feat: Enhance permissions and roles management with improved indexing and state handling

imphnen-backend/src/bin/seed_roles_permissions.rs

@@ -16,7 +16,12 @@ async fn main() -> Result<(), Box<dyn Error>> {
 		.use_db(env.surrealdb_dbname.clone())
 		.await?;
     db.query("DEFINE INDEX user_email_index ON TABLE users COLUMNS email UNIQUE;")
+	
         .await?;
+    db.query("DEFINE INDEX role_name_idx ON TABLE roles COLUMNS name UNIQUE;")
+	
+        .await?;
+	
     println!("✅ Index 'user_email_index' defined on table 'users' for column 'email'.");
 
 	let roles_permissions = vec![

imphnen-iam/src/v1/auth/auth_controller.rs

@@ -139,7 +139,8 @@ pub async fn post_new_password(
     tag = "Authentication"
 )]
 pub async fn post_refresh_token(
+	Extension(state): Extension<AppState>,
 	Json(payload): Json<AuthRefreshTokenRequestDto>,
 ) -> impl IntoResponse {
-	AuthService::mutation_refresh_token(payload).await
+	AuthService::mutation_refresh_token(payload, &state).await
 }

imphnen-iam/src/v1/auth/auth_service.rs

@@ -9,7 +9,7 @@ use crate::{
 	decode_refresh_token, encode_access_token, encode_refresh_token,
 	encode_reset_password_token, extract_email_token, generate_otp, get_iso_date,
 	hash_password, make_thing, send_email, success_response, validate_request,
-	verify_password, surrealdb_init_ws, surrealdb_init_mem,
+	verify_password,
 };
 use axum::{http::StatusCode, response::Response};
 use surrealdb::Uuid;
@@ -37,6 +37,7 @@ pub trait AuthServiceTrait: Send + Sync + 'static {
     ) -> Response;
     async fn mutation_refresh_token(
         payload: AuthRefreshTokenRequestDto,
+        state: &AppState,
     ) -> Response;
     async fn mutation_forgot_password(
         payload: AuthResendOtpRequestDto,
@@ -88,7 +89,7 @@ impl AuthServiceTrait for AuthService {
 				}
 
 				let permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.clone()).collect();
-let access_token = match encode_access_token(payload.email.clone(), user.id.id.to_raw(), permissions) {
+let access_token = match encode_access_token(payload.email.clone(), user.id.id.to_raw(), permissions.clone()) {
 					Ok(token) => token,
 					Err(_e) => {
 						error!(
@@ -185,7 +186,7 @@ let refresh_token = match encode_refresh_token(payload.email.clone(), user.id.id
 				}
 
 				let permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.clone()).collect();
-let access_token = match encode_access_token(payload.email.clone(), user.id.id.to_raw(), permissions) {
+let access_token = match encode_access_token(payload.email.clone(), user.id.id.to_raw(), permissions.clone()) {
 					Ok(token) => token,
 					Err(_e) => {
 						error!(
@@ -328,7 +329,7 @@ let refresh_token = match encode_refresh_token(payload.email.clone(), user.id.id
 				created_at: get_iso_date(),
 				updated_at: get_iso_date(),
 				role: role_thing,
-				is_active: true,
+				is_active: false,
 				..Default::default()
 			})
 			.await
@@ -378,27 +379,15 @@ let refresh_token = match encode_refresh_token(payload.email.clone(), user.id.id
 		}
 	}
 
-	async fn mutation_refresh_token(payload: AuthRefreshTokenRequestDto) -> Response {
+	async fn mutation_refresh_token(
+		payload: AuthRefreshTokenRequestDto,
+		state: &AppState,
+	) -> Response {
 		if let Err((status, message)) = validate_request(&payload) {
 			return common_response(status, &message);
 		}
 		
