Users who are not admin or sec cant change stuff

Author: david-rocca

src/controller/org.controller/org.controller.js

@@ -797,7 +797,7 @@ async function createUser (req, res, next) {
     if (!isSecretariat && isAdmin) {
       if (requesterOrgUUID !== orgUUID) {
         await session.abortTransaction(); session.endSession()
-        return res.status(403).json(error.notOrgAdminOrSecretariat()) // The Admin user must belong to the new user's organization
+        return res.status(403).json(error.notOrgAdminOrSecretariatUpdate()) // The Admin user must belong to the new user's organization
       }
     }
 
@@ -928,6 +928,7 @@ async function updateUser (req, res, next) {
     }
 
     const queryParameters = req.ctx.query
+
     // Specific check for org_short_name (Secretariat only)
     if (queryParameters.org_short_name && !isRequesterSecretariat) {
       logger.info({ uuid: req.ctx.uuid, message: 'Only Secretariat can reassign user organization.' })
@@ -954,6 +955,14 @@ async function updateUser (req, res, next) {
       }
     }
 
+    if (!isRequesterSecretariat && !isAdmin) {
+      if (targetUserUUID !== requesterUUID) {
+        logger.info({ uuid: req.ctx.uuid, message: 'Only Secretariat can reassign user organization.' })
+        await session.abortTransaction(); await session.endSession()
+        return res.status(403).json(error.notSameUserOrSecretariatUpdate())
+      }
+    }
+
     // handlers
     const handlers = {}
     const keys = Object.keys(queryParameters)