teamcopilot 0.0.1

package/dist/reset-password.js

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const dotenv_1 = __importDefault(require("dotenv"));
+dotenv_1.default.config();
+const promises_1 = require("node:readline/promises");
+const node_process_1 = require("node:process");
+const bcryptjs_1 = __importDefault(require("bcryptjs"));
+const client_1 = __importDefault(require("./prisma/client"));
+const password_policy_1 = require("./utils/password-policy");
+const cli_bootstrap_1 = require("./utils/cli-bootstrap");
+async function resolveEmailArgOrPrompt() {
+    const argEmail = process.argv[2];
+    if (argEmail && argEmail.trim().length > 0) {
+        return argEmail.trim();
+    }
+    const rl = (0, promises_1.createInterface)({ input: node_process_1.stdin, output: node_process_1.stdout });
+    try {
+        while (true) {
+            const answer = (await rl.question('Enter email: ')).trim();
+            if (/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(answer)) {
+                return answer;
+            }
+            console.error('Invalid email address. Please try again.');
+        }
+    }
+    finally {
+        rl.close();
+    }
+}
+async function resolveTempPasswordOrPrompt() {
+    const rl = (0, promises_1.createInterface)({ input: node_process_1.stdin, output: node_process_1.stdout });
+    try {
+        while (true) {
+            const answer = (await rl.question(`Enter temporary password (min ${password_policy_1.MIN_PASSWORD_LENGTH} chars): `)).trim();
+            if ((0, password_policy_1.isPasswordValid)(answer)) {
+                return answer;
+            }
+            console.error(`${(0, password_policy_1.getPasswordPolicyErrorMessage)()}. Please try again.`);
+        }
+    }
+    finally {
+        rl.close();
+    }
+}
+async function main() {
+    await (0, cli_bootstrap_1.bootstrapCliDatabaseAccess)();
+    const email = await resolveEmailArgOrPrompt();
+    const tempPassword = await resolveTempPasswordOrPrompt();
+    const user = await client_1.default.users.findUnique({ where: { email } });
+    if (!user) {
+        console.error(`No user found with email: ${email}`);
+        process.exit(1);
+    }
+    const passwordHash = await bcryptjs_1.default.hash(tempPassword, 12);
+    await client_1.default.users.update({
+        where: { id: user.id },
+        data: {
+            password_hash: passwordHash,
+            must_change_password: true,
+            reset_token: null,
+            reset_token_expires_at: null
+        }
+    });
+    console.log(`Temporary password set for ${user.email}. Password change is required on next sign in.`);
+    await client_1.default.$disconnect();
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});

package/dist/rotate-jwt-secret.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const dotenv_1 = __importDefault(require("dotenv"));
+dotenv_1.default.config();
+const client_1 = __importDefault(require("./prisma/client"));
+const cli_bootstrap_1 = require("./utils/cli-bootstrap");
+const jwt_secret_1 = require("./utils/jwt-secret");
+async function main() {
+    await (0, cli_bootstrap_1.bootstrapCliJwtAccess)();
+    await (0, jwt_secret_1.rotateJwtSecret)();
+    console.log("JWT secret rotated. Existing tokens are now invalid.");
+    await client_1.default.$disconnect();
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});

