fix(dashboard): use updateActiveAdministrator for profile page

The profile page used the updateAdministrator mutation which requires
Permission.UpdateAdministrator, preventing administrators without that
permission from editing their own profile (name, email, password).

Switch to updateActiveAdministrator which is gated by Permission.Owner
and resolves the target from ctx.activeUserId, so any authenticated
administrator can edit their own profile without needing elevated
permissions.

- Replace updateAdministratorDocument with updateActiveAdministratorDocument
- Remove id from setValuesForUpdate (UpdateActiveAdministratorInput has
  no id field; the server infers it from the active user)
- Add e2e test verifying a restricted admin (without UpdateAdministrator)
  can update their own profile

Fixes #5037

Author: Ryrahul

packages/dashboard/e2e/tests/settings/profile.spec.ts

@@ -1,5 +1,7 @@
 import { expect, test } from '@playwright/test';
 
+import { VendureAdminClient } from '../../utils/vendure-admin-client.js';
+
 test.describe('Profile', () => {
     test('should display profile page with form fields', async ({ page }) => {
         await page.goto('/profile');
@@ -87,4 +89,65 @@ test.describe('Profile', () => {
         // Reset to original value (don't submit)
         await firstNameInput.fill(originalValue);
     });
+
+    // #5037 — an admin without UpdateAdministrator permission must still be able to
+    // edit their own profile (the page uses updateActiveAdministrator, gated by Owner)
+    test('should allow an admin without UpdateAdministrator permission to update own profile', async ({
+        page,
+        browser,
+    }) => {
+        const suffix = Date.now();
+        const emailAddress = `restricted-${suffix}@test.com`;
+        const password = 'test-password';
+
+        const client = new VendureAdminClient(page);
+        await client.login();
+        const { createRole } = await client.gql(
+            `mutation ($input: CreateRoleInput!) { createRole(input: $input) { id } }`,
+            {
+                input: {
+                    code: `restricted-${suffix}`,
+                    description: 'No admin permissions',
+                    permissions: ['ReadCatalog'],
+                },
+            },
+        );
+        await client.gql(
+            `mutation ($input: CreateAdministratorInput!) { createAdministrator(input: $input) { id } }`,
+            {
+                input: {
+                    firstName: 'Restricted',
+                    lastName: 'Admin',
+                    emailAddress,
+                    password,
+                    roleIds: [createRole.id],
+                },
+            },
+        );
+
+        // Fresh context so we browse as the restricted admin, not the superadmin
+        const context = await browser.newContext({ storageState: { cookies: [], origins: [] } });
+        const restrictedPage = await context.newPage();
+        await restrictedPage.goto('/login');
+        await restrictedPage.getByPlaceholder('Email').fill(emailAddress);
+        await restrictedPage.getByPlaceholder('Password').fill(password);
+        await restrictedPage.getByRole('button', { name: 'Sign in' }).click();
+        await expect(restrictedPage).not.toHaveURL(/\/login/, { timeout: 15_000 });
+
+        await restrictedPage.goto('/profile');
+        const firstNameField = restrictedPage.locator('[data-slot="field"]').filter({
+            has: restrictedPage.locator('[data-slot="field-label"]').getByText('First name', { exact: true }),
+        });
+        await firstNameField.getByRole('textbox').fill('Renamed');
+        await restrictedPage.getByRole('button', { name: 'Update' }).click();
+
+        await expect(
+            restrictedPage.locator('[data-sonner-toast]').filter({ hasText: 'Successfully updated profile' }),
+        ).toBeVisible({ timeout: 10_000 });
+
+        await restrictedPage.reload();
+        await expect(firstNameField.getByRole('textbox')).toHaveValue('Renamed');
+
+        await context.close();
+    });
 });

packages/dashboard/src/app/routes/_authenticated/_profile/profile.graphql.ts

@@ -21,9 +21,9 @@ export const activeAdministratorDocument = graphql(`
     }
 `);
 
-export const updateAdministratorDocument = graphql(`
-    mutation UpdateAdministrator($input: UpdateAdministratorInput!) {
-        updateAdministrator(input: $input) {
+export const updateActiveAdministratorDocument = graphql(`
+    mutation UpdateActiveAdministrator($input: UpdateActiveAdministratorInput!) {
+        updateActiveAdministrator(input: $input) {
             id
         }
     }

packages/dashboard/src/app/routes/_authenticated/_profile/profile.tsx

@@ -20,7 +20,7 @@ import { useLocalFormat } from '@/vdb/hooks/use-local-format.js';
 import { Trans, useLingui } from '@lingui/react/macro';
 import { createFileRoute } from '@tanstack/react-router';
 import { toast } from 'sonner';
-import { activeAdministratorDocument, updateAdministratorDocument } from './profile.graphql.js';
+import { activeAdministratorDocument, updateActiveAdministratorDocument } from './profile.graphql.js';
 
 const pageId = 'profile';
 
@@ -49,11 +49,10 @@ function ProfilePage() {
     const { form, submitHandler, isPending, entity } = useDetailPage({
         queryDocument: activeAdministratorDocument,
         entityField: 'activeAdministrator',
-        updateDocument: updateAdministratorDocument,
+        updateDocument: updateActiveAdministratorDocument,
         pageId,
         setValuesForUpdate: entity => {
             return {
-                id: entity.id,
                 firstName: entity.firstName,
                 lastName: entity.lastName,
                 emailAddress: entity.emailAddress,