {
+	db     *sqlx.DB
+	logger *zap.Logger
+}
+
+// NewHealthHandler creates a new health handler
+func NewHealthHandler(db *sqlx.DB, logger *zap.Logger) *HealthHandler {
+	return &HealthHandler{
+		db:     db,
+		logger: logger,
+	}
+}
+
+// Health handles GET /health
+func (h *HealthHandler) Health(c *gin.Context) {
+	c.JSON(http.StatusOK, gin.H{
+		"status":  "ok",
+		"service": "user-service",
+		"version": "1.0.0",
+	})
+}
+
+// Ready handles GET /ready
+func (h *HealthHandler) Ready(c *gin.Context) {
+	// Check database connection
+	if err := h.db.Ping(); err != nil {
+		h.logger.Error("Database health check failed", zap.Error(err))
+		c.JSON(http.StatusServiceUnavailable, gin.H{
+			"status": "not ready",
+			"reason": "database connection failed",
+			"error":  err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"status":   "ready",
+		"service":  "user-service",
+		"database": "connected",
+	})
+}

user/internal/handlers/user_handler.go

@@ -0,0 +1,280 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+
+	"github.com/RyanCopley/skybridge/user/internal/domain"
+	"github.com/RyanCopley/skybridge/user/internal/services"
+)
+
+// UserHandler handles HTTP requests for user operations
+type UserHandler struct {
+	userService services.UserService
+	logger      *zap.Logger
+}
+
+// NewUserHandler creates a new user handler
+func NewUserHandler(userService services.UserService, logger *zap.Logger) *UserHandler {
+	return &UserHandler{
+		userService: userService,
+		logger:      logger,
+	}
+}
+
+// Create handles POST /users
+func (h *UserHandler) Create(c *gin.Context) {
+	var req domain.CreateUserRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		h.logger.Error("Invalid request body", zap.Error(err))
+		c.JSON(http.StatusBadRequest, gin.H{
+			"error":   "Invalid request body",
+			"details": err.Error(),
+		})
+		return
+	}
+
+	// Get actor from context (set by auth middleware)
+	actorID := getActorFromContext(c)
+
+	user, err := h.userService.Create(c.Request.Context(), &req, actorID)
+	if err != nil {
+		h.logger.Error("Failed to create user", zap.Error(err))
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"error":   "Failed to create user",
+			"details": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusCreated, user)
+}
+
+// GetByID handles GET /users/:id
+func (h *UserHandler) GetByID(c *gin.Context) {
+	idParam := c.Param("id")
+	id, err := uuid.Parse(idParam)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"error":   "Invalid user ID",
+			"details": "User ID must be a valid UUID",
+		})
+		return
+	}
+
+	user, err := h.userService.GetByID(c.Request.Context(), id)
+	if err != nil {
+		if err.Error() == "user not found" {
+			c.JSON(http.StatusNotFound, gin.H{
+				"error": "User not found",
+			})
+			return
+		}
+		h.logger.Error("Failed to get user", zap.String("id", id.String()), zap.Error(err))
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"error":   "Failed to get user",
+			"details": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, user)
+}
+
+// Update handles PUT /users/:id
+func (h *UserHandler) Update(c *gin.Context) {
+	idParam := c.Param("id")
+	id, err := uuid.Parse(idParam)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"error":   "Invalid user ID",
+			"details": "User ID must be a valid UUID",
+		})
+		return
+	}
+
+	var req domain.UpdateUserRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		h.logger.Error("Invalid request body", zap.Error(err))
+		c.JSON(http.StatusBadRequest, gin.H{
+			"error":   "Invalid request body",
+			"details": err.Error(),
+		})
+		return
+	}
+
+	// Get actor from context (set by auth middleware)
+	actorID := getActorFromContext(c)
+
+	user, err := h.userService.Update(c.Request.Context(), id, &req, actorID)
+	if err != nil {
+		if err.Error() == "user not found" {
+			c.JSON(http.StatusNotFound, gin.H{
+				"error": "User not found",
+			})
+			return
+		}
+		h.logger.Error("Failed to update user", zap.String("id", id.String()), zap.Error(err))
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"error":   "Failed to update user",
+			"details": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, user)
+}
+
+// Delete handles DELETE /users/:id
+func (h *UserHandler) Delete(c *gin.Context) {
+	idParam := c.Param("id")
+	id, err := uuid.Parse(idParam)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"error":   "Invalid user ID",
+			"details": "User ID must be a valid UUID",
+		})
+		return
+	}
+
+	// Get actor from context (set by auth middleware)
+	actorID := getActorFromContext(c)
+
+	err = h.userService.Delete(c.Request.Context(), id, actorID)
+	if err != nil {
+		if err.Error() == "user not found" {
+			c.JSON(http.StatusNotFound, gin.H{
+				"error": "User not found",
+			})
+			return
+		}
+		h.logger.Error("Failed to delete user", zap.String("id", id.String()), zap.Error(err))
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"error":   "Failed to delete user",
+			"details": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusNoContent, nil)
+}
+
+// List handles GET /users
+func (h *UserHandler) List(c *gin.Context) {
+	var req domain.ListUsersRequest
+
+	// Parse query parameters
+	if status := c.Query("status"); status != "" {
+		s := domain.UserStatus(status)
+		req.Status = &s
+	}
+
+	if role := c.Query("role"); role != "" {
+		r := domain.UserRole(role)
+		req.Role = &r
+	}
+
+	req.Search = c.Query("search")
+
+	if limit := c.Query("limit"); limit != "" {
+		if l, err := strconv.Atoi(limit); err == nil && l > 0 {
+			req.Limit = l
+		}
+	}
+
+	if offset := c.Query("offset"); offset != "" {
+		if o, err := strconv.Atoi(offset); err == nil && o >= 0 {
+			req.Offset = o
+		}
+	}
+
+	req.OrderBy = c.DefaultQuery("order_by", "created_at")
+	req.OrderDir = c.DefaultQuery("order_dir", "desc")
+
+	response, err := h.userService.List(c.Request.Context(), &req)
+	if err != nil {
+		h.logger.Error("Failed to list users", zap.Error(err))
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"error":   "Failed to list users",
+			"details": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, response)
+}
+
+// GetByEmail handles GET /users/email/:email
+func (h *UserHandler) GetByEmail(c *gin.Context) {
+	email := c.Param("email")
+	if email == "" {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"error": "Email parameter is required",
+		})
+		return
+	}
+
+	user, err := h.userService.GetByEmail(c.Request.Context(), email)
+	if err != nil {
+		if err.Error() == "user not found" {
+			c.JSON(http.StatusNotFound, gin.H{
+				"error": "User not found",
+			})
+			return
+		}
+		h.logger.Error("Failed to get user by email", zap.String("email", email), zap.Error(err))
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"error":   "Failed to get user",
+			"details": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, user)
+}
+
+// ExistsByEmail handles GET /users/exists/:email
+func (h *UserHandler) ExistsByEmail(c *gin.Context) {
+	email := c.Param("email")
+	if email == "" {
+		c.JSON(http.StatusBadRequest, gin.H{
+			"error": "Email parameter is required",
+		})
+		return
+	}
+
+	exists, err := h.userService.ExistsByEmail(c.Request.Context(), email)
+	if err != nil {
+		h.logger.Error("Failed to check user existence", zap.String("email", email), zap.Error(err))
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"error":   "Failed to check user existence",
+			"details": err.Error(),
+		})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"exists": exists,
+		"email":  email,
+	})
+}
+
+// Helper function to get actor from gin context
+func getActorFromContext(c *gin.Context) string {
+	if actor, exists := c.Get("actor_id"); exists {
+		if actorStr, ok := actor.(string); ok {
+			return actorStr
+		}
+	}
+	
+	// Fallback to email header if available
+	if email := c.GetHeader("X-User-Email"); email != "" {
+		return email
+	}
+	
+	return "system"
+}