-		let surrealdb_ws = match surrealdb_init_ws().await {
+		let user_repo = UsersRepository::new(state);
-	           Ok(db) => db,
-	           Err(e) => {
-	               error!("Failed to initialize websocket database: {}", e);
-	               return common_response(StatusCode::INTERNAL_SERVER_ERROR, "Database initialization error");
-	           }
-	       };
-	       let surrealdb_mem = match surrealdb_init_mem().await {
-	           Ok(db) => db,
-	           Err(e) => {
-	               error!("Failed to initialize memory database: {}", e);
-	               return common_response(StatusCode::INTERNAL_SERVER_ERROR, "Database initialization error");
-	           }
-	       };
-		let state = AppState { surrealdb_ws, surrealdb_mem };
-		let user_repo = UsersRepository::new(&state);
 		let user = match decode_refresh_token(&payload.refresh_token) {
 			Ok(token_data) => {
 				match user_repo.query_user_by_email(token_data.claims.sub.clone()).await {
@@ -508,37 +497,42 @@ let token = match encode_reset_password_token(user.email.clone(), user.id.id.to_
 		let auth_repo = AuthRepository::new(state);
 		let email = payload.email.clone();
 		let user = match user_repo.query_user_by_email(email.clone()).await {
-			Ok(user) if !user.is_deleted => user,
+			Ok(user) => user,
 			_ => {
 				return common_response(StatusCode::NOT_FOUND, "User not found");
 			}
 		};
+
+		if user.is_active {
+			return common_response(StatusCode::BAD_REQUEST, "User already active");
+		}
+
 		let patch = UsersSchema {
 			id: user.id.clone(),
 			is_active: true,
 			..UsersSchema::from(user.clone())
 		};
+
 		match auth_repo.query_get_stored_otp(email.clone()).await {
-			Ok(stored_otp) => match stored_otp == payload.otp {
+			Ok(stored_otp) => {
-				true => match user_repo.query_update_user(patch).await {
+				if stored_otp != payload.otp {
-					Ok(_) => match auth_repo.query_delete_stored_otp(email.clone()).await {
+					// Delete OTP even if it doesn't match
-						Ok(_) => common_response(StatusCode::OK, "Email verified successfully"),
+					let _ = auth_repo.query_delete_stored_otp(email.clone()).await;
-						Err(e_del) => {
+					return common_response(StatusCode::BAD_REQUEST, "Failed to verify OTP");
-							error!("Failed to delete OTP for {}: {}", email, e_del);
+				}
-							common_response(StatusCode::INTERNAL_SERVER_ERROR, &e_del.to_string())
+
+				match user_repo.query_update_user(patch).await {
+					Ok(_) => {
+						match auth_repo.query_delete_stored_otp(email.clone()).await {
+							Ok(_) => common_response(StatusCode::OK, "Email verified successfully"),
+							Err(e_del) => {
+								error!("Failed to delete OTP for {}: {}", email, e_del);
+								common_response(StatusCode::INTERNAL_SERVER_ERROR, &e_del.to_string())
+							}
 						}
 					},
-					Err(err_update) => {
+					Err(err_update) => common_response(StatusCode::BAD_REQUEST, &err_update.to_string()),
-						common_response(StatusCode::BAD_REQUEST, &err_update.to_string())
+				}
-					}
-				},
-				false => match auth_repo.query_delete_stored_otp(email.clone()).await {
-					Ok(_) => common_response(StatusCode::BAD_REQUEST, "Failed to verify OTP"),
-					Err(e_del_mismatch) => common_response(
-						StatusCode::INTERNAL_SERVER_ERROR,
-						&format!("Failed to delete OTP: {e_del_mismatch}"),
-					),
-				},
 			},
 			Err(err_get) => common_response(StatusCode::BAD_REQUEST, &err_get.to_string()),
 		}