package/dist/scripts/prisma-workspace.js

@@ -0,0 +1,34 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const dotenv_1 = __importDefault(require("dotenv"));
+const child_process_1 = require("child_process");
+const workspace_sync_1 = require("../utils/workspace-sync");
+const runtime_paths_1 = require("../utils/runtime-paths");
+dotenv_1.default.config();
+const args = process.argv.slice(2);
+if (args.length === 0) {
+    console.error("Usage: npm run prisma -- <prisma args>");
+    process.exit(1);
+}
+const databaseUrl = (0, workspace_sync_1.getWorkspaceDatabaseUrl)();
+const prismaCliEntrypoint = require.resolve("prisma/build/index.js", {
+    paths: [(0, runtime_paths_1.getPackageRoot)()],
+});
+const child = (0, child_process_1.spawn)(process.execPath, [prismaCliEntrypoint, ...args, "--schema", (0, runtime_paths_1.getPrismaSchemaPath)()], {
+    cwd: (0, runtime_paths_1.getPackageRoot)(),
+    stdio: "inherit",
+    env: {
+        ...process.env,
+        DATABASE_URL: databaseUrl,
+    },
+});
+child.on("exit", (code, signal) => {
+    if (signal) {
+        process.kill(process.pid, signal);
+        return;
+    }
+    process.exit(code ?? 1);
+});

