Method Update

server-source-code/internal/handler/users.go:270–407

Update updates a user.

(w http.ResponseWriter, r *http.Request)

// Update updates a user.
func (h *UsersHandler) Update(w http.ResponseWriter, r *http.Request) {
	userID := chi.URLParam(r, "userId")
	if userID == "" {
		Error(w, http.StatusBadRequest, "User ID required")
		return
	}

	existing, err := h.users.GetByID(r.Context(), userID)
	if err != nil || existing == nil {
		Error(w, http.StatusNotFound, "User not found")
		return
	}

	var req struct {
		Username  *string `json:"username"`
		Email     *string `json:"email"`
		FirstName *string `json:"first_name"`
		LastName  *string `json:"last_name"`
		Role      *string `json:"role"`
		IsActive  *bool   `json:"is_active"`
	}
	if err := decodeJSON(r, &req); err != nil {
		Error(w, http.StatusBadRequest, "Invalid request body")
		return
	}

	// Prevent modifying users with a higher-privilege role than the caller.
	callerRole, _ := r.Context().Value(middleware.UserRoleKey).(string)
	if roleRank(existing.Role) > roleRank(callerRole) {
		Error(w, http.StatusForbidden, "Cannot modify a user with a higher-privilege role")
		return
	}
	if existing.Role == "superadmin" && callerRole != "superadmin" {
		perm, permErr := h.permissions.GetByRole(r.Context(), callerRole)
		if permErr != nil || perm == nil || !perm.CanManageSuperusers {
			Error(w, http.StatusForbidden, "You do not have permission to modify superadmin users")
			return
		}
	}

	// Build update
	u := *existing
	if req.Username != nil {
		u.Username = *req.Username
	}
	if req.Email != nil {
		u.Email = *req.Email
	}
	if req.FirstName != nil {
		u.FirstName = req.FirstName
	}
	if req.LastName != nil {
		u.LastName = req.LastName
	}
	if req.Role != nil {
		// Enforce role escalation protection.
		if !h.canAssignRole(r, callerRole, *req.Role) {
			Error(w, http.StatusForbidden, "You do not have permission to assign the role: "+*req.Role)