Skip to content

Commit 0ab495e

Browse files
committed
fix(dashboard): use updateActiveAdministrator for profile page
The profile page used the updateAdministrator mutation which requires Permission.UpdateAdministrator, preventing administrators without that permission from editing their own profile (name, email, password). Switch to updateActiveAdministrator which is gated by Permission.Owner and resolves the target from ctx.activeUserId, so any authenticated administrator can edit their own profile without needing elevated permissions. - Replace updateAdministratorDocument with updateActiveAdministratorDocument - Remove id from setValuesForUpdate (UpdateActiveAdministratorInput has no id field; the server infers it from the active user) Fixes #5035
1 parent db8482a commit 0ab495e

2 files changed

Lines changed: 5 additions & 6 deletions

File tree

packages/dashboard/src/app/routes/_authenticated/_profile/profile.graphql.ts

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,9 @@ export const activeAdministratorDocument = graphql(`
2121
}
2222
`);
2323

24-
export const updateAdministratorDocument = graphql(`
25-
mutation UpdateAdministrator($input: UpdateAdministratorInput!) {
26-
updateAdministrator(input: $input) {
24+
export const updateActiveAdministratorDocument = graphql(`
25+
mutation UpdateActiveAdministrator($input: UpdateActiveAdministratorInput!) {
26+
updateActiveAdministrator(input: $input) {
2727
id
2828
}
2929
}

packages/dashboard/src/app/routes/_authenticated/_profile/profile.tsx

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ import { useLocalFormat } from '@/vdb/hooks/use-local-format.js';
2020
import { Trans, useLingui } from '@lingui/react/macro';
2121
import { createFileRoute } from '@tanstack/react-router';
2222
import { toast } from 'sonner';
23-
import { activeAdministratorDocument, updateAdministratorDocument } from './profile.graphql.js';
23+
import { activeAdministratorDocument, updateActiveAdministratorDocument } from './profile.graphql.js';
2424

2525
const pageId = 'profile';
2626

@@ -49,11 +49,10 @@ function ProfilePage() {
4949
const { form, submitHandler, isPending, entity } = useDetailPage({
5050
queryDocument: activeAdministratorDocument,
5151
entityField: 'activeAdministrator',
52-
updateDocument: updateAdministratorDocument,
52+
updateDocument: updateActiveAdministratorDocument,
5353
pageId,
5454
setValuesForUpdate: entity => {
5555
return {
56-
id: entity.id,
5756
firstName: entity.firstName,
5857
lastName: entity.lastName,
5958
emailAddress: entity.emailAddress,

0 commit comments

Comments
 (0)