An Authenticated User can update other users

[cnuis2cool]

router
  .route('/:userId')
   .patch(auth(), validate(userValidation.updateUser), userController.updateUser);

The above endpoint allows an authenticated user to update another user.

How can we restrict a user updating another user's data but allow updating his data?

[unpseudocomplique]

you removed the 'manageUsers'. You should have .patch(auth('manageUsers'), validate(userValidation.updateUser), userController.updateUser)