From 6b561feb9016badea99ae7305091c0ff55e1d114 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20=C5=A0ediv=C3=BD?= Date: Mon, 6 Apr 2026 20:41:07 +0200 Subject: [PATCH] fix(api): update profile handling to ensure only the name field is modified. --- server/internal/api/session.go | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/server/internal/api/session.go b/server/internal/api/session.go index 50a279a6..beb9f64b 100644 --- a/server/internal/api/session.go +++ b/server/internal/api/session.go @@ -84,15 +84,25 @@ func (api *ApiManagerCtx) Whoami(w http.ResponseWriter, r *http.Request) error { }) } +// TODO: Remove when legacy mode is removed as all sessions must be synced with their providers. func (api *ApiManagerCtx) UpdateProfile(w http.ResponseWriter, r *http.Request) error { session, _ := auth.GetSession(r) - data := session.Profile() - if err := utils.HttpJsonRequest(w, r, &data); err != nil { - return err + profile := session.Profile() + if !profile.IsAdmin { + // Name is the only updatable field in the profile for non-admins + var payload types.MemberProfile + if err := utils.HttpJsonRequest(w, r, &payload); err != nil { + return err + } + profile.Name = payload.Name + } else { + if err := utils.HttpJsonRequest(w, r, &profile); err != nil { + return err + } } - err := api.sessions.Update(session.ID(), data) + err := api.sessions.Update(session.ID(), profile) if err != nil { if errors.Is(err, types.ErrSessionNotFound) { return utils.HttpBadRequest("session does not exist")