Create users controllers

[boiboi796]

##What I did:
I created the users controllers in the users folder.

[a-k-o-r-e-d-e]

This should a role guard

[a-k-o-r-e-d-e]

Role Guard

[Copilot]

Pull request overview

This PR adds a new Users module (controller/service/repository + DTOs and basic tests) and wires it into the existing NestJS application, alongside a small schema tightening for the users table.

Changes:

• Added UsersController, UsersService, UsersRepository, and UsersModule under src/users/.
• Added CreateUserDto validation for user creation.
• Updated DB schema to make several user columns non-null and added jsonwebtoken dependency.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
src/users/users.service.ts	Implements basic user operations and admin check.
src/users/users.service.spec.ts	Adds a minimal UsersService test scaffold.
src/users/users.repository.ts	Adds Drizzle repository methods for users CRUD reads/inserts.
src/users/users.module.ts	Declares Users module with controller/service and DB import.
src/users/users.controller.ts	Exposes /users endpoints including “admin-only” reads.
src/users/users.controller.spec.ts	Adds a minimal UsersController test scaffold.
src/users/dto/users-dto.ts	Introduces DTO + validation rules for user creation.
src/transactions/dto/create-transaction.dto.ts	Removes an unused validator import.
src/db/schema.ts	Makes user fields non-null and reformats schema definition.
src/app.module.ts	Minor formatting-only change.
package.json	Adds jsonwebtoken dependency.
package-lock.json	Locks jsonwebtoken and transitive dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Authorization is based on a client-supplied adminId query param, which can be trivially spoofed (any user can pass an admin's id). Replace this with server-validated authentication (e.g., derive the caller identity from an auth token / session) and a role check, rather than trusting request parameters.

[Copilot]

CreateUserDto uses the property name passwordHash, but it is validated as a strong password and is passed straight into the password_hash DB column. This strongly suggests the API is accepting a plaintext password but storing it as-is; rename the field to password, hash it in the service, and only persist the hash.

Suggested change

	@Injectable()
	export class UsersService {
	constructor(private readonly usersRepository: UsersRepository) {}
	async create(createUserDto: CreateUserDto) {
	return this.usersRepository.create(createUserDto);
	import * as bcrypt from 'bcrypt';
	@Injectable()
	export class UsersService {
	constructor(private readonly usersRepository: UsersRepository) {}
	async create(createUserDto: CreateUserDto) {
	const hashedPassword = await bcrypt.hash(createUserDto.passwordHash, 10);
	const userToCreate = { ...createUserDto, passwordHash: hashedPassword };
	return this.usersRepository.create(userToCreate);

[Copilot]

findAll() selects and returns all user columns, including passwordHash. Even for admin-only endpoints, returning password hashes is unsafe and unnecessary. Select only non-sensitive fields (e.g., id, name, email, userType) or map results to omit passwordHash before returning.

Suggested change

	.select()
	.from(users);
	}
	//for admin use only
	async findById(id: number) {
	return this.dbClient.select()
	.select({
	id: users.id,
	name: users.name,
	email: users.email,
	userType: users.userType,
	})
	.from(users);
	}
	//for admin use only
	async findById(id: number) {
	return this.dbClient
	.select({
	id: users.id,
	name: users.name,
	email: users.email,
	userType: users.userType,
	})

[Copilot]

findById() selects and returns all user columns, including passwordHash, which should never be exposed via API responses. Restrict the selected columns or strip passwordHash from the returned object(s).

Suggested change

	return this.dbClient
	.select()
	.from(users);
	}
	//for admin use only
	async findById(id: number) {
	return this.dbClient.select()
	.from(users)
	.where(eq(users.id, id));
	const results = await this.dbClient
	.select()
	.from(users);
	return results.map(({ passwordHash, ...userWithoutPasswordHash }) => userWithoutPasswordHash);
	}
	//for admin use only
	async findById(id: number) {
	const results = await this.dbClient
	.select()
	.from(users)
	.where(eq(users.id, id));
	return results.map(({ passwordHash, ...userWithoutPasswordHash }) => userWithoutPasswordHash);

[Copilot]

The comment says "sert"; correct the typo to "set" ("... set to user by default").

Suggested change

	.default(UserType.USER), // ADMIN or USER sert to user by default
	.default(UserType.USER), // ADMIN or USER set to user by default

[Copilot]

UsersService injects UsersRepository, but UsersRepository is not registered in UsersModule providers. This will cause Nest to fail to resolve the dependency at runtime; add UsersRepository to the module's providers (and export it if other modules need it).

Suggested change

	@Module({
	providers: [UsersService],
	import { UsersRepository } from './users.repository';
	@Module({
	providers: [UsersService, UsersRepository],

[Copilot]

This controller test registers UsersController without providing its UsersService dependency, so Nest will fail to instantiate the controller. Add UsersService to providers (and mock its dependencies) or override the provider with a mock.

[Copilot]

jsonwebtoken was added as a dependency but isn't used anywhere in the repository. If this PR doesn't introduce JWT usage yet, consider removing it to avoid extra supply-chain surface area and keep dependencies minimal.

Suggested change

"jsonwebtoken": "^9.0.3",

[Copilot]

This unit test module only provides UsersService, but UsersService requires UsersRepository. The test will fail to compile unless you provide UsersRepository (and its DB dependency) or mock UsersRepository in the providers array.

Suggested change

	describe('UsersService', () => {
	let service: UsersService;
	beforeEach(async () => {
	const module: TestingModule = await Test.createTestingModule({
	providers: [UsersService],
	import { UsersRepository } from './users.repository';
	describe('UsersService', () => {
	let service: UsersService;
	beforeEach(async () => {
	const module: TestingModule = await Test.createTestingModule({
	providers: [
	UsersService,
	{
	provide: UsersRepository,
	useValue: {},
	},
	],