fix(profiles): restore admin ability to edit other users' profiles - #338
Merged
Conversation
The update_profile endpoint used RequireUserOwner which returns only the caller's user_id — no role information. The ownership check blocked ALL non-owner edits with 403, including admins. This regressed in d37b30a when the old Member model (RequireAdmin) was replaced with UserProfile. Backend: read X-User-Roles header directly in update_profile (same pattern as node_tags.py / routes.py) and bypass the ownership check when the admin role is present. Regular members editing their own profiles are unaffected — RequireUserOwner stays as the dependency. Frontend: extract ProfileEditForm component (with data-testids) from OwnProfileView. PublicProfileView now shows an inline edit form when an admin views another user's profile. Owner still gets the existing edit link; non-admins see nothing. Tests: - Backend: test_update_profile_admin_can_edit_other (admin edits other user's profile, asserts 200 + all fields updated) - Vitest: 4 new tests — admin button visibility, non-admin hidden, owner link vs admin button, form submission to correct endpoint - E2E: admin-profile-edit.spec.ts (admin edits Mem South's profile, verifies persistence; admin on own profile sees no admin button); members.spec.ts negative assertion (member sees no admin button)
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a regression from
d37b30awhere admins lost the ability to edit other users' profiles. Theupdate_profileendpoint usedRequireUserOwner(returns onlyuser_id, no role info) and blocked all non-owner edits with 403 — no admin bypass existed despite the docstring claiming "Only the owner or admin can update."Changes
Backend —
api/routes/user_profiles.pyX_USER_ROLES_HEADERfromauth.pyupdate_profile, read roles from the request header and bypass the ownership check when the admin role is present (same pattern asnode_tags.py:48-51androutes.py:112)RequireUserOwnerstays as the dependency — regular members editing their own profiles are unaffectedFrontend —
pages/Profile.tsxProfileEditFormcomponent fromOwnProfileView(withdata-testids:profile-form,profile-name,profile-callsign,profile-description,profile-url,profile-save)PublicProfileViewnow shows an inline edit form when an admin (hasRole("admin")) views another user's profile (!isOwner)profile-admin-cancel) exits edit modeTests
test_update_profile_admin_can_edit_otherapiPutcalled with/api/v1/user/profile/p1+ correct bodyadmin-profile-edit.spec.tsmembers.spec.tsAll: 34 backend / 335 frontend / pre-commit clean / e2e typecheck clean.