Description

Users created without admin privileges cannot be updated through the Edit User UI form. The issue is not limited to admin privilege — no user details (admin privilege, password, or full name) are updated from the UI.

Additionally, updating admin privileges through the API requires mandatory fields, which results in unintended overwriting of existing user details.

Steps to Reproduce

UI Issue

1. Create a user without admin privileges.

2. Navigate to the Edit User page.

3. Modify any of the following:

   • Administrator checkbox
   • Password
   • Full Name

4. Click Update User.

API Issue

1. Call the admin user update API without providing all required fields.
2. The API returns a "required field missing" error.
3. Provide all mandatory fields and update the user.

Example API Call:

curl -X 'PUT' \
  'http://localhost:4444/auth/email/admin/users/user_admin%40example.com' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "user_admin@example.com",
  "password": "abcd1235",
  "is_admin": true
}'

Actual Behavior

UI

• Clicking Update User does not update any user details, including admin privilege, password, or full name.

API

• email, password, and is_admin are treated as mandatory fields.
• If full_name is not included in the request payload, the existing full name is overwritten and becomes null / NA.

Expected Behavior

UI

• Users should be able to update admin privilege, password, or full name independently.

API

• The update endpoint should support partial updates.
• Existing user attributes should remain unchanged if they are not provided in the payload.
• Password and email should not be mandatory when updating admin privileges only.

Impact

• Prevents updating user details via UI.
• Causes unintended data loss when updating users through the API.
• Introduces usability and data integrity issues.

Environment

• Database: PostgreSQL
• API Endpoint: /auth/email/admin/users/{email}
• Commit: 4bbb15e

Screenshot