Feat: implement new role for admin

src/middleware/auth.js

@@ -27,3 +27,8 @@ export const adminProtect = asyncHandler((req) => {
   if (req.headers['x-api-key'] === process.env.API_ACCESS_KEY) return;
   if (req.user.role !== 'ADMIN') throw new createError(403, 'You are not permitted to access this resource');
 });
+
+export const externalPartyProtect = asyncHandler((req) => {
+  if (req.headers['x-api-key'] === process.env.API_ACCESS_KEY) return;
+  if (req.user.role !== 'SPECTATOR') throw new createError(403, 'You are not permitted to access this resource');
+});

src/models/user.js

@@ -45,7 +45,7 @@ const UserSchema = new mongoose.Schema(
     },
     role: {
       type: String,
-      enum: ['ADMIN', 'GROUP'],
+      enum: ['ADMIN', 'GROUP', 'SPECTATOR'],
       default: 'GROUP'
     },
     members: {

src/routes/index.routes.js

@@ -1,5 +1,5 @@
 import express from 'express';
-import { adminProtect, protect } from '@/middleware/auth';
+import { adminProtect, externalPartyProtect, protect } from '@/middleware/auth';
 import authRouter from './auth.routes';
 import dashboardRouter from './dashboard.routes';
 import leaderboardRouter from './leaderboard.routes';
@@ -15,7 +15,7 @@ router.use('/auth', authRouter);
 router.use('/submissions', protect, submissionRouter);
 router.use('/users', protect, userRouter);
 router.use('/questions', protect, questionRouter);
-router.use('/dashboard', protect, adminProtect, dashboardRouter);
+router.use('/dashboard', protect, externalPartyProtect, adminProtect, dashboardRouter);
 router.use('/leaderboard', leaderboardRouter);
 router.use('/settings', protect, settingRouter);
 router.use('/storage', protect, adminProtect, storageRouter);

src/routes/user.routes.js

@@ -2,7 +2,7 @@ import express from 'express';
 import { tracedAsyncHandler } from '@sliit-foss/functions';
 import { Segments, celebrate } from 'celebrate';
 import { changePassword, create, eliminateTeams, getAll, getById, update } from '@/controllers/user';
-import { adminProtect } from '@/middleware/auth';
+import { adminProtect, externalPartyProtect } from '@/middleware/auth';
 import {
   addUserSchema,
   changePasswordSchema,
@@ -14,7 +14,7 @@ import {
 const users = express.Router();
 
 users.post('/', adminProtect, celebrate({ [Segments.BODY]: addUserSchema }), tracedAsyncHandler(create));
-users.get('/', adminProtect, tracedAsyncHandler(getAll));
+users.get('/', externalPartyProtect, adminProtect, tracedAsyncHandler(getAll));
 users.get('/:id', celebrate({ [Segments.PARAMS]: userIdSchema }), adminProtect, tracedAsyncHandler(getById));
 users.patch(
   '/change_password',

src/services/user.js

@@ -51,8 +51,7 @@ export const addNewUser = async (payload) => {
   const newUser = await createUser({
     ...payload,
     password: encryptedPassword,
-    is_verified: true,
-    role: 'ADMIN'
+    is_verified: true
   });
   try {
     await sendAdminPassword(payload.email, generatedPassword);

src/validations/user.js

@@ -3,7 +3,8 @@ import { genders, mealPreferences } from '@/models/user';
 
 export const addUserSchema = {
   name: Joi.string().required(),
-  email: Joi.string().email().required()
+  email: Joi.string().email().required(),
+  role: Joi.string().valid('ADMIN', 'SPECTATOR').required()
 };
 
 export const userIdSchema = {