chore: Improve comments for role-based access in employee routes

Author: NadeeshaNJ

routers/employees.js

@@ -3,9 +3,14 @@ const router = express.Router();
 const employeeController = require('../controllers/employeeController');
 const { authenticateToken, authorizeRoles } = require('../middleware/auth');
 
+// Note: Ensure the roles used here ('Admin', 'Manager') match the exact case 
+// stored in your database's user_account.role column.
+
 // Get all employees (with optional filters)
 router.get('/', 
-  authenticateToken, 
+  authenticateToken,
+  // Required roles for viewing all employee data
+  authorizeRoles('Admin', 'Manager'), 
   employeeController.getAllEmployees
 );
 
@@ -19,6 +24,8 @@ router.get('/stats',
 // Get single employee by ID
 router.get('/:id', 
   authenticateToken, 
+  // Often, any employee or the employee themselves should be able to view their own profile.
+  // Assuming general authenticated access is sufficient here, but Manager/Admin might be better.
   employeeController.getEmployeeById
 );
 
@@ -39,6 +46,7 @@ router.put('/:id',
 // Delete employee
 router.delete('/:id', 
   authenticateToken, 
+  // Deleting employees should typically be restricted to the highest level.
   authorizeRoles('Admin'), 
   employeeController.deleteEmployee
 );