Method updatePrincipal

rest/admin_api.go:1801–1888

Handles PUT and POST for a user or a role.

(name string, isUser bool)

// Handles PUT and POST for a user or a role.
func (h *handler) updatePrincipal(name string, isUser bool) error {
	h.assertAdminOnly()
	// Unmarshal the request body into a PrincipalConfig struct:
	body, _ := h.readBody()

	var newInfo auth.PrincipalConfig
	var err error
	if err = base.JSONUnmarshal(body, &newInfo); err != nil {
		return err
	}

	if h.rq.Method == "POST" {
		// On POST, take the name from the "name" property in the request body:
		if newInfo.Name == nil {
			return base.HTTPErrorf(http.StatusBadRequest, "Missing name property")
		}
	} else {
		// ON PUT, verify the name matches, if given:
		if newInfo.Name == nil {
			newInfo.Name = &name
		} else if *newInfo.Name != name {
			return base.HTTPErrorf(http.StatusBadRequest, "Name mismatch (can't change name)")
		}
	}

	// Check read only fields in request against existing read only fields on the user, if the request attempts to
	// change them, return error.
	internalName := internalUserName(*newInfo.Name)
	var unchanged bool
	user, _ := h.db.Authenticator(h.ctx()).GetUser(internalName)
	if user != nil {
		newInfo, unchanged = checkUserAPIReadOnlyFields(newInfo, user)
		if !unchanged {
			return base.HTTPErrorf(http.StatusBadRequest, "Can't change read-only properties")
		}
	}

	if err = auth.ValidatePrincipalName(internalName); err != nil {
		return base.NewHTTPError(http.StatusBadRequest, err.Error())
	}

	newInfo.Name = &internalName
	replaced, princ, err := h.db.UpdatePrincipal(h.ctx(), &newInfo, isUser, h.rq.Method != "POST")
	if err != nil {
		return err
	} else if replaced {
		// update event
		if isUser {
			user := princ.(auth.User)
			if user != nil {
				base.Audit(h.ctx(), base.AuditIDUserUpdate, base.AuditFields{
					"username": internalName,
					"roles":    user.ExplicitRoles().AllKeys(),
					"channels": getAuditEventAccess(h.db, princ),
					"db":       h.db.Name,
				})
			}
		} else {