fix(profiles): restore admin ability to edit other users' profiles

e2e/tests/admin-profile-edit.spec.ts

@@ -0,0 +1,51 @@
+import { expect, test } from "@playwright/test";
+import { ADMIN_STATE } from "../utils/helpers";
+
+test.use({ storageState: ADMIN_STATE });
+
+test.describe.serial("admin profile edit", () => {
+  test("admin can edit another user's profile", async ({ page }) => {
+    await page.goto("/members");
+
+    // Navigate to Mem South's profile (not the admin's own).
+    await page
+      .getByTestId("member-card")
+      .filter({ hasText: "Mem South" })
+      .first()
+      .click();
+    await expect(page).toHaveURL(/\/profile\//);
+
+    // Admin sees the edit button (owner does NOT — sub mismatch).
+    await expect(page.getByTestId("profile-admin-edit")).toBeVisible();
+
+    // Click edit — form appears pre-filled with the target profile's values.
+    await page.getByTestId("profile-admin-edit").click();
+    await expect(page.getByTestId("profile-form")).toBeVisible();
+    await expect(page.getByTestId("profile-name")).toHaveValue("Mem South");
+
+    // Edit callsign and save.
+    await page.getByTestId("profile-callsign").fill("ADMEDIT");
+    await page.getByTestId("profile-save").click();
+
+    // Read-only view returns with updated callsign badge.
+    await expect(page.getByTestId("profile-admin-edit")).toBeVisible();
+    await expect(page.getByText("ADMEDIT")).toBeVisible();
+  });
+
+  test("admin does not see admin edit button on own profile", async ({
+    page,
+  }) => {
+    // Navigate to own profile via members page.
+    await page.goto("/members");
+    await page
+      .getByTestId("member-card")
+      .filter({ hasText: "PW Admin" })
+      .first()
+      .click();
+    await expect(page).toHaveURL(/\/profile\//);
+
+    // Admin IS the owner here — should see the owner edit link, not the
+    // admin edit button.
+    await expect(page.getByTestId("profile-admin-edit")).toHaveCount(0);
+  });
+});

e2e/tests/members.spec.ts

@@ -32,6 +32,10 @@ test.describe("members", () => {
     await expect(page).toHaveURL(/\/profile\/[0-9a-f-]{36}/);
     await expect(page.getByText("Mem South").first()).toBeVisible();
     await expect(page.locator('nav[aria-label="Breadcrumb"]')).toBeVisible();
+
+    // A member viewing another user's profile must NOT see the admin edit
+    // button.
+    await expect(page.getByTestId("profile-admin-edit")).toHaveCount(0);
   });
 
   test("clicking a member node shows the node detail page", async ({ page }) => {

src/meshcore_hub/api/routes/user_profiles.py

@@ -7,7 +7,12 @@
 from sqlalchemy import func, or_, select
 from sqlalchemy.orm import selectinload
 
-from meshcore_hub.api.auth import RequireRead, RequireUserOwner, X_USER_ID_HEADER
+from meshcore_hub.api.auth import (
+    RequireRead,
+    RequireUserOwner,
+    X_USER_ID_HEADER,
+    X_USER_ROLES_HEADER,
+)
 from meshcore_hub.api.cache import cached
 from meshcore_hub.api.cache_invalidation import (
     invalidate_dashboard,
@@ -223,10 +228,14 @@ def update_profile(
         )
 
     if profile.user_id != caller_id:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="Access denied: cannot modify another user's profile",
-        )
+        roles_header = request.headers.get(X_USER_ROLES_HEADER, "")
+        roles = [r.strip() for r in roles_header.split(",") if r.strip()]
+        admin_role = getattr(request.app.state, "oidc_role_admin", "admin")
+        if admin_role not in roles:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Access denied: cannot modify another user's profile",
+            )
 
     if profile_update.name is not None:
         profile.name = profile_update.name.strip()

src/meshcore_hub/web/static/js/spa-react/pages/Profile.test.tsx

@@ -1,5 +1,5 @@
-import { screen, waitFor } from "@testing-library/react";
-import { describe, expect, it, vi } from "vitest";
+import { fireEvent, screen, waitFor } from "@testing-library/react";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { Profile } from "@/pages/Profile";
 import { renderWithProviders } from "@/test/renderWithProviders";
@@ -52,6 +52,110 @@ describe("Profile (public view)", () => {
   });
 });
 