imphnen-iam/src/v1/auth/google/google_oauth_service.rs

@@ -78,12 +78,21 @@ impl AuthRequest {
     }
 }
 
+use crate::{RolesRepository, RolesEnum};
+
 /// Helper function to get default role ID for new OAuth users
-async fn get_default_role_id(_env: &Env) -> Result<String, Error> {
+async fn get_default_role_id(app_state: &AppState) -> Result<String, Error> {
-    // Use the User role ID from the seed data directly
+    let role_repo = RolesRepository::new(app_state);
-    let default_role_id = "5713cb37-dc02-4e87-8048-d7a41d352059".to_string();
+    match role_repo.query_role_by_name(RolesEnum::User.to_string()).await {
-    info!("Using default User role ID from seed: {}", default_role_id);
+        Ok(role) => {
-    Ok(default_role_id)
+            info!("Using default User role ID: {}", role.id);
+            Ok(role.id)
+        },
+        Err(e) => {
+            error!("Failed to retrieve User role: {:?}", e);
+            Err(Error::Anyhow(anyhow::Error::msg("Failed to get default role ID".to_string())))
+        }
+    }
 }
 
 #[async_trait]
@@ -253,7 +262,7 @@ where
         info!("Google user data: name={:?}, given_name={:?}, family_name={:?}, picture={:?}", 
               google_user.name, google_user.given_name, google_user.family_name, google_user.picture);
 
-        let user = self.users_service.get_user_by_email(&google_user.email).await?;
+        let user = self.users_service.get_user_by_email(&google_user.email, app_state).await?;
 
         let user = match user {
             Some(mut user) => {
@@ -262,7 +271,7 @@ where
                 // Update avatar if user doesn't have one and Google provides one
                 if user.avatar.is_none() && google_user.picture.is_some() {
                     info!("Updating avatar for existing user: {}", google_user.email);
-                    match self.users_service.update_user_avatar(&google_user.email, google_user.picture.clone()).await {
+                    match self.users_service.update_user_avatar(&google_user.email, google_user.picture.clone(), app_state).await {
                         Ok(_) => {
                             info!("Successfully updated avatar for user: {}", google_user.email);
                             user.avatar = google_user.picture.clone();
@@ -279,11 +288,11 @@ where
                 info!("Creating new user for email: {}", google_user.email);
                 
                 // Get default role ID using robust lookup
-                let default_role_id = get_default_role_id(self.env).await
+                let default_role_id = get_default_role_id(app_state).await
-                    .unwrap_or_else(|e| {
+                    .map_err(|e| {
-                        error!("Failed to get default role ID, using fallback: {:?}", e);
+                        error!("Failed to get default role ID: {:?}", e);
-                        "5713cb37-dc02-4e87-8048-d7a41d352059".to_string() // Hardcoded User role ID as final fallback
+                        Error::Anyhow(anyhow::Error::msg("Failed to get default role ID for new user".to_string()))
-                    });
+                    })?;
                 
                 let new_user = UsersCreateRequestDto {
                     email: google_user.email.clone(),
@@ -306,12 +315,12 @@ where
                     avatar: google_user.picture.clone(), // Set avatar from Google user picture
                 };
                 
-                self.users_service.create_user_by_dto(new_user).await?
+                self.users_service.create_user_by_dto(new_user, app_state).await?
             }
         };
 
         let permissions: Vec<String> = user.role.permissions.iter().map(|p| p.name.clone()).collect();
-let access_token = encode_access_token(user.email.clone(), user.id.clone(), permissions)
+let access_token = encode_access_token(user.email.clone(), user.id.clone(), permissions.clone())
             .map_err(|e| {
                 error!("Failed to generate access token for {}: {:?}", user.email, e);
                 Error::Auth("Failed to generate access token".to_string())

