Description

Create a GET route handler at /api/users that returns a list of all User records.

Success Criteria

• If the request does not have a valid session, then GET /api/users returns a 401 status code with JSON body {"message": "Session required"}
• If the request session user type is not STAFF, ADMIN or SUPER_ADMIN, then GET /api/users returns a 403 status code with JSON body {"message": "Must be STAFF, ADMIN, or SUPER_ADMIN"}
• GET /api/users returns a 200 status code and all User records as JSON objects (include email and type fields only)
• The route handler is documented with a description of its function, parameters, and responses
• There is a test file that covers the success criteria