FIX: user patch route

Beta

docsfera.json

@@ -1321,9 +1321,6 @@
             "Users"
           ],
           "security": [
-            {
-              "access-token": []
-            },
             {
               "access-token": []
             }

src/modules/users/users.controller.ts

@@ -266,7 +266,6 @@ export class UsersController {
   }
 
   @Patch(':id')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
   @ApiOkResponse({ type: UpdateUserRes })
   async updateUser(
     @User() user: RequestUser,
@@ -274,6 +273,18 @@ export class UsersController {
     @Param('id') id: string,
     @Language() language: LanguageEnum,
   ) {
+
+    const isSameUser = user.user_id === id;
+    const isSuperAdmin = user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)
+    if (!isSameUser && !isSuperAdmin) {
+      throw new ErrorBuilder(ErrorCodes.AUTH.FORBIDDEN);
+    }
+
+    if (isSameUser && !isSuperAdmin && body.roleNames) {
+      // Prevent users from updating their own roles
+      delete body.roleNames;
+    }
+
     this.logger.info('updateUser', { user });
     this.userService.setLanguage(language);
     return await this.userService.updateUser(body, id, user.customer_id);

src/modules/users/users.service.ts

@@ -149,7 +149,7 @@ export class UsersService implements OnModuleInit {
 
   async updateUser(req: UpdateUserReq, id: string, customerId: string) {
     const { roleNames, ...updateUserDTO } = req;
-    if (roleNames) {
+    if (roleNames && roleNames.length > 0) {
       await this.setRoles({ roleNames, userId: id }, customerId);
     }