a lot of things

src/api/user/@me/update.ts

@@ -1,13 +1,22 @@
 import { ContentfulStatusCode } from "hono/utils/http-status";
+import { z } from "zod";
 import { apiResponse } from "../../../modules/api-utils/apiResponse";
 import { createRoute } from "../../../modules/api-utils/createRoute";
 import { authMiddleware } from "../../middleware/authorization";
 
+const updateSchema = z
+  .object({
+    name: z.string().optional(),
+    image: z.string().optional(),
+  })
+  .strict();
+
 export default createRoute(
   "patch",
   ["/@me"],
   async (c) => {
-    const updatedUser = await c.get("user")?.update(await c.req.json());
+    const body = updateSchema.parse(await c.req.json());
+    const updatedUser = await c.get("user")?.update(body);
     const response = apiResponse.successful(
       "Successfully updated user.",
       updatedUser?.toJson(),

src/api/user/checkPermission.ts

@@ -0,0 +1,47 @@
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { z } from "zod";
+import { apiResponse } from "../../modules/api-utils/apiResponse";
+import { createRoute } from "../../modules/api-utils/createRoute";
+import { authMiddleware } from "../middleware/authorization";
+import { users } from "../../managers/users";
+import GenericError from "../../Errors/GenericError";
+
+const checkPermissionSchema = z.object({
+  permissions: z
+    .array(z.string().min(1, "Permission node cannot be empty"))
+    .min(1, "At least one permission is required"),
+});
+
+/* POST /v1/user/users/:identifier/check-permission */
+export default createRoute(
+  "post",
+  ["/users/:identifier/check-permission"],
+
+  async (c) => {
+    const identifier = c.req.param("identifier");
+
+    const user = await users.fetchUser({ id: identifier });
+    if (!user)
+      throw new GenericError({
+        name: "UserNotFound",
+        message: `User with identifier '${identifier}' was not found.`,
+        status: 404,
+      });
+
+    const body = await c.req.json();
+    const { permissions } = checkPermissionSchema.parse(body);
+
+    const results = await Promise.all(
+      permissions.map(async (permission) => ({
+        permission,
+        hasPermission: await user.hasPermission(permission),
+      })),
+    );
+
+    const response = apiResponse.successful("Permission check completed.", {
+      results,
+    });
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["user.read.other"] }),
+);

src/api/user/delete.ts

@@ -0,0 +1,34 @@
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { apiResponse } from "../../modules/api-utils/apiResponse";
+import { createRoute } from "../../modules/api-utils/createRoute";
+import { authMiddleware } from "../middleware/authorization";
+import { users } from "../../managers/users";
+import GenericError from "../../Errors/GenericError";
+
+/* DELETE /v1/user/users/:identifier */
+export default createRoute(
+  "delete",
+  ["/users/:identifier"],
+
+  async (c) => {
+    const identifier = c.req.param("identifier");
+
+    const user = await users.fetchUser({ id: identifier });
+    if (!user)
+      throw new GenericError({
+        name: "UserNotFound",
+        message: `User with identifier '${identifier}' was not found.`,
+        status: 404,
+      });
+
+    const userData = user.toJson();
+    await users.deleteUser(user.id);
+
+    const response = apiResponse.successful(
+      "User Deleted Successfully!",
+      userData,
+    );
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["user.delete.other"] }),
+);

src/api/user/fetch.ts

@@ -0,0 +1,31 @@
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { apiResponse } from "../../modules/api-utils/apiResponse";
+import { createRoute } from "../../modules/api-utils/createRoute";
+import { authMiddleware } from "../middleware/authorization";
+import { users } from "../../managers/users";
+import GenericError from "../../Errors/GenericError";
+
+/* GET /v1/user/users/:identifier */
+export default createRoute(
+  "get",
+  ["/users/:identifier"],
+
+  async (c) => {
+    const identifier = c.req.param("identifier");
+
+    const user = await users.fetchUser({ id: identifier });
+    if (!user)
+      throw new GenericError({
+        name: "UserNotFound",
+        message: `User with identifier '${identifier}' was not found.`,
+        status: 404,
+      });
+
+    const response = apiResponse.successful(
+      "User Fetched Successfully!",
+      user.toJson(),
+    );
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["user.read.other"] }),
+);

