FIX: user patch route

Beta

src/modules/platform-api/platform-api.controller.ts

@@ -630,21 +630,39 @@ export class PlatformApiController {
   @ApiOperation({ summary: 'Execute a pipeline' })
   @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async executePipeline(@Body() body: any, @User() user: RequestUser) {
-    return this.platformApiService.proxy('POST', '/pipeline/execute', user, body);
+    // Inject customer_id (actually customer_name) into body for Platform-API
+    // Note: Platform-API was created before customer_id existed, so it expects customer_name in the customer_id field
+    const enrichedBody = {
+      ...body,
+      customer_id: user.customer_name,
+    };
+    return this.platformApiService.proxy('POST', '/pipeline/execute', user, enrichedBody);
   }
 
   @Post('pipeline/pause')
   @ApiOperation({ summary: 'Pause a pipeline' })
   @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async pausePipeline(@Body() body: any, @User() user: RequestUser) {
-    return this.platformApiService.proxy('POST', '/pipeline/pause', user, body);
+    // Inject customer_id (actually customer_name) into body for Platform-API
+    // Note: Platform-API was created before customer_id existed, so it expects customer_name in the customer_id field
+    const enrichedBody = {
+      ...body,
+      customer_id: user.customer_name,
+    };
+    return this.platformApiService.proxy('POST', '/pipeline/pause', user, enrichedBody);
   }
 
   @Post('pipeline/unpause')
   @ApiOperation({ summary: 'Unpause a pipeline' })
   @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async unpausePipeline(@Body() body: any, @User() user: RequestUser) {
-    return this.platformApiService.proxy('POST', '/pipeline/unpause', user, body);
+    // Inject customer_id (actually customer_name) into body for Platform-API
+    // Note: Platform-API was created before customer_id existed, so it expects customer_name in the customer_id field
+    const enrichedBody = {
+      ...body,
+      customer_id: user.customer_name,
+    };
+    return this.platformApiService.proxy('POST', '/pipeline/unpause', user, enrichedBody);
   }
 
   @Put('pipeline/:pipelineId/memory')

src/modules/users/users.controller.ts

@@ -274,9 +274,17 @@ export class UsersController {
     @Language() language: LanguageEnum,
   ) {
 
-    if (user.user_id !== id || !user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)) {
+    const isSameUser = user.user_id === id;
+    const isSuperAdmin = user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)
+    if (!isSameUser && !isSuperAdmin) {
       throw new ErrorBuilder(ErrorCodes.AUTH.FORBIDDEN);
     }
+
+    if (isSameUser && !isSuperAdmin && body.roleNames) {
+      // Prevent users from updating their own roles
+      delete body.roleNames;
+    }
+
     this.logger.info('updateUser', { user });
     this.userService.setLanguage(language);
     return await this.userService.updateUser(body, id, user.customer_id);