imphnen-iam/src/v1/permissions/permissions_controller.rs

@@ -47,7 +47,7 @@ pub async fn get_permission_list(
 	)
 	.await
 	{
-		Ok((_user, state)) => PermissionsService::get_permission_list(&state, meta).await,
+		Ok((_claims, state)) => PermissionsService::get_permission_list(&state, meta).await,
 		Err(response) => response,
 	}
 }
@@ -76,7 +76,7 @@ pub async fn get_permission_by_id(
 	)
 	.await
 	{
-		Ok((_user, state)) => PermissionsService::get_permission_by_id(&state, id).await,
+		Ok((_claims, state)) => PermissionsService::get_permission_by_id(&state, id).await,
 		Err(response) => response,
 	}
 }
@@ -105,7 +105,7 @@ pub async fn post_create_permission(
 	)
 	.await
 	{
-		Ok((_user, state)) => PermissionsService::create_role(&state, payload).await,
+		Ok((_claims, state)) => PermissionsService::create_role(&state, payload).await,
 		Err(response) => response,
 	}
 }
@@ -135,7 +135,7 @@ pub async fn put_update_permission(
 	)
 	.await
 	{
-		Ok((_user, state)) => PermissionsService::update_permission(&state, payload, id).await,
+		Ok((_claims, state)) => PermissionsService::update_permission(&state, payload, id).await,
 		Err(response) => response,
 	}
 }
@@ -163,7 +163,7 @@ pub async fn delete_permission(
 	)
 	.await
 	{
-		Ok((_user, state)) => PermissionsService::delete_permission(&state, id).await,
+		Ok((_claims, state)) => PermissionsService::delete_permission(&state, id).await,
 		Err(response) => response,
 	}
 }

imphnen-iam/src/v1/permissions/permissions_guard.rs

@@ -1,17 +1,17 @@
 use super::PermissionsEnum;
-use crate::{AppState, common_response, decode_access_token, UsersDetailQueryDto, UsersRepository};
+use crate::{AppState, common_response, decode_access_token};
 use axum::{
 	http::{HeaderMap, StatusCode},
 	response::Response, Extension,
 };
 use axum_extra::headers::{authorization::Bearer, Authorization, HeaderMapExt};
-use imphnen_utils::make_thing;
+// Removed imphnen_utils::make_thing as it's no longer needed here
 
 pub async fn permissions_guard(
 	headers: HeaderMap,
 	Extension(state): Extension<AppState>,
 	required_permissions: Vec<PermissionsEnum>,
-) -> Result<(UsersDetailQueryDto, AppState), Response> {
+) -> Result<(imphnen_libs::jsonwebtoken::Claims, AppState), Response> {
 	let auth_header = headers
 		.typed_get::<Authorization<Bearer>>()
 		.ok_or_else(|| {
@@ -44,17 +44,5 @@ pub async fn permissions_guard(
 		}
 	}
 
-	// Fetch full user details from the database using user_id from JWT
+	Ok((claims, state))
-	let user_repo = UsersRepository::new(&state);
-	let user_id_thing = make_thing("app_users", &claims.user_id);
-	let raw_user = user_repo.query_user_by_id(&user_id_thing)
-		.await
-		.map_err(|_| {
-			common_response(
-				StatusCode::INTERNAL_SERVER_ERROR, // Changed to internal server error as user ID should be valid from JWT
-				"Failed to retrieve user details",
-			)
-		})?;
-	
-	Ok((raw_user, state))
 }

