Method UpdateProfile

server-source-code/internal/handler/auth.go:881–987

UpdateProfile handles PUT /auth/profile (update own profile: username, email, first_name, last_name).

(w http.ResponseWriter, r *http.Request)

// UpdateProfile handles PUT /auth/profile (update own profile: username, email, first_name, last_name).
func (h *AuthHandler) UpdateProfile(w http.ResponseWriter, r *http.Request) {
	userID, _ := r.Context().Value(middleware.UserIDKey).(string)
	if userID == "" {
		Error(w, http.StatusUnauthorized, "Unauthorized")
		return
	}
	user, err := h.users.GetByID(r.Context(), userID)
	if err != nil || user == nil {
		Error(w, http.StatusNotFound, "User not found")
		return
	}
	// OIDC users cannot modify profile fields managed by IdP
	if user.OidcSub != nil || user.OidcProvider != nil {
		Error(w, http.StatusForbidden, "Profile information is managed by your OIDC provider and cannot be modified here")
		return
	}
	var req map[string]interface{}
	if err := decodeJSON(r, &req); err != nil {
		Error(w, http.StatusBadRequest, "Invalid request body")
		return
	}
	extractStr := func(keys ...string) *string {
		for _, k := range keys {
			if v, ok := req[k]; ok && v != nil {
				if s, ok := v.(string); ok {
					t := strings.TrimSpace(s)
					return &t
				}
			}
		}
		return nil
	}
	// For first_name/last_name: key present with empty string means clear
	extractName := func(keys ...string) *string {
		for _, k := range keys {
			if _, has := req[k]; has {
				if v, ok := req[k].(string); ok {
					t := strings.TrimSpace(v)
					if t == "" {
						return nil // explicit clear
					}
					return &t
				}
				return nil // null
			}
		}
		return nil
	}
	username := extractStr("username")
	email := extractStr("email")
	firstName := extractName("first_name", "firstName")
	lastName := extractName("last_name", "lastName")
	u := *user
	if username != nil {
		if len(*username) < 3 {
			Error(w, http.StatusBadRequest, "Username must be at least 3 characters")
			return
		}