user/internal/middleware/auth.go

@@ -0,0 +1,37 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
+
+	"github.com/RyanCopley/skybridge/user/internal/config"
+)
+
+// Authentication middleware
+func Authentication(cfg config.ConfigProvider, logger *zap.Logger) gin.HandlerFunc {
+	return gin.HandlerFunc(func(c *gin.Context) {
+		// For development, we'll use header-based authentication
+		if cfg.GetString("AUTH_PROVIDER") == "header" {
+			userEmail := c.GetHeader(cfg.GetString("AUTH_HEADER_USER_EMAIL"))
+			if userEmail == "" {
+				logger.Warn("Missing authentication header",
+					zap.String("header", cfg.GetString("AUTH_HEADER_USER_EMAIL")),
+					zap.String("path", c.Request.URL.Path))
+				
+				c.JSON(http.StatusUnauthorized, gin.H{
+					"error": "Authentication required",
+				})
+				c.Abort()
+				return
+			}
+
+			// Set actor in context for handlers
+			c.Set("actor_id", userEmail)
+			c.Set("user_email", userEmail)
+		}
+
+		c.Next()
+	})
+}

user/internal/middleware/cors.go

@@ -0,0 +1,22 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+)
+
+// CORS middleware for handling cross-origin requests
+func CORS() gin.HandlerFunc {
+	return gin.HandlerFunc(func(c *gin.Context) {
+		c.Writer.Header().Set("Access-Control-Allow-Origin", "*")
+		c.Writer.Header().Set("Access-Control-Allow-Credentials", "true")
+		c.Writer.Header().Set("Access-Control-Allow-Headers", "Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With, X-User-Email")
+		c.Writer.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS, GET, PUT, DELETE, PATCH")
+
+		if c.Request.Method == "OPTIONS" {
+			c.AbortWithStatus(204)
+			return
+		}
+
+		c.Next()
+	})
+}