imphnen-iam/src/v1/roles/roles_controller.rs

@@ -45,7 +45,7 @@ pub async fn get_role_list(
 	)
 	.await
 	{
-		Ok((_user, state)) => RolesService::get_role_list(&state, meta).await,
+		Ok((_claims, state)) => RolesService::get_role_list(&state, meta).await,
 		Err(response) => response,
 	}
 }
@@ -74,7 +74,7 @@ pub async fn get_role_by_id(
 	)
 	.await
 	{
-		Ok((_user, state)) => RolesService::get_role_by_id(&state, id).await,
+		Ok((_claims, state)) => RolesService::get_role_by_id(&state, id).await,
 		Err(response) => response,
 	}
 }
@@ -103,7 +103,7 @@ pub async fn post_create_role(
 	)
 	.await
 	{
-		Ok((_user, state)) => RolesService::create_role(&state, payload).await,
+		Ok((_claims, state)) => RolesService::create_role(&state, payload).await,
 		Err(response) => response,
 	}
 }
@@ -133,7 +133,7 @@ pub async fn put_update_role(
 	)
 	.await
 	{
-		Ok((_user, state)) => RolesService::update_role(&state, id, payload).await,
+		Ok((_claims, state)) => RolesService::update_role(&state, id, payload).await,
 		Err(response) => response,
 	}
 }
@@ -161,7 +161,7 @@ pub async fn delete_role(
 	)
 	.await
 	{
-		Ok((_user, state)) => RolesService::delete_role(&state, id).await,
+		Ok((_claims, state)) => RolesService::delete_role(&state, id).await,
 		Err(response) => response,
 	}
 }

imphnen-iam/src/v1/users/users_controller.rs

@@ -55,7 +55,7 @@ pub async fn get_user_list(
 	)
 	.await
 	{
-		Ok((_user, state)) => UsersService::get_user_list(&state, meta).await,
+		Ok((_claims, state)) => UsersService::get_user_list(&state, meta).await,
 		Err(response) => response,
 	}
 }
@@ -86,7 +86,7 @@ pub async fn get_user_by_id(
 	)
 	.await
 	{
-		Ok((_user, state)) => UsersService::get_user_by_id(&state, id).await,
+		Ok((_claims, state)) => UsersService::get_user_by_id(&state, id).await,
 		Err(response) => response,
 	}
 }
@@ -107,7 +107,7 @@ pub async fn get_user_me(
 	Extension(state): Extension<AppState>,
 ) -> impl IntoResponse {
 	match permissions_guard(headers, Extension(state), vec![]).await {
-		Ok((user, state)) => UsersService::get_user_me(user, &state).await,
+		Ok((claims, state)) => UsersService::get_user_me(claims, &state).await,
 		Err(response) => response,
 	}
 }
@@ -136,7 +136,7 @@ pub async fn post_create_user(
 	)
 	.await
 	{
-		Ok((_user, state)) => UsersService::create_user(&state, payload).await,
+		Ok((_claims, state)) => UsersService::create_user(&state, payload).await,
 		Err(response) => response,
 	}
 }
@@ -169,7 +169,7 @@ pub async fn put_update_user(
 	)
 	.await
 	{
-		Ok((_user, state)) => UsersService::update_user(&state, id, payload).await,
+		Ok((_claims, state)) => UsersService::update_user(&state, id, payload).await,
 		Err(response) => response,
 	}
 }
@@ -192,7 +192,7 @@ pub async fn put_update_user_me(
 	Json(payload): Json<UsersUpdateRequestDto>,
 ) -> impl IntoResponse {
 	match permissions_guard(headers.clone(), Extension(state), vec![]).await {
-		Ok((_user, state)) => UsersService::update_user_me(headers, &state, payload).await,
+		Ok((claims, state)) => UsersService::update_user_me(claims, &state, payload).await,
 		Err(response) => response,
 	}
 }
@@ -225,7 +225,7 @@ pub async fn patch_user_active_status(
 	)
 	.await
 	{
-		Ok((_user, state)) => UsersService::set_user_active_status(&state, id, payload).await,
+		Ok((_claims, state)) => UsersService::set_user_active_status(&state, id, payload).await,
 		Err(response) => response,
 	}
 }
@@ -253,7 +253,7 @@ pub async fn delete_user(
 	)
 	.await
 	{
-		Ok((_user, state)) => UsersService::delete_user(&state, id).await,
+		Ok((_claims, state)) => UsersService::delete_user(&state, id).await,
 		Err(response) => response,
 	}
 }
@@ -290,9 +290,9 @@ pub async fn upload_file(
 	)
 	.await
 	{
-		Ok((user, state)) => {
+		Ok((claims, state)) => {
 			// Extract user ID from user data
-			let user_id = user.id.id.to_string(); // Use user.id.id to get the actual ID
+			let user_id = claims.user_id.clone(); // Use claims.user_id directly
 			
