Phase 2

.github/workflows/ci-cd.yml

@@ -103,3 +103,25 @@ jobs:
 
       - name: Deployed to Docker Hub
         run: echo "Deployed to Docker Hub"
+
+  deploy:
+    name: Deploy to VPS
+    runs-on: ubuntu-latest
+    needs: build-and-push
+
+    steps:
+      - name: Deploy via SSH
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.SERVER_HOST }}
+          username: ${{ secrets.SERVER_USER }}
+          key: ${{ secrets.SERVER_SSH_KEY }}
+          port: 22
+          script: |
+            cd ~/notifierapi
+
+            sudo docker compose pull
+
+            sudo docker compose up -d
+
+            sudo docker image prune -f

src/controllers/auth/login.js

@@ -37,6 +37,10 @@ const login = async (req, res) => {
       user: {
         id: user.id,
         email: user.email,
+        name: user.name,
+        role: user.role,
+        profilePictureUrl: user.profilePictureUrl,
+        isEmailVerified: user.isEmailVerified,
       },
     },
   });

src/controllers/users/getAnnouncementStatus.js

@@ -8,6 +8,11 @@ const getUserAnnouncementStatus = async (req, res) => {
   const { status: userStatus } = req.query; // Validated and parsed by Zod middleware
   const skip = (page - 1) * limit;
 
+  // Authorization Check
+  if (req.user.role !== "ADMIN" && req.user.id !== userId) {
+    throw new AppError("Not authorized", 403);
+  }
+
   // Check if user exists
   const user = await prisma.user.findUnique({
     where: { id: userId },

src/routes/users.js

@@ -42,7 +42,6 @@ router.delete("/:id", authorize("ADMIN"), asyncHandler(deleteUser));
 
 router.get(
   "/:id/announcements",
-  authorize("ADMIN"),
   validateRequest(statusQuerySchema, "query"),
   asyncHandler(getUserAnnouncementStatus),
 ); // Query params for key "status" should be either "read" or "unread"