fix(users-controller):

Author: chernetManaye

src/app.js

@@ -3,6 +3,7 @@ const express = require("express");
 const cookieParser = require("cookie-parser");
 const globalErrorHandler = require("./error/middleware");
 const { authorizeFromToken } = require("./auth/middleware");
+const CustomError = require("./error/utils/customError");
 
 const app = express();
 
@@ -22,7 +23,7 @@ app.use("/api/v1/notifications", require("./notification/routes"));
 app.use("/api/v1/products", require("./product/routes"));
 app.use("/api/v1/upload", require("./upload/routes"));
 
-// app.use("/api/v1/users", require("./user/routes"));
+app.use("/api/v1/users", require("./user/routes"));
 app.use("/api/v1/orders", require("./order/routes"));
 app.use("/api/v1/payments", require("./payment/routes"));
 app.use("/api/v1/referrals", require("./referral/routes"));

src/user/controller.js

@@ -1,14 +1,12 @@
 const User = require("./model");
 const asyncErrorHandler = require("../utils/asyncErrorHandler");
+const CustomError = require("../error/utils/customError");
 
 // Get all users
 const getUsers = asyncErrorHandler(async (req, res) => {
   const users = await User.find();
   if (!users) {
-    return res.status(404).json({
-      success: false,
-      message: "No users found",
-    });
+    throw new CustomError("No users found", 404);
   }
 
   res.status(200).json({
@@ -38,62 +36,17 @@ const getUserById = asyncErrorHandler(async (req, res) => {
 
 // Update user by ID
 const updateUser = asyncErrorHandler(async (req, res) => {
-  const { id } = req.params;
-  const { operation } = req.body;
+  const user = await User.findByIdAndUpdate(req.params.id, req.body, {
+    new: true,
+  });
 
-  const user = await User.findById(id);
   if (!user) throw new CustomError("User not found", 404);
 
-  switch (operation) {
-    case "UPDATE_PROFILE":
-      Object.assign(user, req.body);
-      await user.save();
-      return res.status(200).json({
-        success: true,
-        message: "Profile updated successfully",
-        user,
-      });
-
-    case "UPDATE_PASSWORD":
-      const { currentPassword, newPassword } = req.body;
-      // Check current password
-      const isMatch = await bcrypt.compare(currentPassword, user.password);
-      if (!isMatch) throw new CustomError("Current password is incorrect", 401);
-
-      // Hash new password
-      user.password = await bcrypt.hash(newPassword, 12);
-      await user.save();
-      return res.status(200).json({
-        success: true,
-        message: "Password updated successfully",
-      });
-
-    case "UPDATE_ROLE":
-      // Middleware already ensures req.user.role === 'ADMIN'
-      // middleware already ensures req.role esists
-
-      user.role = role;
-      await user.save();
-
-      // Generate a new JWT since the user's role changed
-      const newToken = signJwtToken(user._id, user.username, user.role);
-
-      // Send new token in cookie
-      res.cookie("jwt-token", newToken, {
-        httpOnly: true,
-        secure: process.env.NODE_ENV === "production",
-        maxAge: 24 * 60 * 60 * 1000, // 1 day
-      });
-
-      return res.status(200).json({
-        success: true,
-        message: "Role updated successfully",
-        data: { _id: user._id, role: user.role },
-      });
-
-    default:
-      throw new CustomError("Invalid operation", 400);
-  }
+  res.status(200).json({
+    success: true,
+    message: "User updated successfully!",
+    user,
+  });
 });
 
 // Delete user by ID
@@ -103,39 +56,15 @@ const deleteUser = asyncErrorHandler(async (req, res, next) => {
 
   if (!deletedUser) throw new CustomError("User not found", 404);
 
-  // Extract cart and preferences from deleted user
-  const {
-    cart = [],
-    preferences = { theme: "light" },
-    settings = {},
-  } = deletedUser;
-
-  // Clear auth cookies (JWT + session)
-  res.clearCookie("jwt-token", {
-    httpOnly: true,
-    secure: process.env.NODE_ENV === "production",
-  });
-
-  // Initialize guest session using user's previous data
-  req.session.guest = true;
-  req.session.cart = cart;
-  req.session.preferences = preferences;
-  req.session.settings = settings;
-  req.session.consent = {
-    necessary: true,
-    preferences: true,
-    settings: true,
-    analytics: false,
-    marketing: false,
-  };
+  // res.clearCookie("access-token", {
+  //   httpOnly: true,
+  //   secure: process.env.NODE_ENV === "production",
+  // });
 
   // Respond
   res.status(200).json({
     success: true,
-    message: "Account deleted. Guest session initialized.",
-    sessionId: req.sessionID,
-    cart: req.session.cart,
-    preferences: req.session.preferences,
+    message: "Account deleted successfully!",
   });
 });
 

src/user/routes.js

@@ -5,28 +5,13 @@ const {
   getUsers,
   deleteUser,
 } = require("./controller");
-const {
-  protect,
-  restrictToOwner,
-  sanitizeUserUpdate,
-} = require("../auth/middleware");
-
-const { validateUpdateUser } = require("./validator");
 
 router.get("/", getUsers);
 
-router.get("/:id", protect, restrictToOwner, getUserById);
-// PATCH /users/:id → Update own user data (sanitize forbidden fields)
-router.patch(
-  "/:id",
-  protect,
-  restrictToOwner,
-  sanitizeUserUpdate,
-  validateUpdateUser,
-  updateUser,
-);
+router.get("/:id", getUserById);
+
+router.patch("/:id", updateUser);
 
-// DELETE /users/:id → Delete own account
-router.delete("/:id", protect, restrictToOwner, deleteUser);
+router.delete("/:id", deleteUser);
 
 module.exports = router;