feat: add password change, class unenroll, and optional notify flags

Let admins skip SMS on user, class, and invoice actions, and let users change their own password with the current one.

components/users/userController.js

@@ -17,6 +17,10 @@ exports.getSelf = catchAsync(async (req, res, next) => {
 exports.updateSelf = catchAsync(async (req, res, next) => {
   delete req.body.role;
   delete req.body.isActive;
+  delete req.body.password;
+  delete req.body.passwordHash;
+  delete req.body.refreshTokens;
+  delete req.body.username;
 
   const user = await userService.updateUser(req.user._id, req.body);
   return successResponse(res, 200, 'Profile updated successfully', user);

components/users/userService.js

@@ -11,6 +11,7 @@ const { generateUsername, generateSimplePassword } = require('../../utils/creden
 const { sendAccountCreatedSms } = require('../../utils/senders/smsMessages');
 const logger = require('../../utils/logger');
 const { mergeFullName, normalizeGender } = require('../../utils/userProfile');
+const { pickNotifyFlags } = require('../../utils/notifyFlags');
 
 const normalizeAdminNotes = (value) => {
   if (value == null) return undefined;
@@ -175,7 +176,9 @@ const createUserAdmin = async (body) => {
   });
 
   try {
-    await sendAccountCreatedSms(profile.phoneNumber, username, plainPassword, user._id);
+    if (pickNotifyFlags(body).sms) {
+      await sendAccountCreatedSms(profile.phoneNumber, username, plainPassword, user._id);
+    }
   } catch (err) {
     logger.error(`[createUserAdmin] Account SMS failed for ${profile.phoneNumber}: ${err.message}`);
   }