Add 4 files, update 15 files

src/app/api/users/role/route.ts

@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server';
 import { z } from 'zod';
 import { db } from '@/lib/db';
 import { getSession } from '@/lib/auth';
+import { canManageUser } from '@/lib/role-access';
 
 const changeRoleSchema = z.object({
   userId: z.string().min(1),
@@ -48,6 +49,10 @@ export async function PUT(request: Request) {
       return NextResponse.json({ error: 'User not found' }, { status: 404 });
     }
 
+    if (!canManageUser(session.user?.role, existing.role, userId === session.userId)) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
+
     // School admins can only manage users from their own school
     if (
       session.user?.role === 'SCHOOL_ADMIN' &&