From 76485f929dbf8f4fe3e3a30e41e33dd0dd23317c Mon Sep 17 00:00:00 2001
From: Marcos Rodrigues <marcos.rodrigues.dev@gmail.com>
Date: Fri, 26 Dec 2025 17:53:02 -0300
Subject: [PATCH] FIX: user patch route

---
 src/modules/users/users.controller.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/modules/users/users.controller.ts b/src/modules/users/users.controller.ts
index b5cb32b..71ba19c 100644
--- a/src/modules/users/users.controller.ts
+++ b/src/modules/users/users.controller.ts
@@ -274,9 +274,17 @@ export class UsersController {
     @Language() language: LanguageEnum,
   ) {
 
-    if (user.user_id !== id || !user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)) {
+    const isSameUser = user.user_id === id;
+    const isSuperAdmin = user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)
+    if (!isSameUser && !isSuperAdmin) {
       throw new ErrorBuilder(ErrorCodes.AUTH.FORBIDDEN);
     }
+
+    if (isSameUser && !isSuperAdmin && body.roleNames) {
+      // Prevent users from updating their own roles
+      delete body.roleNames;
+    }
+
     this.logger.info('updateUser', { user });
     this.userService.setLanguage(language);
     return await this.userService.updateUser(body, id, user.customer_id);