Validate bearer token in all endpoints before database actions #95

Description:
Currently, our endpoints perform database actions as long as they are called with a bearer token. However, we are not validating the contents of the token before allowing the action. This is a security gap.

What needs to happen:
Before any endpoint executes its logic, we need to validate the bearer token to ensure that the request is coming from an authorized and valid user. Specifically:

1. Check id: Verify that the id in the token belongs to a user that still exists in the database (worked on issue Endpoints: Check if owner of token exists in database #100).

   • If the user does not exist, reject the request.

2. Check role: Verify that the user’s role in the token matches the required authorization level for the action being requested.

   • Example: only teacher should be able to perform an update on a user other than they self.

Acceptance criteria:

• Each endpoint validates the bearer token before running its logic.
• Invalid or expired tokens are rejected with an appropriate error response (e.g., 401 Unauthorized).
• Requests from users that do not exist in the database are rejected.
• Requests from users without sufficient privileges are rejected with 403 Forbidden.
• Unit tests exist to confirm that invalid tokens, missing users, and insufficient roles are correctly rejected.

Why this matters:
Without validating the bearer token properly, we risk unauthorized users or stale tokens being used to perform actions in the database, which could lead to data corruption, privilege escalation, or other security issues.