 			// Process upload - don't use match here since it returns Response directly
 			UsersService::upload_file(&state, user_id, multipart).await

imphnen-iam/src/v1/users/users_dto.rs

@@ -393,5 +393,11 @@ impl From<&UsersDetailItemDto> for UsersDetailQueryDto {
 			updated_at: dto.updated_at.clone(),
 			mentor_id: None,
 		}
-	}
+		}
+}
+
+impl UsersDetailItemDto {
+	   pub fn extract_permissions_from_user_role(&self) -> Vec<String> {
+	       self.role.permissions.iter().map(|p| p.name.clone()).collect()
+	   }
 }

imphnen-iam/src/v1/users/users_service.rs

@@ -6,12 +6,11 @@ use crate::{
 	AppState, MetaRequestDto, ResponseListSuccessDto, UsersRepository, UsersSchema,
 };
 use crate::{
-	ResponseSuccessDto, common_response, extract_email, extract_email_async, success_list_response,
+	ResponseSuccessDto, common_response, success_list_response,
-	success_response, validate_request, UsersDetailQueryDto,
+	success_response, validate_request,
 };
-use axum::http::HeaderMap;
 use axum::{http::StatusCode, response::Response, extract::Multipart};
-use imphnen_libs::{ResourceEnum, hash_password, verify_password, surrealdb_init_ws, surrealdb_init_mem, MinioConfig, FileType, decode_base64_file, extract_content_type_from_data_url, create_minio_service_from_config};
+use imphnen_libs::{ResourceEnum, hash_password, verify_password, MinioConfig, FileType, decode_base64_file, extract_content_type_from_data_url, create_minio_service_from_config};
 use imphnen_utils::make_thing;
 use uuid::Uuid;
 use anyhow::Result;
@@ -24,18 +23,18 @@ use serde_json::json;
 pub trait UsersServiceTrait: Send + Sync + 'static {
     async fn get_user_list(state: &AppState, meta: MetaRequestDto) -> Response;
     async fn get_user_by_id(state: &AppState, id: String) -> Response;
-    async fn get_user_me(user: UsersDetailQueryDto, state: &AppState) -> Response;
+    async fn get_user_me(claims: imphnen_libs::jsonwebtoken::Claims, state: &AppState) -> Response;
     async fn create_user(state: &AppState, new_user: UsersCreateRequestDto) -> Response;
     async fn update_user(state: &AppState, id: String, user: UsersUpdateRequestDto) -> Response;
-    async fn update_user_me(headers: HeaderMap, state: &AppState, user: UsersUpdateRequestDto) -> Response;
+    async fn update_user_me(claims: imphnen_libs::jsonwebtoken::Claims, state: &AppState, user: UsersUpdateRequestDto) -> Response;
     async fn set_user_active_status(state: &AppState, id: String, payload: UsersActiveInactiveRequestDto) -> Response;
     async fn update_user_password(state: &AppState, email: String, payload: UsersSetNewPasswordRequestDto) -> Response;
     async fn get_user_by_mentor_id(state: &AppState, mentor_id: String) -> Response;
     async fn delete_user(state: &AppState, id: String) -> Response;
 
-    async fn get_user_by_email(&self, email: &str) -> Result<Option<UserDto>>;
+    async fn get_user_by_email(&self, email: &str, state: &AppState) -> Result<Option<UserDto>>;
-    async fn create_user_by_dto(&self, new_user: CreateUserDto) -> Result<UserDto>;
+    async fn create_user_by_dto(&self, new_user: CreateUserDto, state: &AppState) -> Result<UserDto>;
-    async fn update_user_avatar(&self, email: &str, avatar_url: Option<String>) -> Result<()>;
+    async fn update_user_avatar(&self, email: &str, avatar_url: Option<String>, state: &AppState) -> Result<()>;
     async fn upload_file(state: &AppState, user_id: String, multipart: Multipart) -> Response;
 }
 
