docs(auth): correct updateMe role guidance

[wixysam]

What

The updateMe JSDoc tells readers they can set the built-in role field, in three separate places: the prose, the example's title, and the example body. Anyone who copies the snippet hits a 403.

Why

Reported by a user on 12 Aug 2026, who tested against the live API before writing in:

The updateMe documentation states users can update the built-in role field, but a real request returns 403 "You do not have permission to update user roles." Please correct the documentation and explicitly list protected built-in fields.

They are right. updateMe sends PUT /apps/{appId}/entities/User/me, which lands in UserCRUD.update in apper:

new_user_role = payload.pop("role", None)
if new_user_role is not None and new_user_role != entity.app_role:
    await update_user_role(app, entity, new_user_role)

role never travels with the rest of the fields. It is pulled out and sent through update_user_role, which requires collaborator_role="editor" or platform blanket access. An ordinary signed-in app user has neither. Because the check runs before the payload merge, the 403 also means none of the other fields land.

Changes

• Drop the claim that role is updatable, and drop role from the example.
• Say that updating role requires editor access, rather than moving role into the read-only list. Owners and editor collaborators genuinely can change it, so calling it read-only would be a second inaccuracy in the other direction.
• Add collaborator_role to the protected-field list. The same function discards it with payload.pop("collaborator_role", None) and no error, which is worse for the caller than a 403.

Note on history

This wording came from fix-updateme-role-docs-17-may-hadas, including a commit titled "Clarify updateMe: role is updatable, fix read-only field list." The most likely explanation is that it was tested as an app owner, where setting role does succeed. That path still works and is now documented as such.

Docs

developers/references/sdk/docs/interfaces/auth is generated from this JSDoc, so the fix has to land here or it gets wiped on the next regeneration. Regenerated output is in a paired mintlify-docs PR. Merge this one first.

🤖 Generated with Claude Code

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.44-pr.262.1f0f5a7

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.44-pr.262.1f0f5a7"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.44-pr.262.1f0f5a7"
  }
}

• 📦 Preview Package: @base44-preview/sdk@0.8.44-pr.262.1f0f5a7
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}