Function apiV1PatchUser

internal/web/api_v1_users.go:56–117

PATCH /admin/api/v1/users/{userid}

(w http.ResponseWriter, r *http.Request)

// PATCH /admin/api/v1/users/{userid}
func apiV1PatchUser(w http.ResponseWriter, r *http.Request) {
	userId := resolveUserId(w, r.PathValue("userid"))
	if userId == 0 {
		return
	}

	u := loadUserRecord(w, userId)
	if u == nil {
		return
	}

	// Capture the plaintext password from the request before decoding into the
	// UserRecord, because UserRecord.Password stores a bcrypt hash and we need
	// to call SetPassword to hash a new plaintext value.
	var raw struct {
		Password string `json:"Password"`
	}
	body, err := io.ReadAll(r.Body)
	if err != nil {
		writeAPIError(w, http.StatusBadRequest, "failed to read request body: "+err.Error())
		return
	}
	_ = json.Unmarshal(body, &raw)

	updated := *u
	if err := json.Unmarshal(body, &updated); err != nil {
		writeAPIError(w, http.StatusBadRequest, "malformed request body: "+err.Error())
		return
	}

	// Preserve the canonical ID; callers cannot change it via PATCH.
	updated.UserId = userId

	// If a plaintext password was supplied, hash it properly.
	if raw.Password != "" && !isBcryptHash(raw.Password) {
		if err := updated.SetPassword(raw.Password); err != nil {
			writeAPIError(w, http.StatusBadRequest, "invalid password: "+err.Error())
			return
		}
	}

	if updated.Character.Gold < 0 {
		updated.Character.Gold = 0
	}
	if updated.Character.Bank < 0 {
		updated.Character.Bank = 0
	}

	updated.Character.Validate()

	if err := users.SaveUser(updated); err != nil {
		writeAPIError(w, http.StatusInternalServerError, err.Error())
		return
	}

	users.UpdateOnlineUser(updated)

	writeJSON(w, http.StatusOK, APIResponse[*users.UserRecord]{