@@ -76,11 +75,16 @@ impl UsersServiceTrait for UsersService {
 		}
 	}
 
-	async fn get_user_me(user: UsersDetailQueryDto, _state: &AppState) -> Response {
+	async fn get_user_me(claims: imphnen_libs::jsonwebtoken::Claims, state: &AppState) -> Response {
-		// User data is already provided by the permissions_guard
+		let repo = UsersRepository::new(state);
-		success_response(ResponseSuccessDto {
+		let thing_id = make_thing(&ResourceEnum::Users.to_string(), &claims.user_id);
-			data: UserDto::from(&user),
+		match repo.query_user_by_id(&thing_id).await {
-		})
+			Ok(user) if !user.is_deleted => success_response(ResponseSuccessDto {
+				data: UserDto::from(&user),
+			}),
+			Ok(_) => common_response(StatusCode::NOT_FOUND, "User not found"),
+			Err(e) => common_response(StatusCode::NOT_FOUND, &e.to_string()),
+		}
 	}
 
 	async fn create_user(
@@ -134,34 +138,23 @@ impl UsersServiceTrait for UsersService {
 	}
 
 	async fn update_user_me(
-		headers: HeaderMap,
+		claims: imphnen_libs::jsonwebtoken::Claims,
 		state: &AppState,
-		user: UsersUpdateRequestDto,
+		user_update_dto: UsersUpdateRequestDto,
 	) -> Response {
 		let repo = UsersRepository::new(state);
 		
-		// Try synchronous email extraction first (for internal JWT tokens)
+		let thing_id = make_thing(&ResourceEnum::Users.to_string(), &claims.user_id);
-		let email = match extract_email(&headers) {
+		let user_data = match repo.query_user_by_id(&thing_id).await {
-			Some(email) => email,
-			None => {
-				// If sync extraction fails, try async (for Google tokens)
-				match extract_email_async(&headers).await {
-					Some(email) => email,
-					None => return common_response(StatusCode::UNAUTHORIZED, "Unauthorized"),
-				}
-			}
-		};
-		
-		let user_data = match repo.query_user_by_email(email.clone()).await {
 			Ok(user) => user,
 			Err(_) => return common_response(StatusCode::NOT_FOUND, "User not found"),
 		};
 		
-		if let Err((status, message)) = validate_request(&user) {
+		if let Err((status, message)) = validate_request(&user_update_dto) {
 			return common_response(status, &message);
 		}
 		
-		let updated_user = UsersSchema::partial_update(user_data, user);
+		let updated_user = UsersSchema::partial_update(user_data, user_update_dto);
 		match repo.query_update_user(updated_user).await {
 			Ok(msg) => common_response(StatusCode::OK, &msg),
 			Err(e) => common_response(StatusCode::BAD_REQUEST, &e.to_string()),
@@ -268,79 +261,46 @@ impl UsersServiceTrait for UsersService {
 		}
 	}
 
-    #[allow(unused_variables)]
+    async fn get_user_by_email(&self, email: &str, state: &AppState) -> Result<Option<UserDto>> {
-    async fn get_user_by_email(&self, email: &str) -> Result<Option<UserDto>> {
+        let repo = UsersRepository::new(state);
-        let surrealdb_ws = surrealdb_init_ws().await
-            .map_err(|e| anyhow::anyhow!("Failed to initialize websocket database: {}", e))?;
-        let surrealdb_mem = surrealdb_init_mem().await
-            .map_err(|e| anyhow::anyhow!("Failed to initialize memory database: {}", e))?;
-        
-        let state = AppState {
-            surrealdb_ws,
-            surrealdb_mem,
-        };
-        let repo = UsersRepository::new(&state);
         let user = repo.query_user_by_email(email.to_string()).await;
         match user {
-            Ok(u) => Ok(Some(UserDto::from(&u))), // Corrected to use UserDto::from by reference
+            Ok(u) => Ok(Some(UserDto::from(&u))),
             Err(e) if e.to_string().contains("User not found") => Ok(None),
             Err(e) => Err(anyhow::anyhow!(e.to_string())),
         }
     }
 
