Only admin can remove other users accounts

api/user_views.py

@@ -60,10 +60,14 @@ def edit_user(user_id):
 @user_bp.route('/users/<int:user_id>', methods=['DELETE'])
 @jwt_required()
 def remove_user(user_id):
+    logged_user_id = int(get_jwt_identity())
+    logged_user_role = User.query.get(logged_user_id).role
+    if logged_user_role != "Administrator" and logged_user_id != user_id:
+        return jsonify({'error': f'You can not remove other user accounts.'}), 403
     user_to_delete = User.query.get_or_404(user_id)
     db.session.delete(user_to_delete)
     db.session.commit()
-    return jsonify({})
+    return jsonify({"msg": "User removed successfully."})
 
 @user_bp.route('/login', methods=['POST'])
 def user_login():