package/dist/skills/index.js

@@ -0,0 +1,311 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = __importDefault(require("express"));
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const multer_1 = __importDefault(require("multer"));
+const client_1 = __importDefault(require("../prisma/client"));
+const index_1 = require("../utils/index");
+const skill_1 = require("../utils/skill");
+const skill_permissions_1 = require("../utils/skill-permissions");
+const permission_common_1 = require("../utils/permission-common");
+const skill_files_1 = require("../utils/skill-files");
+const resource_file_routes_1 = require("../utils/resource-file-routes");
+const skill_approval_snapshot_1 = require("../utils/skill-approval-snapshot");
+const resource_access_1 = require("../utils/resource-access");
+const router = express_1.default.Router({ mergeParams: true });
+const uploadTmpDir = path_1.default.join(os_1.default.tmpdir(), "teamcopilot-skill-uploads");
+fs_1.default.mkdirSync(uploadTmpDir, { recursive: true });
+const skillFileUpload = (0, multer_1.default)({ dest: uploadTmpDir, limits: { files: 1 } });
+function normalizeSkillNameOrSlug(value) {
+    return value
+        .toLowerCase()
+        .trim()
+        .replace(/[^a-z0-9\s-]/g, "")
+        .replace(/\s+/g, "-")
+        .replace(/-+/g, "-");
+}
+async function getSkillEditorAccess(slug, userId) {
+    const accessSummary = await (0, resource_access_1.getResourceAccessSummary)("skill", slug, userId);
+    const skillStatus = accessSummary.is_approved ? "approved" : "pending";
+    return {
+        can_view: accessSummary.can_view,
+        can_edit: accessSummary.can_edit,
+        editor_status: skillStatus,
+    };
+}
+async function assertCanViewSkillFiles(slug, userId) {
+    const access = await getSkillEditorAccess(slug, userId);
+    if (!access.can_view) {
+        throw {
+            status: 403,
+            message: "You do not have permission to view this skill"
+        };
+    }
+}
+async function assertCanEditSkillFiles(slug, userId) {
+    const access = await getSkillEditorAccess(slug, userId);
+    if (!access.can_edit) {
+        throw {
+            status: 403,
+            message: "You do not have permission to edit this skill"
+        };
+    }
+}
+router.post("/", (0, index_1.apiHandler)(async (req, res) => {
+    const body = req.body;
+    const rawName = typeof body.name === "string" ? body.name : "";
+    const normalizedName = normalizeSkillNameOrSlug(rawName);
+    const unifiedName = normalizedName;
+    if (!unifiedName) {
+        throw {
+            status: 400,
+            message: "name is required"
+        };
+    }
+    await (0, skill_1.createSkill)({
+        slug: unifiedName,
+        createdByUserId: req.userId,
+    });
+    res.status(201).json({ success: true });
+}, true));
+router.get("/", (0, index_1.apiHandler)(async (req, res) => {
+    const slugs = (0, skill_1.listSkillSlugs)();
+    const skills = [];
+    const creatorIds = new Set();
+    const metadataBySlug = new Map();
+    for (const slug of slugs) {
+        const metadata = await (0, skill_1.getOrCreateSkillMetadataAndEnsurePermission)(slug);
+        metadataBySlug.set(slug, metadata);
+        if (metadata.created_by_user_id) {
+            creatorIds.add(metadata.created_by_user_id);
+        }
+    }
+    const creators = creatorIds.size > 0
+        ? await client_1.default.users.findMany({
+            where: {
+                id: { in: Array.from(creatorIds) }
+            },
+            select: {
+                id: true,
+                name: true,
+                email: true,
+            }
+        })
+        : [];
+    const creatorNameById = new Map(creators.map((creator) => [creator.id, creator.name]));
+    const creatorEmailById = new Map(creators.map((creator) => [creator.id, creator.email]));
+    for (const slug of slugs) {
+        const metadata = metadataBySlug.get(slug);
+        if (!metadata)
+            continue;
+        const { manifest } = await (0, skill_1.readSkillManifestAndEnsurePermissions)(slug);
+        const accessSummary = await (0, resource_access_1.getResourceAccessSummary)("skill", slug, req.userId);
+        if (!accessSummary.can_view) {
+            continue;
+        }
+        const createdByUserId = metadata.created_by_user_id;
+        skills.push({
+            slug,
+            name: manifest.name,
+            description: manifest.description,
+            created_by_user_id: createdByUserId,
+            created_by_user_name: createdByUserId ? (creatorNameById.get(createdByUserId) ?? null) : null,
+            created_by_user_email: createdByUserId ? (creatorEmailById.get(createdByUserId) ?? null) : null,
+            approved_by_user_id: metadata.approved_by_user_id,
+            is_approved: accessSummary.is_approved,
+            can_view: accessSummary.can_view,
+            can_edit: accessSummary.can_edit,
+            permission_mode: accessSummary.permission_mode,
+            is_locked_due_to_missing_users: accessSummary.is_locked_due_to_missing_users,
+        });
+    }
+    res.json({ skills });
+}, true));
