FIX: user patch route

Beta

docsfera.json

@@ -1321,9 +1321,6 @@
             "Users"
           ],
           "security": [
-            {
-              "access-token": []
-            },
             {
               "access-token": []
             }

src/modules/platform-api/platform-api.controller.ts

@@ -630,21 +630,39 @@ export class PlatformApiController {
   @ApiOperation({ summary: 'Execute a pipeline' })
   @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async executePipeline(@Body() body: any, @User() user: RequestUser) {
-    return this.platformApiService.proxy('POST', '/pipeline/execute', user, body);
+    // Inject customer_id (actually customer_name) into body for Platform-API
+    // Note: Platform-API was created before customer_id existed, so it expects customer_name in the customer_id field
+    const enrichedBody = {
+      ...body,
+      customer_id: user.customer_name,
+    };
+    return this.platformApiService.proxy('POST', '/pipeline/execute', user, enrichedBody);
   }
 
   @Post('pipeline/pause')
   @ApiOperation({ summary: 'Pause a pipeline' })
   @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async pausePipeline(@Body() body: any, @User() user: RequestUser) {
-    return this.platformApiService.proxy('POST', '/pipeline/pause', user, body);
+    // Inject customer_id (actually customer_name) into body for Platform-API
+    // Note: Platform-API was created before customer_id existed, so it expects customer_name in the customer_id field
+    const enrichedBody = {
+      ...body,
+      customer_id: user.customer_name,
+    };
+    return this.platformApiService.proxy('POST', '/pipeline/pause', user, enrichedBody);
   }
 
   @Post('pipeline/unpause')
   @ApiOperation({ summary: 'Unpause a pipeline' })
   @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async unpausePipeline(@Body() body: any, @User() user: RequestUser) {
-    return this.platformApiService.proxy('POST', '/pipeline/unpause', user, body);
+    // Inject customer_id (actually customer_name) into body for Platform-API
+    // Note: Platform-API was created before customer_id existed, so it expects customer_name in the customer_id field
+    const enrichedBody = {
+      ...body,
+      customer_id: user.customer_name,
+    };
+    return this.platformApiService.proxy('POST', '/pipeline/unpause', user, enrichedBody);
   }
 
   @Put('pipeline/:pipelineId/memory')

src/modules/users/users.controller.ts

@@ -266,7 +266,6 @@ export class UsersController {
   }
 
   @Patch(':id')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
   @ApiOkResponse({ type: UpdateUserRes })
   async updateUser(
     @User() user: RequestUser,
@@ -274,6 +273,18 @@ export class UsersController {
     @Param('id') id: string,
     @Language() language: LanguageEnum,
   ) {
+
+    const isSameUser = user.user_id === id;
+    const isSuperAdmin = user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)
+    if (!isSameUser && !isSuperAdmin) {
+      throw new ErrorBuilder(ErrorCodes.AUTH.FORBIDDEN);
+    }
+
+    if (isSameUser && !isSuperAdmin && body.roleNames) {
+      // Prevent users from updating their own roles
+      delete body.roleNames;
+    }
+
     this.logger.info('updateUser', { user });
     this.userService.setLanguage(language);
     return await this.userService.updateUser(body, id, user.customer_id);

src/modules/users/users.service.ts

@@ -149,7 +149,7 @@ export class UsersService implements OnModuleInit {
 
   async updateUser(req: UpdateUserReq, id: string, customerId: string) {
     const { roleNames, ...updateUserDTO } = req;
-    if (roleNames) {
+    if (roleNames && roleNames.length > 0) {
       await this.setRoles({ roleNames, userId: id }, customerId);
     }