user/internal/middleware/logging.go

@@ -0,0 +1,34 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+	"go.uber.org/zap"
+)
+
+// Logger middleware for structured logging
+func Logger(logger *zap.Logger) gin.HandlerFunc {
+	return gin.LoggerWithFormatter(func(param gin.LogFormatterParams) string {
+		logger.Info("HTTP request",
+			zap.String("method", param.Method),
+			zap.String("path", param.Path),
+			zap.Int("status", param.StatusCode),
+			zap.Duration("latency", param.Latency),
+			zap.String("client_ip", param.ClientIP),
+			zap.String("user_agent", param.Request.UserAgent()),
+		)
+		return ""
+	})
+}
+
+// Recovery middleware with structured logging
+func Recovery(logger *zap.Logger) gin.HandlerFunc {
+	return gin.RecoveryWithWriter(gin.DefaultWriter, func(c *gin.Context, recovered interface{}) {
+		logger.Error("Panic recovered",
+			zap.Any("error", recovered),
+			zap.String("method", c.Request.Method),
+			zap.String("path", c.Request.URL.Path),
+			zap.String("client_ip", c.ClientIP()),
+		)
+		c.AbortWithStatus(500)
+	})
+}

user/internal/repository/interfaces/interfaces.go

@@ -0,0 +1,129 @@
+package interfaces
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+	"github.com/RyanCopley/skybridge/user/internal/domain"
+)
+
+// UserRepository defines the interface for user data operations
+type UserRepository interface {
+	// Create creates a new user
+	Create(ctx context.Context, user *domain.User) error
+	
+	// GetByID retrieves a user by ID
+	GetByID(ctx context.Context, id uuid.UUID) (*domain.User, error)
+	
+	// GetByEmail retrieves a user by email
+	GetByEmail(ctx context.Context, email string) (*domain.User, error)
+	
+	// Update updates an existing user
+	Update(ctx context.Context, user *domain.User) error
+	
+	// Delete deletes a user by ID
+	Delete(ctx context.Context, id uuid.UUID) error
+	
+	// List retrieves users with filtering and pagination
+	List(ctx context.Context, req *domain.ListUsersRequest) (*domain.ListUsersResponse, error)
+	
+	// UpdateLastLogin updates the last login timestamp
+	UpdateLastLogin(ctx context.Context, id uuid.UUID) error
+	
+	// Count returns the total number of users matching the filter
+	Count(ctx context.Context, req *domain.ListUsersRequest) (int, error)
+	
+	// ExistsByEmail checks if a user exists with the given email
+	ExistsByEmail(ctx context.Context, email string) (bool, error)
+}
+
+// UserProfileRepository defines the interface for user profile operations
+type UserProfileRepository interface {
+	// Create creates a new user profile
+	Create(ctx context.Context, profile *domain.UserProfile) error
+	
+	// GetByUserID retrieves a user profile by user ID
+	GetByUserID(ctx context.Context, userID uuid.UUID) (*domain.UserProfile, error)
+	
+	// Update updates an existing user profile
+	Update(ctx context.Context, profile *domain.UserProfile) error
+	
+	// Delete deletes a user profile by user ID
+	Delete(ctx context.Context, userID uuid.UUID) error
+}
+
+// UserSessionRepository defines the interface for user session operations
+type UserSessionRepository interface {
+	// Create creates a new user session
+	Create(ctx context.Context, session *domain.UserSession) error
+	
+	// GetByToken retrieves a session by token
+	GetByToken(ctx context.Context, token string) (*domain.UserSession, error)
+	
+	// GetByUserID retrieves all sessions for a user
+	GetByUserID(ctx context.Context, userID uuid.UUID) ([]domain.UserSession, error)
+	
+	// Update updates an existing session (e.g., last used time)
+	Update(ctx context.Context, session *domain.UserSession) error
+	
+	// Delete deletes a session by ID
+	Delete(ctx context.Context, id uuid.UUID) error
+	
+	// DeleteByUserID deletes all sessions for a user
+	DeleteByUserID(ctx context.Context, userID uuid.UUID) error
+	
+	// DeleteExpired deletes all expired sessions
+	DeleteExpired(ctx context.Context) error
+	
+	// IsValidToken checks if a token is valid and not expired
+	IsValidToken(ctx context.Context, token string) (bool, error)
+}
+
+// AuditRepository defines the interface for audit logging
+type AuditRepository interface {
+	// LogEvent logs an audit event
+	LogEvent(ctx context.Context, event *AuditEvent) error
+	
+	// GetEvents retrieves audit events with filtering
+	GetEvents(ctx context.Context, req *GetEventsRequest) (*GetEventsResponse, error)
+}
+
+// AuditEvent represents an audit event
+type AuditEvent struct {
+	ID          uuid.UUID `json:"id" db:"id"`
+	Type        string    `json:"type" db:"type"`
+	Severity    string    `json:"severity" db:"severity"`
+	Status      string    `json:"status" db:"status"`
+	Timestamp   string    `json:"timestamp" db:"timestamp"`
+	ActorID     string    `json:"actor_id" db:"actor_id"`
+	ActorType   string    `json:"actor_type" db:"actor_type"`
+	ActorIP     string    `json:"actor_ip" db:"actor_ip"`
+	UserAgent   string    `json:"user_agent" db:"user_agent"`
+	ResourceID  string    `json:"resource_id" db:"resource_id"`
+	ResourceType string   `json:"resource_type" db:"resource_type"`
+	Action      string    `json:"action" db:"action"`
+	Description string    `json:"description" db:"description"`
+	Details     map[string]interface{} `json:"details" db:"details"`
+	RequestID   string    `json:"request_id" db:"request_id"`
+	SessionID   string    `json:"session_id" db:"session_id"`
+}
+
+// GetEventsRequest represents a request to get audit events
+type GetEventsRequest struct {
+	UserID       *uuid.UUID `json:"user_id,omitempty"`
+	ResourceType *string    `json:"resource_type,omitempty"`
+	Action       *string    `json:"action,omitempty"`
+	StartTime    *string    `json:"start_time,omitempty"`
+	EndTime      *string    `json:"end_time,omitempty"`
+	Limit        int        `json:"limit,omitempty"`
+	Offset       int        `json:"offset,omitempty"`
+}
+
+// GetEventsResponse represents a response for audit events
+type GetEventsResponse struct {
+	Events  []AuditEvent `json:"events"`
+	Total   int          `json:"total"`
+	Limit   int          `json:"limit"`
+	Offset  int          `json:"offset"`
+	HasMore bool         `json:"has_more"`
+}