src/api/user/fetchAll.ts

@@ -0,0 +1,23 @@
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { apiResponse } from "../../modules/api-utils/apiResponse";
+import { createRoute } from "../../modules/api-utils/createRoute";
+import { authMiddleware } from "../middleware/authorization";
+import { users } from "../../managers/users";
+
+/* GET /v1/user/users */
+export default createRoute(
+  "get",
+  ["/users"],
+
+  async (c) => {
+    const allUsers = await users.fetchAllUsers();
+    const usersArray = allUsers.map((u) => u.toJson());
+
+    const response = apiResponse.successful(
+      "Users Fetched Successfully!",
+      usersArray,
+    );
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["user.read.other", "user.list.other"] }),
+);

src/api/user/fetchRoles.ts

@@ -0,0 +1,34 @@
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { apiResponse } from "../../modules/api-utils/apiResponse";
+import { createRoute } from "../../modules/api-utils/createRoute";
+import { authMiddleware } from "../middleware/authorization";
+import { users } from "../../managers/users";
+import GenericError from "../../Errors/GenericError";
+
+/* GET /v1/user/users/:identifier/roles */
+export default createRoute(
+  "get",
+  ["/users/:identifier/roles"],
+
+  async (c) => {
+    const identifier = c.req.param("identifier");
+
+    const user = await users.fetchUser({ id: identifier });
+    if (!user)
+      throw new GenericError({
+        name: "UserNotFound",
+        message: `User with identifier '${identifier}' was not found.`,
+        status: 404,
+      });
+
+    const roles = await user.fetchRoles();
+    const rolesArray = roles.map((r) => r.toJson({ viewPermissions: true }));
+
+    const response = apiResponse.successful(
+      "User Roles Fetched Successfully!",
+      rolesArray,
+    );
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["user.read.other", "role.read"] }),
+);

src/api/user/index.ts

@@ -0,0 +1,6 @@
+export { default as fetch } from "./fetch";
+export { default as fetchAll } from "./fetchAll";
+export { default as update } from "./update";
+export { default as deleteUser } from "./delete";
+export { default as fetchRoles } from "./fetchRoles";
+export { default as checkPermission } from "./checkPermission";

src/api/user/update.ts

@@ -0,0 +1,68 @@
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { z } from "zod";
+import { apiResponse } from "../../modules/api-utils/apiResponse";
+import { createRoute } from "../../modules/api-utils/createRoute";
+import { authMiddleware } from "../middleware/authorization";
+import { users } from "../../managers/users";
+import GenericError from "../../Errors/GenericError";
+
+const updateSchema = z
+  .object({
+    name: z.string().optional(),
+    image: z.string().optional(),
+    roles: z.array(z.string()).optional(),
+    permissions: z.array(z.string()).optional(),
+  })
+  .strict();
+
+/* PATCH /v1/user/users/:identifier */
+export default createRoute(
+  "patch",
+  ["/users/:identifier"],
+
+  async (c) => {
+    const identifier = c.req.param("identifier");
+    const requestingUser = c.get("user");
+
+    const user = await users.fetchUser({ id: identifier });
+    if (!user)
+      throw new GenericError({
+        name: "UserNotFound",
+        message: `User with identifier '${identifier}' was not found.`,
+        status: 404,
+      });
+
+    const body = updateSchema.parse(await c.req.json());
+
+    if (body.roles && !(await requestingUser.hasPermission("user.roles.other")))
+      throw new GenericError({
+        name: "InsufficientPermission",
+        message: "You do not have permission to modify roles on another user.",
+        status: 403,
+      });
+
+    if (
+      body.permissions &&
+      !(await requestingUser.hasPermission("user.permissions.other"))
+    )
+      throw new GenericError({
+        name: "InsufficientPermission",
+        message:
+          "You do not have permission to modify permissions on another user.",
+        status: 403,
+      });
+
+    const { roles: roleIds, permissions, ...profileData } = body;
+
+    if (Object.keys(profileData).length > 0) await user.update(profileData);
+    if (roleIds) await user.setRoles(roleIds);
+    if (permissions) await user.setPermissions(permissions);
+
+    const response = apiResponse.successful(
+      "User Updated Successfully!",
+      user.toJson(),
+    );
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["user.write.other"] }),
+);