+router.get("/:slug", (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    await assertCanViewSkillFiles(slug, req.userId);
+    const { metadata, manifest } = await (0, skill_1.readSkillManifestAndEnsurePermissions)(slug);
+    const createdByUserId = metadata.created_by_user_id ?? null;
+    const approvedByUserId = metadata.approved_by_user_id ?? null;
+    const userIds = [createdByUserId, approvedByUserId].filter((id) => typeof id === "string");
+    const users = userIds.length > 0
+        ? await client_1.default.users.findMany({
+            where: { id: { in: userIds } },
+            select: { id: true, name: true, email: true }
+        })
+        : [];
+    const usersById = new Map(users.map((user) => [user.id, user]));
+    const creator = createdByUserId ? (usersById.get(createdByUserId) ?? null) : null;
+    const approver = approvedByUserId ? (usersById.get(approvedByUserId) ?? null) : null;
+    const accessSummary = await (0, resource_access_1.getResourceAccessSummary)("skill", slug, req.userId);
+    const permission = await (0, skill_permissions_1.getSkillAccessPermissionWithUsers)(slug);
+    const permissionMode = (0, permission_common_1.assertCommonPermissionMode)(permission.permission_mode, "skill access");
+    const permissions = permissionMode === "everyone"
+        ? { mode: "everyone" }
+        : { mode: "restricted", allowed_user_ids: permission.allowedUsers.map((row) => row.user_id) };
+    res.json({
+        skill: {
+            slug,
+            name: manifest.name,
+            created_by_user_id: createdByUserId,
+            created_by_user_name: creator?.name ?? null,
+            created_by_user_email: creator?.email ?? null,
+            approved_by_user_id: approvedByUserId,
+            is_approved: accessSummary.is_approved,
+            approved_by_user_name: approver?.name ?? null,
+            approved_by_user_email: approver?.email ?? null,
+            can_view: accessSummary.can_view,
+            can_edit: accessSummary.can_edit,
+            permission_mode: accessSummary.permission_mode,
+            is_locked_due_to_missing_users: accessSummary.is_locked_due_to_missing_users,
+            permissions,
+            allowed_users_resolved: permission.allowedUsers.map((row) => ({
+                user_id: row.user.id,
+                name: row.user.name,
+                email: row.user.email,
+                is_owner: row.user.id === metadata.created_by_user_id,
+                is_approver: row.user.id === metadata.approved_by_user_id
+            })),
+        }
+    });
+}, true));
+router.post("/:slug/approve", (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    const approvalResult = await (0, skill_approval_snapshot_1.approveSkillWithSnapshot)(slug, req.userId);
+    const { metadata: approvedMetadata } = await (0, skill_1.readSkillManifestAndEnsurePermissions)(slug);
+    await (0, skill_permissions_1.addApproverToSkillAccessPermissionsIfRestricted)(slug, req.userId, approvedMetadata.created_by_user_id);
+    res.json({
+        skill: {
+            slug,
+            approved_by_user_id: approvalResult.approved_by_user_id,
+            is_approved: true,
+            snapshot_hash: approvalResult.snapshot_hash,
+            snapshot_file_count: approvalResult.snapshot_file_count
+        }
+    });
+}, true));
+router.post("/:slug/reject-restore", (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    const result = await (0, skill_approval_snapshot_1.restoreSkillToApprovedSnapshot)(slug, req.userId);
+    res.json({
+        skill: {
+            slug,
+            restored_file_count: result.restored_file_count,
+            snapshot_hash: result.snapshot_hash,
+        }
+    });
+}, true));
+router.get("/:slug/approval-diff", (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    if (req.role !== "Engineer") {
+        throw {
+            status: 403,
+            message: "Only Engineers can review approval diffs"
+        };
+    }
+    await (0, skill_1.readSkillManifestAndEnsurePermissions)(slug);
+    const previousSnapshot = await (0, skill_approval_snapshot_1.loadApprovedSkillSnapshotFromDb)(slug);
+    const currentSnapshot = (0, skill_approval_snapshot_1.collectCurrentSkillSnapshot)(slug);
+    const diff = (0, skill_approval_snapshot_1.buildSkillApprovalDiffResponse)(previousSnapshot, currentSnapshot);
+    res.json(diff);
+}, true));
+(0, resource_file_routes_1.registerResourceFileRoutes)({
+    router,
+    uploadMiddleware: skillFileUpload.single("file"),
+    assertCanView: assertCanViewSkillFiles,
+    ensureResourceExists: async (slug) => {
+        await (0, skill_1.readSkillManifestAndEnsurePermissions)(slug);
+    },
+    getEditorAccess: getSkillEditorAccess,
+    assertCanEdit: assertCanEditSkillFiles,
+    listDirectory: skill_files_1.listSkillDirectory,
+    readFileContent: skill_files_1.readSkillFileContent,
+    saveFileContent: skill_files_1.saveSkillFileContent,
+    createFileOrFolder: skill_files_1.createSkillFileOrFolder,
+    uploadFileFromTempPath: skill_files_1.uploadSkillFileFromTempPath,
+    renamePath: skill_files_1.renameSkillPath,
