Added permission to block non admins from seeing all users

nodejs/routes/user.js

@@ -6,8 +6,9 @@ const permission = require('../utils/permission');
 
 router.get('/', async function(req, res, next){
 	try{
+		await permission.byGroup(req.user, ['app_sso_admin'])
 		return res.json({
-			results:  await User[req.query.detail ? "listDetail" : "list"]()
+			results:  await User[req.query.detail ? "listDetail" : "list"](),
 		});
 	}catch(error){
 		next(error);

nodejs/views/users.ejs

@@ -38,6 +38,11 @@
 		app.util.actionMessage('Refreshing user list...', $target);
 
 		app.user.list(function(error, data){
+			if(error){
+				console.log('data', data)
+				app.util.actionMessage(data.message, $target, 'danger');
+				return;
+			}
 			$.each( data.results, function(key, value) {
 				if(value.uidNumber<1500) return;
 				user_row = Mustache.render(rowTemplate, value);