From f0ff08643acd83515402846fe31ca476218fa624 Mon Sep 17 00:00:00 2001 From: evan Date: Mon, 21 Sep 2026 22:55:18 -0700 Subject: [PATCH 1/3] allow editing of door codes --- api/main_endpoints/routes/User.js | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/api/main_endpoints/routes/User.js b/api/main_endpoints/routes/User.js index 603855ee6..78a9d6875 100644 --- a/api/main_endpoints/routes/User.js +++ b/api/main_endpoints/routes/User.js @@ -306,11 +306,14 @@ router.post('/edit', async (req, res) => { fieldsToIterateOver = Object.keys(existingUser); } + const allowedFieldSet = new Set(ALLOWED_FIELDS); fieldsToIterateOver.forEach(field => { // Only include the field if it was provided in the request body - if (userData[field] !== undefined) { - // Check if value actually changed for audit - if (userData[field] !== existingUser[field]) { + const previousValue = existingUser[field] ?? null; + + // Check if value actually changed for audit + if (allowedFieldSet.has(field) && userData[field] !== undefined) { + if (userData[field] !== previousValue) { fieldChanges[field] = { from: existingUser[field], to: userData[field] }; } dataToUpdate[field] = userData[field]; From 1474997718703a23b789b33ff5a0eb9c8966f9a2 Mon Sep 17 00:00:00 2001 From: evan Date: Mon, 21 Sep 2026 23:05:28 -0700 Subject: [PATCH 2/3] more --- api/main_endpoints/routes/User.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/api/main_endpoints/routes/User.js b/api/main_endpoints/routes/User.js index 78a9d6875..cdb9831c4 100644 --- a/api/main_endpoints/routes/User.js +++ b/api/main_endpoints/routes/User.js @@ -303,7 +303,7 @@ router.post('/edit', async (req, res) => { let fieldsToIterateOver = ALLOWED_FIELDS; if (isAtLeastAnOfficer) { - fieldsToIterateOver = Object.keys(existingUser); + fieldsToIterateOver = Object.keys(existingUser).concat(SENSITIVE_FIELDS); } const allowedFieldSet = new Set(ALLOWED_FIELDS); @@ -312,7 +312,7 @@ router.post('/edit', async (req, res) => { const previousValue = existingUser[field] ?? null; // Check if value actually changed for audit - if (allowedFieldSet.has(field) && userData[field] !== undefined) { + if (allowedFieldSet.has(field)) { if (userData[field] !== previousValue) { fieldChanges[field] = { from: existingUser[field], to: userData[field] }; } From 90e5b6aae5c8f2d7dd8bd0563c2df02561f208dc Mon Sep 17 00:00:00 2001 From: evan Date: Mon, 21 Sep 2026 23:08:54 -0700 Subject: [PATCH 3/3] 1 more time --- api/main_endpoints/routes/User.js | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/api/main_endpoints/routes/User.js b/api/main_endpoints/routes/User.js index cdb9831c4..62bdd55b5 100644 --- a/api/main_endpoints/routes/User.js +++ b/api/main_endpoints/routes/User.js @@ -306,14 +306,11 @@ router.post('/edit', async (req, res) => { fieldsToIterateOver = Object.keys(existingUser).concat(SENSITIVE_FIELDS); } - const allowedFieldSet = new Set(ALLOWED_FIELDS); fieldsToIterateOver.forEach(field => { // Only include the field if it was provided in the request body - const previousValue = existingUser[field] ?? null; - - // Check if value actually changed for audit - if (allowedFieldSet.has(field)) { - if (userData[field] !== previousValue) { + if (userData[field] !== undefined) { + // Check if value actually changed for audit + if (userData[field] !== existingUser[field]) { fieldChanges[field] = { from: existingUser[field], to: userData[field] }; } dataToUpdate[field] = userData[field];