AGENTS.md

@@ -32,7 +32,7 @@ alembic/           # Database migrations
 ## Seed data
 
 Users and units are auto-seeded on first startup via lifespan hook:
-- 16 users covering all roles (Admin/Jerome, Admin/Wahab, CS Rep, CS Manager, FM Dispatcher, Tech, CEO, Director)
+- 17 users covering all roles (Admin/Jerome, Admin/Wahab, CS Rep, CS Manager, FM Dispatcher, Tech, CEO, Director)
 - 120 apartment units (East/West, 10 floors × 6 apts per wing)
 - Default password for all seed users: `denya123`
 - Units load from `apartment_mapping.json` if present, else built-in fallback
@@ -46,6 +46,7 @@ Users and units are auto-seeded on first startup via lifespan hook:
 | POST | `/api/auth/login` | No | Get JWT tokens |
 | POST | `/api/auth/refresh` | Token | Refresh tokens |
 | GET | `/api/auth/me` | Bearer | Current user |
+| GET | `/api/auth/admin-only` | Admin/Jerome, Admin/Wahab | RBAC demo endpoint |
 | POST | `/api/whatsapp/mock` | No | Mock WhatsApp |
 | GET | `/api/whatsapp/mock-log` | No | Recent mock submissions |
 
@@ -53,7 +54,7 @@ Users and units are auto-seeded on first startup via lifespan hook:
 
 - JWT access (30min) + refresh (7d) tokens
 - Roles: CS Rep, CS Manager, FM Dispatcher, Admin/Jerome, Admin/Wahab, Tech, CEO, Director
-- Use `require_roles("Admin/Jerome", "CEO")` dependency for RBAC
+- Use `require_roles("Admin/Jerome", "Admin/Wahab")` dependency for RBAC
 - `sub` claim holds string user ID
 
 ## Database