user/internal/repository/postgres/profile_repository.go

@@ -0,0 +1,158 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+
+	"github.com/RyanCopley/skybridge/user/internal/domain"
+	"github.com/RyanCopley/skybridge/user/internal/repository/interfaces"
+)
+
+type userProfileRepository struct {
+	db *sqlx.DB
+}
+
+// NewUserProfileRepository creates a new user profile repository
+func NewUserProfileRepository(db *sqlx.DB) interfaces.UserProfileRepository {
+	return &userProfileRepository{db: db}
+}
+
+func (r *userProfileRepository) Create(ctx context.Context, profile *domain.UserProfile) error {
+	profile.CreatedAt = time.Now()
+	profile.UpdatedAt = time.Now()
+
+	// Convert preferences to JSON
+	var preferencesJSON []byte
+	if profile.Preferences != nil {
+		var err error
+		preferencesJSON, err = json.Marshal(profile.Preferences)
+		if err != nil {
+			return fmt.Errorf("failed to marshal preferences: %w", err)
+		}
+	}
+
+	query := `
+		INSERT INTO user_profiles (
+			user_id, bio, location, website, timezone, language, 
+			preferences, created_at, updated_at
+		) VALUES (
+			$1, $2, $3, $4, $5, $6, $7, $8, $9
+		)`
+
+	_, err := r.db.ExecContext(ctx, query,
+		profile.UserID, profile.Bio, profile.Location, profile.Website,
+		profile.Timezone, profile.Language, preferencesJSON,
+		profile.CreatedAt, profile.UpdatedAt,
+	)
+	if err != nil {
+		return fmt.Errorf("failed to create user profile: %w", err)
+	}
+
+	return nil
+}
+
+func (r *userProfileRepository) GetByUserID(ctx context.Context, userID uuid.UUID) (*domain.UserProfile, error) {
+	query := `
+		SELECT user_id, bio, location, website, timezone, language,
+		       preferences, created_at, updated_at
+		FROM user_profiles 
+		WHERE user_id = $1`
+
+	row := r.db.QueryRowContext(ctx, query, userID)
+
+	var profile domain.UserProfile
+	var preferencesJSON sql.NullString
+
+	err := row.Scan(
+		&profile.UserID, &profile.Bio, &profile.Location, &profile.Website,
+		&profile.Timezone, &profile.Language, &preferencesJSON,
+		&profile.CreatedAt, &profile.UpdatedAt,
+	)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, fmt.Errorf("user profile not found")
+		}
+		return nil, fmt.Errorf("failed to get user profile: %w", err)
+	}
+
+	// Parse preferences JSON
+	if preferencesJSON.Valid && preferencesJSON.String != "" {
+		var preferences map[string]interface{}
+		err = json.Unmarshal([]byte(preferencesJSON.String), &preferences)
+		if err != nil {
+			return nil, fmt.Errorf("failed to unmarshal preferences: %w", err)
+		}
+		profile.Preferences = preferences
+	}
+
+	return &profile, nil
+}
+
+func (r *userProfileRepository) Update(ctx context.Context, profile *domain.UserProfile) error {
+	profile.UpdatedAt = time.Now()
+
+	// Convert preferences to JSON
+	var preferencesJSON []byte
+	if profile.Preferences != nil {
+		var err error
+		preferencesJSON, err = json.Marshal(profile.Preferences)
+		if err != nil {
+			return fmt.Errorf("failed to marshal preferences: %w", err)
+		}
+	}
+
+	query := `
+		UPDATE user_profiles SET 
+			bio = $2,
+			location = $3,
+			website = $4,
+			timezone = $5,
+			language = $6,
+			preferences = $7,
+			updated_at = $8
+		WHERE user_id = $1`
+
+	result, err := r.db.ExecContext(ctx, query,
+		profile.UserID, profile.Bio, profile.Location, profile.Website,
+		profile.Timezone, profile.Language, preferencesJSON,
+		profile.UpdatedAt,
+	)
+	if err != nil {
+		return fmt.Errorf("failed to update user profile: %w", err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get affected rows: %w", err)
+	}
+	if rowsAffected == 0 {
+		return fmt.Errorf("user profile not found")
+	}
+
+	return nil
+}
+
+func (r *userProfileRepository) Delete(ctx context.Context, userID uuid.UUID) error {
+	query := `DELETE FROM user_profiles WHERE user_id = $1`
+
+	result, err := r.db.ExecContext(ctx, query, userID)
+	if err != nil {
+		return fmt.Errorf("failed to delete user profile: %w", err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get affected rows: %w", err)
+	}
+	if rowsAffected == 0 {
+		return fmt.Errorf("user profile not found")
+	}
+
+	return nil
+}

