Repository navigation
fix(identity): drop the unused Email field from UpdateUserCommand - #1454
Merged
Merged
Conversation
UpdateUserCommand.Email was validated as an e-mail address but the handler never passed it on, so PUT /profile answered 200 and left the address unchanged. Changing an e-mail needs a confirmation flow, so the field is removed from the command and its validator instead of being wired through. The dashboard profile save no longer sends it. Closes #1431
iammukeshm
added a commit
that referenced
this pull request
Nov 3, 2026
…1459) - admin: the language switcher's profile save sends If-Match with the ETag of the read it merges from, retries once on 412, and no longer sends the email field the API dropped in #1454 - admin: apiFetch gains the onResponse hook the dashboard already has - dashboard: the container renders defaultLanguage from FSH_DEFAULT_LANGUAGE like the admin does; compose passes it to both apps, Terraform sets it on the dashboard site, and the container CI job asserts the en-US default - dashboard: drop the English-text fallback for the deactivated-tenant 403, now that the API always sends the Multitenancy.TenantDeactivated code - both: add the missing t dependency to the upload hook and the file preview effect, so error text follows a language switch - admin: remove the unused theme-toggle component
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
UpdateUserCommand.Emailwas validated as an e-mail address, butUpdateUserCommandHandlernever passed it toIUserService.UpdateAsync. A client that sent a new address toPUT /api/v1/identity/profilegot a 200 and nothing changed. Changing an e-mail properly needs a confirmation flow (GenerateChangeEmailTokenAsync/ChangeEmailAsync), so as proposed in the issue the field is removed from the command and its validator instead of being wired straight through. A real "change e-mail with confirmation" endpoint can be tracked separately.This is a small contract change. The API uses the default System.Text.Json setting for unknown members (
JsonUnmappedMemberHandling.Skip; neitherConfigureHttpJsonOptionsinProgram.csnor the endpoint changes it), so a client that still sendsemailis not rejected: the property is skipped, the rest of the update applies and the address stays as it was, which is the same outcome as before. The only behavioural difference is that a malformedemailused to fail validation with a 400 and is now ignored. The field also disappears from the OpenAPI schema.Clients: the dashboard's
updateMyProfilewas sendingemail: profile.emailon every save. It no longer does, and its doc comment no longer claims e-mail has its own endpoint. The Playwright test that assertedemailin the PUT body now asserts it is absent. The admin app only callsPUT /profile/image, so it needed no change.Testing:
UpdateProfile_Should_LeaveEmailUnchanged_When_BodyCarriesAnEmail: a PUT withfirstNameplus a differentemailreturns 200, the first name is saved, and the e-mail is unchanged.npm run lint0 errors (12 existing warnings),tsc -b --noEmitclean,tests/settings/profile.spec.ts12/12 passing (also 36/36 with--repeat-each=3).Docs: fullstackhero/docs#274
Closes #1431