Commit c46b91a
docs(auth): correct updateMe role guidance
The updateMe JSDoc told readers they could set the built-in `role` field
and shipped an example that did exactly that. A user reported a 403 "You
do not have permission to update user roles" from the live API on 12 Aug
2026.
In apper, `UserCRUD.update` pops `role` out of the payload and routes it
through `update_user_role`, which requires editor access on the app or
platform admin access. An ordinary app user has neither, so the request
fails and no other field in the payload is applied.
Changes:
- Drop the claim that `role` is updatable, and drop `role` from the
example so the snippet works when copied.
- State that updating `role` needs editor access, rather than listing it
as read-only. Owners and editor collaborators genuinely can change it.
- Add `collaborator_role` to the protected-field list. The same function
discards it silently, with no error at all.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>1 parent 4db0eb6 commit c46b91a
1 file changed
Lines changed: 10 additions & 7 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
144 | 144 | | |
145 | 145 | | |
146 | 146 | | |
147 | | - | |
148 | | - | |
149 | | - | |
| 147 | + | |
| 148 | + | |
| 149 | + | |
| 150 | + | |
| 151 | + | |
| 152 | + | |
150 | 153 | | |
151 | | - | |
152 | | - | |
| 154 | + | |
| 155 | + | |
| 156 | + | |
153 | 157 | | |
154 | 158 | | |
155 | 159 | | |
156 | 160 | | |
157 | 161 | | |
158 | 162 | | |
159 | 163 | | |
160 | | - | |
| 164 | + | |
161 | 165 | | |
162 | | - | |
163 | 166 | | |
164 | 167 | | |
165 | 168 | | |
| |||
0 commit comments