user/internal/repository/postgres/user_repository.go

@@ -0,0 +1,305 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jmoiron/sqlx"
+	"github.com/lib/pq"
+
+	"github.com/RyanCopley/skybridge/user/internal/domain"
+	"github.com/RyanCopley/skybridge/user/internal/repository/interfaces"
+)
+
+type userRepository struct {
+	db *sqlx.DB
+}
+
+// NewUserRepository creates a new user repository
+func NewUserRepository(db *sqlx.DB) interfaces.UserRepository {
+	return &userRepository{db: db}
+}
+
+func (r *userRepository) Create(ctx context.Context, user *domain.User) error {
+	query := `
+		INSERT INTO users (
+			id, email, first_name, last_name, display_name, avatar, 
+			role, status, created_at, updated_at, created_by, updated_by
+		) VALUES (
+			:id, :email, :first_name, :last_name, :display_name, :avatar,
+			:role, :status, :created_at, :updated_at, :created_by, :updated_by
+		)`
+
+	if user.ID == uuid.Nil {
+		user.ID = uuid.New()
+	}
+	user.CreatedAt = time.Now()
+	user.UpdatedAt = time.Now()
+
+	if user.Status == "" {
+		user.Status = domain.UserStatusPending
+	}
+
+	_, err := r.db.NamedExecContext(ctx, query, user)
+	if err != nil {
+		if pqErr, ok := err.(*pq.Error); ok && pqErr.Code == "23505" {
+			return fmt.Errorf("user with email %s already exists", user.Email)
+		}
+		return fmt.Errorf("failed to create user: %w", err)
+	}
+
+	return nil
+}
+
+func (r *userRepository) GetByID(ctx context.Context, id uuid.UUID) (*domain.User, error) {
+	query := `
+		SELECT id, email, first_name, last_name, display_name, avatar,
+		       role, status, last_login_at, created_at, updated_at, created_by, updated_by
+		FROM users 
+		WHERE id = $1`
+
+	var user domain.User
+	err := r.db.GetContext(ctx, &user, query, id)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, fmt.Errorf("user not found")
+		}
+		return nil, fmt.Errorf("failed to get user: %w", err)
+	}
+
+	return &user, nil
+}
+
+func (r *userRepository) GetByEmail(ctx context.Context, email string) (*domain.User, error) {
+	query := `
+		SELECT id, email, first_name, last_name, display_name, avatar,
+		       role, status, last_login_at, created_at, updated_at, created_by, updated_by
+		FROM users 
+		WHERE email = $1`
+
+	var user domain.User
+	err := r.db.GetContext(ctx, &user, query, email)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, fmt.Errorf("user not found")
+		}
+		return nil, fmt.Errorf("failed to get user: %w", err)
+	}
+
+	return &user, nil
+}
+
+func (r *userRepository) Update(ctx context.Context, user *domain.User) error {
+	user.UpdatedAt = time.Now()
+
+	query := `
+		UPDATE users SET 
+			email = :email,
+			first_name = :first_name,
+			last_name = :last_name,
+			display_name = :display_name,
+			avatar = :avatar,
+			role = :role,
+			status = :status,
+			last_login_at = :last_login_at,
+			updated_at = :updated_at,
+			updated_by = :updated_by
+		WHERE id = :id`
+
+	result, err := r.db.NamedExecContext(ctx, query, user)
+	if err != nil {
+		if pqErr, ok := err.(*pq.Error); ok && pqErr.Code == "23505" {
+			return fmt.Errorf("user with email %s already exists", user.Email)
+		}
+		return fmt.Errorf("failed to update user: %w", err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get affected rows: %w", err)
+	}
+	if rowsAffected == 0 {
+		return fmt.Errorf("user not found")
+	}
+
+	return nil
+}
+
+func (r *userRepository) Delete(ctx context.Context, id uuid.UUID) error {
+	query := `DELETE FROM users WHERE id = $1`
+
+	result, err := r.db.ExecContext(ctx, query, id)
+	if err != nil {
+		return fmt.Errorf("failed to delete user: %w", err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get affected rows: %w", err)
+	}
+	if rowsAffected == 0 {
+		return fmt.Errorf("user not found")
+	}
+
+	return nil
+}
+
+func (r *userRepository) List(ctx context.Context, req *domain.ListUsersRequest) (*domain.ListUsersResponse, error) {
+	// Build WHERE clause
+	var conditions []string
+	var args []interface{}
+	argCounter := 1
+
