From c46b91ad5599645ee2283db90cbb5c4bfa157820 Mon Sep 17 00:00:00 2001 From: "Sam (automated drift fix)" Date: Wed, 26 Aug 2026 15:56:32 +0300 Subject: [PATCH 1/2] docs(auth): correct updateMe role guidance The updateMe JSDoc told readers they could set the built-in `role` field and shipped an example that did exactly that. A user reported a 403 "You do not have permission to update user roles" from the live API on 12 Aug 2026. In apper, `UserCRUD.update` pops `role` out of the payload and routes it through `update_user_role`, which requires editor access on the app or platform admin access. An ordinary app user has neither, so the request fails and no other field in the payload is applied. Changes: - Drop the claim that `role` is updatable, and drop `role` from the example so the snippet works when copied. - State that updating `role` needs editor access, rather than listing it as read-only. Owners and editor collaborators genuinely can change it. - Add `collaborator_role` to the protected-field list. The same function discards it silently, with no error at all. Co-Authored-By: Claude Opus 5 (1M context) --- src/modules/auth.types.ts | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/src/modules/auth.types.ts b/src/modules/auth.types.ts index d32b87e..32acaca 100644 --- a/src/modules/auth.types.ts +++ b/src/modules/auth.types.ts @@ -144,12 +144,16 @@ export interface AuthModule { /** * Updates the current authenticated user's information. * - * You can update `role` and any [custom fields](/developers/backend/resources/entities/user-schema#custom-fields) defined in your - * User entity schema. - * The `role` value must be either `'user'` or `'admin'`. + * You can update any [custom fields](/developers/backend/resources/entities/user-schema#custom-fields) + * defined in your User entity schema. + * + * Updating `role` requires editor access on the app. An app user without it + * gets a 403 response, and none of the other fields in the request are applied. + * * - * The following fields are read-only and can't be changed with this method: - * `id`, `email`, `full_name`, `created_date`, `updated_date`, and `created_by`. + * These fields can't be changed with this method: + * `id`, `email`, `full_name`, `created_date`, `updated_date`, `created_by`, + * and `collaborator_role`. * * * @param data - Object containing the fields to update. @@ -157,9 +161,8 @@ export interface AuthModule { * * @example * ```typescript - * // Update role and custom fields defined in your User entity + * // Update custom fields defined in your User entity * await base44.auth.updateMe({ - * role: 'admin', * bio: 'Software developer', * preferences: { theme: 'dark' } * }); From 78cc883559413dc521a0cd4258240dc5ef807fca Mon Sep 17 00:00:00 2001 From: "Sam (automated drift fix)" Date: Wed, 26 Aug 2026 16:00:26 +0300 Subject: [PATCH 2/2] docs(auth): drop the 403 detail from updateMe role note Leaves the requirement itself. The status code is response behavior, not something a reader needs in order to use the method correctly. Co-Authored-By: Claude Opus 5 (1M context) --- src/modules/auth.types.ts | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/modules/auth.types.ts b/src/modules/auth.types.ts index 32acaca..7c080ef 100644 --- a/src/modules/auth.types.ts +++ b/src/modules/auth.types.ts @@ -147,8 +147,7 @@ export interface AuthModule { * You can update any [custom fields](/developers/backend/resources/entities/user-schema#custom-fields) * defined in your User entity schema. * - * Updating `role` requires editor access on the app. An app user without it - * gets a 403 response, and none of the other fields in the request are applied. + * Updating `role` requires editor access on the app. * * * These fields can't be changed with this method: