Admin restrictions

src/routes/index.js

@@ -11,7 +11,7 @@ import catchAsync from '../lib/catchAsync';
 const router = Router();
 
 router.use('/books', books);
-router.use('/users', users);
+router.use('/admin/users', users);
 router.use('/sessions', sessions);
 router.use('/loans', loans);
 

src/routes/users.js

@@ -25,8 +25,11 @@ router.get('/:id', ensureLoggedIn(), catchAsync(async (req, res) => {
 // View all users
 router.get('/', ensureLoggedIn(), catchAsync(async (req, res) => {
   const users = await User.findAll({});
-
-  res.render('users/index', {users});
+  if(req.user.role == 'Borrower') {
+	  res.redirect('/');
+  } else {
+  	res.render('users/index', {users});
+  }
 }));
 
 // Update a user
@@ -41,7 +44,7 @@ router.post('/:id', ensureLoggedIn(), catchAsync(async (req, res) => {
   try {
     await user.save();
     req.flash('info', 'User updated successfully');
-    res.redirect('/users');
+    res.redirect('/admin/users');
   } catch(e) {
     console.warn(e);
     res.render('users/edit', {user, error: e.toString()});

src/views/index.ejs

@@ -10,10 +10,9 @@
   <li><a href='/books'>View available books</a></li>
 
   <% if (!currentUser) { %>
-    <li><a href='/users/new'>Sign up</a></li>
+    <li><a href='/admin/users/new'>Sign up</a></li>
     <li><a href='/sessions/new'>Sign in</a></li>
   <% } else { %>
-    <li><a href='/users'>List of Users</a></li>
     <li>
       <form action='/sessions/destroy' method='post'>
         <button type='submit'>Logout</button>

src/views/users/index.ejs

@@ -3,9 +3,11 @@
     UserID: <%- users.id %>
     Email: <%- users.email %>
     Role: <%- users.role %>
-    <a href="/users/<%- users.id %>">Edit</a>
+    <a href="/admin/users/<%- users.id %>">Edit</a>
   </p>
   <hr>
 <% }) %>
 
+
 <p><a href='/'>Home</a></p>
+

src/views/users/new.ejs

@@ -8,7 +8,7 @@
 
 <p>Sign up</p>
 
-<form action='/users' method='post'>
+<form action='/admin/users' method='post'>
 
   <p>
     <label>