+	if req.Status != nil {
+		conditions = append(conditions, fmt.Sprintf("status = $%d", argCounter))
+		args = append(args, *req.Status)
+		argCounter++
+	}
+
+	if req.Role != nil {
+		conditions = append(conditions, fmt.Sprintf("role = $%d", argCounter))
+		args = append(args, *req.Role)
+		argCounter++
+	}
+
+	if req.Search != "" {
+		searchPattern := "%" + strings.ToLower(req.Search) + "%"
+		conditions = append(conditions, fmt.Sprintf("(LOWER(email) LIKE $%d OR LOWER(first_name) LIKE $%d OR LOWER(last_name) LIKE $%d OR LOWER(display_name) LIKE $%d)", argCounter, argCounter, argCounter, argCounter))
+		args = append(args, searchPattern)
+		argCounter++
+	}
+
+	whereClause := ""
+	if len(conditions) > 0 {
+		whereClause = "WHERE " + strings.Join(conditions, " AND ")
+	}
+
+	// Build ORDER BY clause
+	orderBy := "created_at"
+	orderDir := "DESC"
+	if req.OrderBy != "" {
+		orderBy = req.OrderBy
+	}
+	if req.OrderDir != "" {
+		orderDir = strings.ToUpper(req.OrderDir)
+	}
+
+	// Set default pagination
+	limit := 20
+	if req.Limit > 0 {
+		limit = req.Limit
+	}
+	offset := 0
+	if req.Offset > 0 {
+		offset = req.Offset
+	}
+
+	// Query for users
+	query := fmt.Sprintf(`
+		SELECT id, email, first_name, last_name, display_name, avatar,
+		       role, status, last_login_at, created_at, updated_at, created_by, updated_by
+		FROM users 
+		%s
+		ORDER BY %s %s
+		LIMIT $%d OFFSET $%d`,
+		whereClause, orderBy, orderDir, argCounter, argCounter+1)
+
+	args = append(args, limit, offset)
+
+	var users []domain.User
+	err := r.db.SelectContext(ctx, &users, query, args...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list users: %w", err)
+	}
+
+	// Get total count
+	total, err := r.Count(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get user count: %w", err)
+	}
+
+	hasMore := offset+len(users) < total
+
+	return &domain.ListUsersResponse{
+		Users:   users,
+		Total:   total,
+		Limit:   limit,
+		Offset:  offset,
+		HasMore: hasMore,
+	}, nil
+}
+
+func (r *userRepository) UpdateLastLogin(ctx context.Context, id uuid.UUID) error {
+	query := `UPDATE users SET last_login_at = $1 WHERE id = $2`
+
+	result, err := r.db.ExecContext(ctx, query, time.Now(), id)
+	if err != nil {
+		return fmt.Errorf("failed to update last login: %w", err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get affected rows: %w", err)
+	}
+	if rowsAffected == 0 {
+		return fmt.Errorf("user not found")
+	}
+
+	return nil
+}
+
+func (r *userRepository) Count(ctx context.Context, req *domain.ListUsersRequest) (int, error) {
+	var conditions []string
+	var args []interface{}
+	argCounter := 1
+
+	if req.Status != nil {
+		conditions = append(conditions, fmt.Sprintf("status = $%d", argCounter))
+		args = append(args, *req.Status)
+		argCounter++
+	}
+
+	if req.Role != nil {
+		conditions = append(conditions, fmt.Sprintf("role = $%d", argCounter))
+		args = append(args, *req.Role)
+		argCounter++
+	}
+
+	if req.Search != "" {
+		searchPattern := "%" + strings.ToLower(req.Search) + "%"
+		conditions = append(conditions, fmt.Sprintf("(LOWER(email) LIKE $%d OR LOWER(first_name) LIKE $%d OR LOWER(last_name) LIKE $%d OR LOWER(display_name) LIKE $%d)", argCounter, argCounter, argCounter, argCounter))
+		args = append(args, searchPattern)
+		argCounter++
+	}
+
+	whereClause := ""
+	if len(conditions) > 0 {
+		whereClause = "WHERE " + strings.Join(conditions, " AND ")
+	}
+
+	query := fmt.Sprintf("SELECT COUNT(*) FROM users %s", whereClause)
+
+	var count int
+	err := r.db.GetContext(ctx, &count, query, args...)
+	if err != nil {
+		return 0, fmt.Errorf("failed to count users: %w", err)
+	}
+
+	return count, nil
+}
+
+func (r *userRepository) ExistsByEmail(ctx context.Context, email string) (bool, error) {
+	query := `SELECT EXISTS(SELECT 1 FROM users WHERE email = $1)`
+
+	var exists bool
+	err := r.db.GetContext(ctx, &exists, query, email)
+	if err != nil {
+		return false, fmt.Errorf("failed to check user existence: %w", err)
+	}
+
+	return exists, nil
+}