-    #[allow(unused_variables)]
+    async fn create_user_by_dto(&self, new_user: CreateUserDto, state: &AppState) -> Result<UserDto> {
-    async fn create_user_by_dto(&self, new_user: CreateUserDto) -> Result<UserDto> {
+        let repo = UsersRepository::new(state);
-        let surrealdb_ws = surrealdb_init_ws().await
+        let email_clone = new_user.email.clone();
-            .map_err(|e| anyhow::anyhow!("Failed to initialize websocket database: {}", e))?;
-        let surrealdb_mem = surrealdb_init_mem().await
-            .map_err(|e| anyhow::anyhow!("Failed to initialize memory database: {}", e))?;
-        
-        let state = AppState {
-            surrealdb_ws,
-            surrealdb_mem,
-        };
-        let repo = UsersRepository::new(&state);
-        let email_clone = new_user.email.clone(); // Store email before moving new_user
         let user_schema = UsersSchema {
             email: new_user.email,
-            password: new_user.password, // No unwrap_or_default needed
+            password: new_user.password,
             fullname: new_user.fullname,
-            phone_number: new_user.phone_number, // No unwrap_or_default needed
+            phone_number: new_user.phone_number,
-            is_active: new_user.is_active, // No unwrap_or needed
+            is_active: new_user.is_active,
-            avatar: new_user.avatar, // Copy avatar from DTO
+            avatar: new_user.avatar,
             role: make_thing(&ResourceEnum::Roles.to_string(), &new_user.role_id),
             ..Default::default()
         };
         match repo.query_create_user(user_schema).await {
-            Ok(_msg) => { // msg is String, not UsersDetailQueryDto
+            Ok(_msg) => {
-                // Re-fetch the created user to get the full UsersDetailQueryDto
+                let created_user = repo.query_user_by_email(email_clone).await?;
-                let created_user = repo.query_user_by_email(email_clone).await?; // Use cloned email
+                Ok(UserDto::from(&created_user))
-                Ok(UserDto::from(&created_user)) // Corrected to use UserDto::from by reference
             },
             Err(e) => Err(anyhow::anyhow!(e.to_string())),
         }
     }
 
-    async fn update_user_avatar(&self, email: &str, avatar_url: Option<String>) -> Result<()> {
+    async fn update_user_avatar(&self, email: &str, avatar_url: Option<String>, state: &AppState) -> Result<()> {
-        let surrealdb_ws = surrealdb_init_ws().await
+        let repo = UsersRepository::new(state);
-            .map_err(|e| anyhow::anyhow!("Failed to initialize websocket database: {}", e))?;
-        let surrealdb_mem = surrealdb_init_mem().await
-            .map_err(|e| anyhow::anyhow!("Failed to initialize memory database: {}", e))?;
         
-        let state = AppState {
-            surrealdb_ws,
-            surrealdb_mem,
-        };
-        let repo = UsersRepository::new(&state);
-        
-        // Get the existing user
         let mut user = repo.query_user_by_email(email.to_string()).await
             .map_err(|e| anyhow::anyhow!("Failed to get user: {}", e))?;
         
-        // Update the avatar
         user.avatar = avatar_url;
         
-        // Convert to schema and update
         let user_schema = UsersSchema::from(user);
         match repo.query_update_user(user_schema).await {
             Ok(_) => {