Greptile Summary

This PR fixes a permission error for regular users changing their UI language by introducing a new UpdateOwnProfile service method that bypasses Ent privacy rules using a system bypass, rather than routing through the admin-gated UpdateUser path.

• UpdateOwnProfile correctly captures the authenticated user's ID from context before calling RunWithSystemBypass, so the privilege escalation cannot be exploited to update a different user's profile.
• The field set available through this path is restricted to firstName, lastName, preferLanguage, avatar, and password — admin-only fields like email, isOwner, scopes, and role IDs are deliberately excluded.
• Both UpdateMe and UpdateMyPassword resolvers are switched to the new method; old-password verification for UpdateMyPassword correctly remains at the resolver layer before calling into the service.

Confidence Score: 5/5

Safe to merge — the self-service update path is correctly scoped to the authenticated user and restricted to non-privileged profile fields.

The user ID is extracted from the authenticated context before RunWithSystemBypass replaces the principal, so there is no path for a user to update another user's record. The field allowlist in UpdateOwnProfile excludes all admin-only fields (email, isOwner, scopes, roles). Password changes still require the old password to be verified at the resolver layer before reaching the service. The pattern mirrors how WithSystemBypass is already used elsewhere in the codebase.

No files require special attention.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Client
    participant UpdateMe Resolver
    participant UpdateOwnProfile
    participant RunWithSystemBypass
    participant Ent DB

    Client->>UpdateMe Resolver: updateMe(input)
    UpdateMe Resolver->>UpdateMe Resolver: contexts.GetUser(ctx) → nil check
    UpdateMe Resolver->>UpdateOwnProfile: UpdateOwnProfile(ctx, input)
    UpdateOwnProfile->>UpdateOwnProfile: contexts.GetUser(ctx) → capture id
    UpdateOwnProfile->>RunWithSystemBypass: RunWithSystemBypass(ctx, "update-own-profile", fn)
    RunWithSystemBypass->>RunWithSystemBypass: NewSystemContext(ctx) → system principal
    RunWithSystemBypass->>Ent DB: UpdateOneID(id).Set*(fields).Save(bypassCtx)
    Ent DB-->>RunWithSystemBypass: updated user
    RunWithSystemBypass-->>UpdateOwnProfile: user
    UpdateOwnProfile->>UpdateOwnProfile: invalidateUserCache(ctx, id)
    UpdateOwnProfile-->>UpdateMe Resolver: user
    UpdateMe Resolver-->>Client: User

_{Reviews (2): Last reviewed commit: "fix: allow users to update language pref..." | Re-trigger Greptile}