This is not a full response to your question but what I could quickly jot down while looking at your post. Sorry, no insights to share. I would discourage you from choosing this answer in case someone with a more fleshed out response decides to come along and provide more value.
I looked over the song controller. I considered style and organization choices ...
I think I came up with a better and more declarative way using Joi schemas in nested dictionaries.
The idea is that we first figure out these three things:
Is the user editing themselves? (bool)
What type of user is the editor? (admin, etc)
What type of user is being edited? (admin, etc)
And based on those three things, we can lookup the correct Joi schema ...
After I examine the codes you have written, I could see some things that are not rightly done. Below are the few things I highlighted:
The structuring of the codebase is not okay hence it can be maintainable and scalable if the codebase grows.
The RESTful API naming convention is not an acceptable one. Endpoints of any REST API should contain only resources ...