Merge remote-tracking branch 'upstream/master' into feat/redirect-on-no-admin

Server/middleware/verifyOwnership.js

@@ -18,6 +18,17 @@ const verifyOwnership = (Model, paramName) => {
         throw error;
       }
 
+      // Special case for User model, as it will not have a `userId` field as other docs will
+      if (Model.modelName === "User") {
+        if (userId.toString() !== doc._id.toString()) {
+          const error = new Error(errorMessages.VERIFY_OWNER_UNAUTHORIZED);
+          error.status = 403;
+          throw error;
+        }
+        next();
+        return;
+      }
+
       // If the userID does not match the document's userID, return a 403 error
       if (userId.toString() !== doc.userId.toString()) {
         console.log(userId.toString(), doc.userId.toString());
@@ -26,9 +37,11 @@ const verifyOwnership = (Model, paramName) => {
         throw error;
       }
       next();
+      return;
     } catch (error) {
       error.service = SERVICE_NAME;
       next(error);
+      return;
     }
   };
 };

Server/validation/joi.js

@@ -14,6 +14,7 @@ const registerValidation = joi.object({
   lastname: joi.string().required(),
   email: joi.string().email().required(),
   password: joi.string().min(8).required(),
+  role: joi.string().required(),
 });
 
 const editUserParamValidation = joi.object({
@@ -24,6 +25,7 @@ const editUserBodyValidation = joi.object({
   firstname: joi.string(),
   lastname: joi.string(),
   profilePicUrl: joi.string(),
+  role: joi.string(),
 });
 
 const recoveryValidation = joi.object({