3 files changed, 56 insertions, 3 deletions
diff --git a/src/routes/auth.rs b/src/routes/auth.rs
index a7191e2..0c459f5 100644
--- a/src/routes/auth.rs
+++ b/src/routes/auth.rs
@@ -18,7 +18,12 @@ pub fn create_route() -> Router {
 /// Make login. Check if a user with the email and password passed in request body exists into the
 /// database
 async fn make_login(Json(payload): Json<LoginCredentials>) -> Result<Json<AuthBody>, AppError> {
-    let user = User::new(String::new(), String::new(), payload.username, payload.password);
+    let user = User::new(
+        String::new(),
+        String::new(),
+        payload.username,
+        payload.password,
+    );
     match User::find(user).await {
         Ok(user) => {
             let claims = Claims::new(user.id);
diff --git a/src/routes/model.rs b/src/routes/model.rs
index 8c2e656..5fe75a1 100644
--- a/src/routes/model.rs
+++ b/src/routes/model.rs
@@ -119,6 +119,8 @@ async fn edit_model(
         payload.material,
         claims.user_id,
     );
+
+    // NOTE: can we edit this as same as `user.edit_avatar()`?
     Model::edit(model.id, model_body).await?;
     Ok(Json(model))
 }
diff --git a/src/routes/user.rs b/src/routes/user.rs
index bc87bf5..5dc2c37 100644
--- a/src/routes/user.rs
+++ b/src/routes/user.rs
@@ -3,7 +3,7 @@ use crate::{
     files::{delete_upload, upload},
     models::{
         auth::Claims,
-        user::{User, UserList},
+        user::{User, UserEdit, UserList},
     },
     pagination::{ModelPagination, Pagination, UserPagination},
 };
@@ -19,7 +19,7 @@ pub fn create_route() -> Router {
         .route("/", get(list_users))
         .route("/me", get(get_me))
         .route("/me/avatar", put(edit_my_avatar).delete(delete_my_avatar))
-        .route("/:id", get(get_user))
+        .route("/:id", get(get_user).put(edit_user))
         .route("/:id/models", get(get_user_models))
 }
 
@@ -103,6 +103,52 @@ async fn get_user(Path(user_id): Path<i32>) -> Result<Json<UserList>, AppError>
     }
 }
 
+/// Edit an user with id = `user_id`. Only staffers and owner of that account can perform this
+/// action
+async fn edit_user(
+    Path(user_id): Path<i32>,
+    Json(payload): Json<UserEdit>,
+    claims: Claims,
+) -> Result<Json<UserList>, AppError> {
+    let mut user = match User::find_by_id(user_id).await {
+        Ok(user) => user,
+        Err(_) => {
+            return Err(AppError::NotFound("User not found".to_string()));
+        }
+    };
+
+    let claimed = match User::find_by_id(claims.user_id).await {
+        Ok(user) => user,
+        Err(_) => {
+            return Err(AppError::NotFound("User not found".to_string()));
+        }
+    };
+
+    if !(claimed.id == user.id || claimed.is_staff.unwrap()) {
+        return Err(AppError::Unauthorized);
+    }
+
+    if user.email != payload.email {
+        if User::email_has_taken(&payload.email).await? {
+            return Err(AppError::BadRequest(
+                "An user with this email already exists".to_string(),
+            ));
+        }
+    }
+
+    if user.username != payload.username {
+        if User::username_has_taken(&payload.username).await? {
+            return Err(AppError::BadRequest(
+                "An user with this username already exists".to_string(),
+            ));
+        }
+    }
+
+    user.edit(payload).await?;
+
+    Ok(Json(user))
+}
+
 /// Get user models list
 async fn get_user_models(
     Path(user_id): Path<i32>,