+describe("Profile (admin edit)", () => {
+  afterEach(() => {
+    window.__APP_CONFIG__ = makeConfig();
+  });
+
+  function setAdminConfig() {
+    const config = makeConfig({
+      oidc_enabled: true,
+      user: { sub: "admin-user", name: "Admin" },
+      roles: ["admin"],
+      role_names: { admin: "admin", operator: "operator", member: "member" },
+    });
+    window.__APP_CONFIG__ = config;
+    return config;
+  }
+
+  function setMemberConfig() {
+    const config = makeConfig({
+      oidc_enabled: true,
+      user: { sub: "other-user", name: "Member" },
+      roles: ["member"],
+      role_names: { admin: "admin", operator: "operator", member: "member" },
+    });
+    window.__APP_CONFIG__ = config;
+    return config;
+  }
+
+  it("admin sees edit button on another user's profile", async () => {
+    vi.spyOn(api, "apiGet").mockResolvedValue(PROFILE_DATA);
+    const config = setAdminConfig();
+    renderWithProviders(<Profile />, {
+      route: "/profile/p1",
+      routePath: "/profile/:id",
+      config,
+    });
+    await waitFor(() => {
+      expect(screen.getByTestId("profile-admin-edit")).toBeInTheDocument();
+    });
+  });
+
+  it("non-admin does not see edit button on another user's profile", async () => {
+    vi.spyOn(api, "apiGet").mockResolvedValue(PROFILE_DATA);
+    const config = setMemberConfig();
+    renderWithProviders(<Profile />, {
+      route: "/profile/p1",
+      routePath: "/profile/:id",
+      config,
+    });
+    await waitFor(() => {
+      expect(screen.getAllByText("Jane Operator").length).toBeGreaterThanOrEqual(1);
+    });
+    expect(screen.queryByTestId("profile-admin-edit")).toBeNull();
+  });
+
+  it("owner sees edit link, not admin edit button", async () => {
+    vi.spyOn(api, "apiGet").mockResolvedValue(PROFILE_DATA);
+    const config = makeConfig({
+      oidc_enabled: true,
+      user: { sub: "user-123", name: "Jane" },
+      roles: ["admin"],
+      role_names: { admin: "admin", operator: "operator", member: "member" },
+    });
+    window.__APP_CONFIG__ = config;
+    renderWithProviders(<Profile />, {
+      route: "/profile/p1",
+      routePath: "/profile/:id",
+      config,
+    });
+    await waitFor(() => {
+      expect(screen.getAllByText("Jane Operator").length).toBeGreaterThanOrEqual(1);
+    });
+    expect(screen.queryByTestId("profile-admin-edit")).toBeNull();
+  });
+
+  it("admin edit form submits to correct endpoint", async () => {
+    vi.spyOn(api, "apiGet").mockResolvedValue(PROFILE_DATA);
+    const apiPutSpy = vi.spyOn(api, "apiPut").mockResolvedValue(undefined);
+    const config = setAdminConfig();
+    renderWithProviders(<Profile />, {
+      route: "/profile/p1",
+      routePath: "/profile/:id",
+      config,
+    });
+    await waitFor(() => {
+      expect(screen.getByTestId("profile-admin-edit")).toBeInTheDocument();
+    });
+
+    fireEvent.click(screen.getByTestId("profile-admin-edit"));
+
+    const nameInput = await screen.findByTestId("profile-name");
+    fireEvent.change(nameInput, { target: { value: "Admin Set Name" } });
+    fireEvent.click(screen.getByTestId("profile-save"));
+
+    await waitFor(() => {
+      expect(apiPutSpy).toHaveBeenCalledWith("/api/v1/user/profile/p1", {
+        name: "Admin Set Name",
+        callsign: "AB1CDE",
+        description: "Mesh enthusiast",
+        url: "https://example.com",
+      });
+    });
+  });
+});
+
 describe("Profile (own view)", () => {
   it("shows a login prompt when OIDC is disabled", async () => {
     renderWithProviders(<Profile />, { route: "/profile" });