-
Notifications
You must be signed in to change notification settings - Fork 528
fix: cannot use direct crud user update method #998
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -51,6 +51,29 @@ async def get_by_email(self, db: AsyncSession, *, email: str) -> Optional[User]: | |
raise NotFoundException(f"User with email {email} not found") | ||
return db_obj | ||
|
||
async def update_user_no_auth(self, db: AsyncSession, *, id: UUID, obj_in: UserUpdate) -> User: | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Rule violated: Check for Cursor Rules Drift Documenting this unauthenticated update path is required: the new Prompt for AI agents
|
||
"""Update a user without authentication. | ||
|
||
Important: this method is not part of the regular CRUD operations. | ||
This is a custom method for updating a user, that does not | ||
require a current user. Use responsibly. | ||
|
||
Args: | ||
db (AsyncSession): The database session. | ||
id (UUID): The UUID of the user to update. | ||
obj_in (UserUpdate): The updated user object. | ||
""" | ||
user = await self.get(db, id=id) | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Calling self.get here omits the required current_user argument, so update_user_no_auth will raise a TypeError and never reach the commit/refresh. Prompt for AI agents
|
||
if not user: | ||
raise NotFoundException(f"User with ID {id} not found") | ||
|
||
for field, value in obj_in.model_dump(exclude_unset=True).items(): | ||
setattr(user, field, value) | ||
|
||
await db.commit() | ||
await db.refresh(user) | ||
return user | ||
|
||
async def get(self, db: AsyncSession, id: UUID, current_user: User) -> Optional[User]: | ||
"""Get a single object by ID. | ||
|
||
|
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Passing the ORM user into update_user_no_auth will crash this auth path because the method expects a UserUpdate schema and calls model_dump() on it; authentication will fail here.
Prompt for AI agents