Add initial users manager

server/routes/users.route.ts

@@ -2,25 +2,48 @@ import express, { Router } from 'express';
 import { controller } from '@controllers/index';
 import { service } from '@services/index';
 import { ApiError } from '@utils/index';
+import { validation } from '@validations/index';
+import { validateRequest } from '@validations/shared.validation';
 import { authenticateAdmin } from '../middleware/authenticate-admin';
 
 export const router: Router = express.Router({ mergeParams: true });
 
 router
   .route('/')
-  .get(authenticateAdmin, controller.users.getUserList)
-  .post(authenticateAdmin, controller.users.createUser);
+  .get(
+    authenticateAdmin,
+    validateRequest(validation.users.list),
+    controller.users.getUserList
+  )
+  .post(
+    authenticateAdmin,
+    validateRequest(validation.users.createUser),
+    controller.users.createUser
+  );
 
 router.param('userId', async (req, _res, next, userId) => {
-  await service.users.findById(req.authUser, { id: userId });
+  const user = await service.users.findById(req.authUser, { id: userId });
 
-  if (req.authUser.isAdmin || req.authUser.id === userId) {
+  if (req.authUser.id === userId) {
     return next();
   }
 
-  throw ApiError.forbidden('You are not allowed to access this resource');
+  // Only superadmins can modify other admins
+  if (user.isAdmin && !req.authUser.isSuperAdmin) {
+    throw ApiError.forbidden('You are not authorized to access this resource');
+  }
+
+  return next();
 });
 
-router.route('/:userId/update').post(controller.users.updateUser);
-
-router.route('/:userId/delete').post(controller.users.deleteUser);
+router
+  .route('/:userId')
+  .get(validateRequest(validation.users.detail), controller.users.getUserDetail)
+  .patch(
+    validateRequest(validation.users.updateUser),
+    controller.users.updateUser
+  )
+  .delete(
+    validateRequest(validation.users.deleteUser),
+    controller.users.deleteUser
+  );