user/internal/services/user_service.go

@@ -0,0 +1,326 @@
+package services
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+
+	"github.com/RyanCopley/skybridge/user/internal/domain"
+	"github.com/RyanCopley/skybridge/user/internal/repository/interfaces"
+)
+
+// UserService defines the interface for user business logic
+type UserService interface {
+	// Create creates a new user
+	Create(ctx context.Context, req *domain.CreateUserRequest, actorID string) (*domain.User, error)
+	
+	// GetByID retrieves a user by ID
+	GetByID(ctx context.Context, id uuid.UUID) (*domain.User, error)
+	
+	// GetByEmail retrieves a user by email
+	GetByEmail(ctx context.Context, email string) (*domain.User, error)
+	
+	// Update updates an existing user
+	Update(ctx context.Context, id uuid.UUID, req *domain.UpdateUserRequest, actorID string) (*domain.User, error)
+	
+	// Delete deletes a user by ID
+	Delete(ctx context.Context, id uuid.UUID, actorID string) error
+	
+	// List retrieves users with filtering and pagination
+	List(ctx context.Context, req *domain.ListUsersRequest) (*domain.ListUsersResponse, error)
+	
+	// UpdateLastLogin updates the last login timestamp
+	UpdateLastLogin(ctx context.Context, id uuid.UUID) error
+	
+	// ExistsByEmail checks if a user exists with the given email
+	ExistsByEmail(ctx context.Context, email string) (bool, error)
+}
+
+type userService struct {
+	userRepo        interfaces.UserRepository
+	profileRepo     interfaces.UserProfileRepository
+	auditRepo       interfaces.AuditRepository
+	logger          *zap.Logger
+}
+
+// NewUserService creates a new user service
+func NewUserService(
+	userRepo interfaces.UserRepository,
+	profileRepo interfaces.UserProfileRepository,
+	auditRepo interfaces.AuditRepository,
+	logger *zap.Logger,
+) UserService {
+	return &userService{
+		userRepo:    userRepo,
+		profileRepo: profileRepo,
+		auditRepo:   auditRepo,
+		logger:      logger,
+	}
+}
+
+func (s *userService) Create(ctx context.Context, req *domain.CreateUserRequest, actorID string) (*domain.User, error) {
+	// Validate email uniqueness
+	exists, err := s.userRepo.ExistsByEmail(ctx, req.Email)
+	if err != nil {
+		s.logger.Error("Failed to check email uniqueness", zap.String("email", req.Email), zap.Error(err))
+		return nil, fmt.Errorf("failed to validate email uniqueness: %w", err)
+	}
+	if exists {
+		return nil, fmt.Errorf("user with email %s already exists", req.Email)
+	}
+
+	// Create user domain object
+	user := &domain.User{
+		ID:          uuid.New(),
+		Email:       req.Email,
+		FirstName:   req.FirstName,
+		LastName:    req.LastName,
+		DisplayName: req.DisplayName,
+		Avatar:      req.Avatar,
+		Role:        req.Role,
+		Status:      req.Status,
+		CreatedBy:   actorID,
+		UpdatedBy:   actorID,
+	}
+
+	if user.Status == "" {
+		user.Status = domain.UserStatusPending
+	}
+
+	// Create user in database
+	err = s.userRepo.Create(ctx, user)
+	if err != nil {
+		s.logger.Error("Failed to create user", zap.String("email", req.Email), zap.Error(err))
+		return nil, fmt.Errorf("failed to create user: %w", err)
+	}
+
+	// Create default user profile
+	profile := &domain.UserProfile{
+		UserID:      user.ID,
+		Bio:         "",
+		Location:    "",
+		Website:     "",
+		Timezone:    "UTC",
+		Language:    "en",
+		Preferences: make(map[string]interface{}),
+	}
+
+	err = s.profileRepo.Create(ctx, profile)
+	if err != nil {
+		s.logger.Warn("Failed to create user profile", zap.String("user_id", user.ID.String()), zap.Error(err))
+		// Don't fail user creation if profile creation fails
+	}
+
+	// Log audit event
+	if s.auditRepo != nil {
+		auditEvent := &interfaces.AuditEvent{
+			ID:           uuid.New(),
+			Type:         "user.created",
+			Severity:     "info",
+			Status:       "success",
+			Timestamp:    time.Now().Format(time.RFC3339),
+			ActorID:      actorID,
+			ActorType:    "user",
+			ResourceID:   user.ID.String(),
+			ResourceType: "user",
+			Action:       "create",
+			Description:  fmt.Sprintf("User %s created", user.Email),
+			Details: map[string]interface{}{
+				"user_id": user.ID.String(),
+				"email":   user.Email,
+				"role":    user.Role,
+				"status":  user.Status,
+			},
+		}
+		_ = s.auditRepo.LogEvent(ctx, auditEvent)
+	}
+
+	s.logger.Info("User created successfully", 
+		zap.String("user_id", user.ID.String()),
+		zap.String("email", user.Email),
+		zap.String("actor", actorID))
+
+	return user, nil
+}
+
+func (s *userService) GetByID(ctx context.Context, id uuid.UUID) (*domain.User, error) {
+	user, err := s.userRepo.GetByID(ctx, id)
+	if err != nil {
+		s.logger.Debug("Failed to get user by ID", zap.String("id", id.String()), zap.Error(err))
+		return nil, err
+	}
+
+	return user, nil
+}
+
+func (s *userService) GetByEmail(ctx context.Context, email string) (*domain.User, error) {
+	user, err := s.userRepo.GetByEmail(ctx, email)
+	if err != nil {
