FEAT: protected update route with admin seqid or if user request to equal a jwt user id claim

docsfera.json

@@ -1321,9 +1321,6 @@
             "Users"
           ],
           "security": [
-            {
-              "access-token": []
-            },
             {
               "access-token": []
             }

src/modules/platform-api/platform-api.controller.ts

@@ -630,39 +630,21 @@ export class PlatformApiController {
   @ApiOperation({ summary: 'Execute a pipeline' })
   @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async executePipeline(@Body() body: any, @User() user: RequestUser) {
-    // Inject customer_id (actually customer_name) into body for Platform-API
-    // Note: Platform-API was created before customer_id existed, so it expects customer_name in the customer_id field
-    const enrichedBody = {
-      ...body,
-      customer_id: user.customer_name,
-    };
-    return this.platformApiService.proxy('POST', '/pipeline/execute', user, enrichedBody);
+    return this.platformApiService.proxy('POST', '/pipeline/execute', user, body);
   }
 
   @Post('pipeline/pause')
   @ApiOperation({ summary: 'Pause a pipeline' })
   @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async pausePipeline(@Body() body: any, @User() user: RequestUser) {
-    // Inject customer_id (actually customer_name) into body for Platform-API
-    // Note: Platform-API was created before customer_id existed, so it expects customer_name in the customer_id field
-    const enrichedBody = {
-      ...body,
-      customer_id: user.customer_name,
-    };
-    return this.platformApiService.proxy('POST', '/pipeline/pause', user, enrichedBody);
+    return this.platformApiService.proxy('POST', '/pipeline/pause', user, body);
   }
 
   @Post('pipeline/unpause')
   @ApiOperation({ summary: 'Unpause a pipeline' })
   @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async unpausePipeline(@Body() body: any, @User() user: RequestUser) {
-    // Inject customer_id (actually customer_name) into body for Platform-API
-    // Note: Platform-API was created before customer_id existed, so it expects customer_name in the customer_id field
-    const enrichedBody = {
-      ...body,
-      customer_id: user.customer_name,
-    };
-    return this.platformApiService.proxy('POST', '/pipeline/unpause', user, enrichedBody);
+    return this.platformApiService.proxy('POST', '/pipeline/unpause', user, body);
   }
 
   @Put('pipeline/:pipelineId/memory')

src/modules/users/users.controller.ts

@@ -266,7 +266,6 @@ export class UsersController {
   }
 
   @Patch(':id')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
   @ApiOkResponse({ type: UpdateUserRes })
   async updateUser(
     @User() user: RequestUser,
@@ -274,6 +273,10 @@ export class UsersController {
     @Param('id') id: string,
     @Language() language: LanguageEnum,
   ) {
+
+    if (user.user_id !== id || !user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)) {
+      throw new ErrorBuilder(ErrorCodes.AUTH.FORBIDDEN);
+    }
     this.logger.info('updateUser', { user });
     this.userService.setLanguage(language);
     return await this.userService.updateUser(body, id, user.customer_id);

src/modules/users/users.service.ts

@@ -149,7 +149,7 @@ export class UsersService implements OnModuleInit {
 
   async updateUser(req: UpdateUserReq, id: string, customerId: string) {
     const { roleNames, ...updateUserDTO } = req;
-    if (roleNames) {
+    if (roleNames && roleNames.length > 0) {
       await this.setRoles({ roleNames, userId: id }, customerId);
     }