Customers and Admins

So far every user is the same kind of user, so the shop can't tell its owner from a shopper. A role column fixes that: each user is a 'customer' or an 'admin', and only admins may add products.

A column with a DEFAULT fills itself in when an INSERT leaves it out. For example, an orders table could start every order as 'new', so an INSERT that gives only the user_id still gets a status:

db.execute("CREATE TABLE IF NOT EXISTS orders (id INTEGER PRIMARY KEY, user_id INTEGER NOT NULL, status TEXT NOT NULL DEFAULT 'new')");
db.update("INSERT INTO orders (user_id) VALUES (?)", 2);

There are two ways to say no. 401 means "I don't know who you are: log in". 403 Forbidden means "I know who you are, and you may not do this". A second check, adminRequired(user, view), gives the 403. It takes the user that loginRequired found, so it runs inside loginRequired's lambda.

Nobody can sign up as an admin, so the shop creates its owner's account itself, in the constructor, when it starts. Ana signs up after that, so she gets id 2:

POST /register  {"email": "ana@example.com", "password": "secret123"}  →  201  {"email": "ana@example.com", "id": 2}
GET /me  (Ana's token)  →  200  {"email": "ana@example.com", "id": 2, "role": "customer"}
POST /products  {"name": "Desk", "price": 120}  (Ana's token)  →  403  {"error": "Admins only"}
POST /products  {"name": "Desk", "price": 120}  (no token)  →  401  {"error": "Login required"}
POST /login  {"email": "admin@example.com", "password": "admin-pass-123"}  →  200  {"token": "…"}
GET /me  (admin's token)  →  200  {"email": "admin@example.com", "id": 1, "role": "admin"}
POST /products  {"name": "Desk", "price": 120}  (admin's token)  →  201  {"id": 9, "name": "Desk", "price": 120}

Your task: give the users table a role column that defaults to 'customer', create the admin account in the constructor, select the role in currentUser, write adminRequired, and make addProduct run loginRequired, then adminRequired, then the given saveProduct.

Assignment
Follow the Coding Tutorial to give every user a role and let only admins add products.

Hint
Inside SQL written in double quotes, the text 'customer' takes single quotes. adminRequired needs a user, so it goes inside loginRequired's lambda, never before it.