Add user and employee management enhancements with database schema updates

- Introduced new columns `status`, `created_by`, and `updated_by` in the `users` table to track user status and ownership.
- Updated the `employees` table to include a foreign key reference to the `users` table via `user_id`.
- Created migration script `0012_users_primary.sql` to apply these changes to the database schema.
- Enhanced the `EmployeesService` and `EmployeesRepository` to support user assignments and related data retrieval.
- Updated DTOs and service methods to reflect the new user and employee relationships.
- Added unit tests to validate the new functionality and ensure data integrity.
- Modified existing controllers to accommodate the new fields and relationships in user and employee management.

test/users.e2e-spec.ts

@@ -0,0 +1,158 @@
+import { INestApplication } from '@nestjs/common';
+import { Test, TestingModule } from '@nestjs/testing';
+import { eq } from 'drizzle-orm';
+import request from 'supertest';
+import { App } from 'supertest/types';
+import { AppModule } from '../src/app.module';
+import { configureApp } from '../src/common/configure-app';
+import { DRIZZLE, type DrizzleDB } from '../src/database/database.module';
+import {
+  privilegeDetails,
+  privilegeKeys,
+  privileges,
+  users,
+} from '../src/database/schema';
+import { PRIVILEGE_ACTIONS } from '../src/modules/privileges/privilege-action';
+import { registerAndActivate } from './helpers/activate-user';
+
+describe('Users (e2e)', () => {
+  let app: INestApplication<App>;
+  let db: DrizzleDB;
+
+  const password = 'password123';
+  const adminUsername = `usr_admin_${Date.now()}`;
+  const otherUsername = `usr_other_${Date.now()}`;
+
+  let adminAccessToken: string;
+  let adminUserId: string;
+  let otherAccessToken: string;
+
+  beforeAll(async () => {
+    const moduleFixture: TestingModule = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleFixture.createNestApplication();
+    configureApp(app, {
+      NODE_ENV: 'test',
+      SWAGGER_ENABLED: 'false',
+    });
+    await app.init();
+    db = app.get(DRIZZLE);
+
+    const admin = await registerAndActivate(app, db, adminUsername, password);
+    adminAccessToken = admin.accessToken;
+    adminUserId = admin.userId;
+
+    const other = await registerAndActivate(app, db, otherUsername, password);
+    otherAccessToken = other.accessToken;
+
+    const now = Date.now();
+    const [priv] = await db
+      .insert(privileges)
+      .values({
+        name: 'User Admin',
+        code: `USR_ADMIN_${now}`,
+        status: 'active',
+        createdAt: now,
+        updatedAt: now,
+        createdBy: adminUserId,
+        updatedBy: adminUserId,
+      })
+      .returning();
+
+    const keys = await db.select().from(privilegeKeys);
+    const detailRows = keys.flatMap((key) =>
+      PRIVILEGE_ACTIONS.map((action) => ({
+        privilegeId: priv.id,
+        privilegeKeyId: key.id,
+        action,
+        value: true,
+      })),
+    );
+    await db.insert(privilegeDetails).values(detailRows);
+
+    await db
+      .update(users)
+      .set({ privilegeId: priv.id, updatedAt: Date.now() })
+      .where(eq(users.id, adminUserId));
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('forbids users list without permission', async () => {
+    await request(app.getHttpServer())
+      .get('/users')
+      .set('Authorization', `Bearer ${otherAccessToken}`)
+      .expect(403);
+  });
+
+  it('rejects unauthenticated access', async () => {
+    await request(app.getHttpServer()).get('/users').expect(401);
+  });
+
+  it('CRUD users with status, privilege, search, bulk, and import', async () => {
+    const created = await request(app.getHttpServer())
+      .post('/users')
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({
+        username: `usr_${Date.now().toString().slice(-6)}`,
+        password: 'password123',
+      })
+      .expect(201);
+
+    expect(created.body).toMatchObject({
+      status: 'draft',
+      privilege: null,
+      employee: null,
+    });
+    expect(created.body).not.toHaveProperty('passwordHash');
+    const id = (created.body as { id: string }).id;
+
+    await request(app.getHttpServer())
+      .get(`/users/${id}`)
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .expect(200);
+
+    const listed = await request(app.getHttpServer())
+      .get('/users')
+      .query({ search: 'usr_' })
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .expect(200);
+    expect(listed.body.data.length).toBeGreaterThan(0);
+    expect(listed.body.meta).toBeDefined();
+
+    await request(app.getHttpServer())
+      .patch(`/users/${id}`)
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({ status: 'active' })
+      .expect(400);
+
+    await request(app.getHttpServer())
+      .patch(`/users/${id}/status`)
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({ status: 'active' })
+      .expect(200);
+
+    await request(app.getHttpServer())
+      .post('/users/bulk-status')
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({ ids: [id], status: 'archived' })
+      .expect(200);
+
+    const csv = `username,password\nusr_imp_${Date.now().toString().slice(-5)},password123\n`;
+    await request(app.getHttpServer())
+      .post('/users/import')
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .attach('file', Buffer.from(csv, 'utf8'), 'users.csv')
+      .expect(200);
+
+    await request(app.getHttpServer())
+      .post('/users/bulk-delete')
+      .set('Authorization', `Bearer ${adminAccessToken}`)
+      .send({ ids: [id] })
+      .expect(200);
+  });
+});