+		s.logger.Debug("Failed to get user by email", zap.String("email", email), zap.Error(err))
+		return nil, err
+	}
+
+	return user, nil
+}
+
+func (s *userService) Update(ctx context.Context, id uuid.UUID, req *domain.UpdateUserRequest, actorID string) (*domain.User, error) {
+	// Get existing user
+	existingUser, err := s.userRepo.GetByID(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+
+	// Check email uniqueness if email is being updated
+	if req.Email != nil && *req.Email != existingUser.Email {
+		exists, err := s.userRepo.ExistsByEmail(ctx, *req.Email)
+		if err != nil {
+			s.logger.Error("Failed to check email uniqueness", zap.String("email", *req.Email), zap.Error(err))
+			return nil, fmt.Errorf("failed to validate email uniqueness: %w", err)
+		}
+		if exists {
+			return nil, fmt.Errorf("user with email %s already exists", *req.Email)
+		}
+	}
+
+	// Update fields
+	if req.Email != nil {
+		existingUser.Email = *req.Email
+	}
+	if req.FirstName != nil {
+		existingUser.FirstName = *req.FirstName
+	}
+	if req.LastName != nil {
+		existingUser.LastName = *req.LastName
+	}
+	if req.DisplayName != nil {
+		existingUser.DisplayName = *req.DisplayName
+	}
+	if req.Avatar != nil {
+		existingUser.Avatar = *req.Avatar
+	}
+	if req.Role != nil {
+		existingUser.Role = *req.Role
+	}
+	if req.Status != nil {
+		existingUser.Status = *req.Status
+	}
+	existingUser.UpdatedBy = actorID
+
+	// Update user in database
+	err = s.userRepo.Update(ctx, existingUser)
+	if err != nil {
+		s.logger.Error("Failed to update user", zap.String("id", id.String()), zap.Error(err))
+		return nil, fmt.Errorf("failed to update user: %w", err)
+	}
+
+	// Log audit event
+	if s.auditRepo != nil {
+		auditEvent := &interfaces.AuditEvent{
+			ID:           uuid.New(),
+			Type:         "user.updated",
+			Severity:     "info",
+			Status:       "success",
+			Timestamp:    time.Now().Format(time.RFC3339),
+			ActorID:      actorID,
+			ActorType:    "user",
+			ResourceID:   id.String(),
+			ResourceType: "user",
+			Action:       "update",
+			Description:  fmt.Sprintf("User %s updated", existingUser.Email),
+			Details: map[string]interface{}{
+				"user_id": id.String(),
+				"email":   existingUser.Email,
+				"role":    existingUser.Role,
+				"status":  existingUser.Status,
+			},
+		}
+		_ = s.auditRepo.LogEvent(ctx, auditEvent)
+	}
+
+	s.logger.Info("User updated successfully", 
+		zap.String("user_id", id.String()),
+		zap.String("email", existingUser.Email),
+		zap.String("actor", actorID))
+
+	return existingUser, nil
+}
+
+func (s *userService) Delete(ctx context.Context, id uuid.UUID, actorID string) error {
+	// Get user for audit logging
+	user, err := s.userRepo.GetByID(ctx, id)
+	if err != nil {
+		return err
+	}
+
+	// Delete user profile first
+	_ = s.profileRepo.Delete(ctx, id) // Don't fail if profile doesn't exist
+
+	// Delete user
+	err = s.userRepo.Delete(ctx, id)
+	if err != nil {
+		s.logger.Error("Failed to delete user", zap.String("id", id.String()), zap.Error(err))
+		return fmt.Errorf("failed to delete user: %w", err)
+	}
+
+	// Log audit event
+	if s.auditRepo != nil {
+		auditEvent := &interfaces.AuditEvent{
+			ID:           uuid.New(),
+			Type:         "user.deleted",
+			Severity:     "warn",
+			Status:       "success",
+			Timestamp:    time.Now().Format(time.RFC3339),
+			ActorID:      actorID,
+			ActorType:    "user",
+			ResourceID:   id.String(),
+			ResourceType: "user",
+			Action:       "delete",
+			Description:  fmt.Sprintf("User %s deleted", user.Email),
+			Details: map[string]interface{}{
+				"user_id": id.String(),
+				"email":   user.Email,
+			},
+		}
+		_ = s.auditRepo.LogEvent(ctx, auditEvent)
+	}
+
+	s.logger.Info("User deleted successfully", 
+		zap.String("user_id", id.String()),
+		zap.String("email", user.Email),
+		zap.String("actor", actorID))
+
+	return nil
+}
+
+func (s *userService) List(ctx context.Context, req *domain.ListUsersRequest) (*domain.ListUsersResponse, error) {
+	response, err := s.userRepo.List(ctx, req)
+	if err != nil {
+		s.logger.Error("Failed to list users", zap.Error(err))
+		return nil, fmt.Errorf("failed to list users: %w", err)
+	}
+
+	return response, nil
+}
+
+func (s *userService) UpdateLastLogin(ctx context.Context, id uuid.UUID) error {
+	err := s.userRepo.UpdateLastLogin(ctx, id)
+	if err != nil {
+		s.logger.Error("Failed to update last login", zap.String("id", id.String()), zap.Error(err))
+		return fmt.Errorf("failed to update last login: %w", err)
+	}
+
+	return nil
+}
+
+func (s *userService) ExistsByEmail(ctx context.Context, email string) (bool, error) {
+	exists, err := s.userRepo.ExistsByEmail(ctx, email)
+	if err != nil {
+		s.logger.Error("Failed to check email existence", zap.String("email", email), zap.Error(err))
+		return false, fmt.Errorf("failed to check email existence: %w", err)
+	}
+
+	return exists, nil
+}