feat: block no admin users to access some routes

backend/src/controllers/SessionController.js

@@ -23,7 +23,10 @@ exports.store = async (req, res, next) => {
 		}
 	);
 
-	return res
-		.status(200)
-		.json({ token: token, username: user.name, userId: user.id });
+	return res.status(200).json({
+		token: token,
+		username: user.name,
+		profile: user.profile,
+		userId: user.id,
+	});
 };

backend/src/controllers/SettingController.js

@@ -2,12 +2,24 @@ const Setting = require("../models/Setting");
 const { getIO } = require("../libs/socket");
 
 exports.index = async (req, res) => {
+	if (req.user.profile !== "admin") {
+		return res
+			.status(403)
+			.json({ error: "Only administrators can access this route." });
+	}
+
 	const settings = await Setting.findAll();
 
 	return res.status(200).json(settings);
 };
 
 exports.update = async (req, res) => {
+	if (req.user.profile !== "admin") {
+		return res
+			.status(403)
+			.json({ error: "Only administrators can access this route." });
+	}
+
 	const io = getIO();
 	const { settingKey } = req.params;
 	const setting = await Setting.findByPk(settingKey);

backend/src/controllers/UserController.js

@@ -8,6 +8,12 @@ const Setting = require("../models/Setting");
 const { getIO } = require("../libs/socket");
 
 exports.index = async (req, res) => {
+	if (req.user.profile !== "admin") {
+		return res
+			.status(403)
+			.json({ error: "Only administrators can access this route." });
+	}
+
 	const { searchParam = "", pageNumber = 1 } = req.query;
 
 	const whereCondition = {