+    deletePath: skill_files_1.deleteSkillPath,
+    skipResponseSanitizationForFileContentRead: false,
+});
+const updateSkillPermissionsHandler = (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    const metadata = await (0, skill_1.getOrCreateSkillMetadataAndEnsurePermission)(slug);
+    const approvalState = await (0, skill_approval_snapshot_1.getSkillSnapshotApprovalState)(slug);
+    if (!approvalState.is_current_code_approved) {
+        throw {
+            status: 403,
+            message: "Skill must be approved before updating access permissions"
+        };
+    }
+    const currentSummary = await (0, resource_access_1.getResourceAccessSummary)("skill", slug, req.userId);
+    if (!currentSummary.can_edit) {
+        throw {
+            status: 403,
+            message: currentSummary.is_locked_due_to_missing_users
+                ? "Skill permissions cannot be modified because no allowed users remain"
+                : "You do not have permission to modify skill access permissions"
+        };
+    }
+    const { mode, allowed_user_ids } = req.body;
+    if (mode !== "restricted" && mode !== "everyone") {
+        throw {
+            status: 400,
+            message: 'mode must be "restricted" or "everyone"'
+        };
+    }
+    const updatedPermission = mode === "everyone"
+        ? await (0, skill_permissions_1.setSkillAccessPermissions)(slug, { mode: "everyone" }, metadata.created_by_user_id)
+        : await (0, skill_permissions_1.setSkillAccessPermissions)(slug, {
+            mode: "restricted",
+            allowed_user_ids: Array.isArray(allowed_user_ids) ? allowed_user_ids.map((id) => String(id)) : []
+        }, metadata.created_by_user_id);
+    const updatedSummary = await (0, resource_access_1.getResourceAccessSummary)("skill", slug, req.userId);
+    const updatedPermissionMode = (0, permission_common_1.assertCommonPermissionMode)(updatedPermission.permission_mode, "skill access");
+    const permissions = updatedPermissionMode === "everyone"
+        ? { mode: "everyone" }
+        : { mode: "restricted", allowed_user_ids: updatedPermission.allowedUsers.map((row) => row.user_id) };
+    res.json({
+        skill: {
+            slug,
+            ...updatedSummary,
+            permissions,
+            allowed_users_resolved: updatedPermission.allowedUsers.map((row) => ({
+                user_id: row.user.id,
+                name: row.user.name,
+                email: row.user.email,
+                is_owner: row.user.id === metadata.created_by_user_id,
+                is_approver: row.user.id === metadata.approved_by_user_id
+            }))
+        }
+    });
+}, true);
+// PATCH /api/skills/:slug/permissions - Update permissions (canonical)
+router.patch("/:slug/permissions", updateSkillPermissionsHandler);
+router.delete("/:slug", (0, index_1.apiHandler)(async (req, res) => {
+    const slug = req.params.slug;
+    const metadata = await (0, skill_1.getOrCreateSkillMetadataAndEnsurePermission)(slug);
+    const creatorUserId = metadata.created_by_user_id ?? null;
+    const creator = creatorUserId
+        ? await client_1.default.users.findUnique({
+            where: { id: creatorUserId },
+            select: { id: true }
+        })
+        : null;
+    const isOwner = creatorUserId === req.userId;
+    const hasNoCreatorUser = creator === null;
+    const isEngineer = req.role === "Engineer";
+    if (!isOwner && !(hasNoCreatorUser && isEngineer)) {
+        throw {
+            status: 403,
+            message: "Only the skill owner can delete this skill. Engineers can only delete skills whose owner no longer exists."
+        };
+    }
+    await (0, skill_1.deleteSkill)(slug);
+    res.json({ success: true });
+}, true));
+exports.default = router;

package/dist/types/permissions.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/types/shared/permissions.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../permissions"), exports);

package/dist/types/shared/skill.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../skill"), exports);

package/dist/types/shared/workflow-files.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../workflow-files"), exports);

package/dist/types/shared/workflow.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("../workflow"), exports);

package/dist/types/skill.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/types/workflow-files.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/types/workflow.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/users/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = __importDefault(require("express"));
+const client_1 = __importDefault(require("../prisma/client"));
+const index_1 = require("../utils/index");
+const router = express_1.default.Router({ mergeParams: true });
+router.get("/", (0, index_1.apiHandler)(async (_req, res) => {
+    const users = await client_1.default.users.findMany({
+        orderBy: { name: "asc" },
+        select: {
+            id: true,
+            name: true,
+            email: true,
+            role: true
+        }
+    });
+    res.json({ users });
+}, true));
+exports.default = router;