FIX: user can get own info, even with no users:admin permission

src/modules/users/users.controller.ts

@@ -49,6 +49,8 @@ import {
 } from './dtos/entities';
 import { UsersService } from './users.service';
 import { Metadata } from '@grpc/grpc-js';
+import ErrorBuilder from 'src/utils/ErrorBuilder';
+import ErrorCodes from 'src/utils/errorCodes';
 
 // TODO GET de hierarquias e do PATCH em usuário
 @ApiTags('Users')
@@ -123,7 +125,6 @@ export class UsersController {
   }
 
   @Get(':id')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
   @ApiOkResponse({
     type: UserByCustomer,
   })
@@ -134,6 +135,14 @@ export class UsersController {
   ) {
     this.logger.info('findOneById', { user });
     this.userService.setLanguage(language);
+    if (
+      id !== user.user_id &&
+      !user.permissions.includes(
+        PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid,
+      )
+    ) {
+      throw new ErrorBuilder(ErrorCodes.AUTH.FORBIDDEN);
+    }
     return await this.userService.findOneById(id);
   }