Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Admin edits to a user's info (name, dob, email, etc.) send no notification to the affected user

Ouverte
  • Quelque chose ne va pas ?
#929 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
55/100
Type d'issue
Fonctionnalité
Clarté
Plutôt claire
Activité
Calme
Stack technique
typescript
Domaine
authentication, backend-api-design

Piste de recherche

Start by reading UsersController.updateUser and ProfilesController.updateProfileById in application/backend/src/controllers/, then trace how the project sends notification emails and tests these update endpoints. The issue suggests notifying on admin-initiated profile changes, with both old and new addresses notified when email changes; confirm the notification scope with maintainers. Done when the agreed notifications are sent and covered by tests.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

backend bug Notifications

UsersController.updateUser and ProfilesController.updateProfileById in application/backend/src/controllers/ let an admin (OrganisationAdmin or StudyAdmin) update any of a user's or participant's fields — email, firstName, lastName, role, dob, mobile, address, next of kin, and so on. Neither endpoint sends any notification to the affected user (old or new email).

The user has no way to know their info was changed. If it's the email that got changed, they only find out when their next login attempt with the old address returns "invalid credentials".

Users cannot self-change their own email today. ProfilesController.updateCurrentProfile only writes firstName and lastName to the User table even when the body includes an email, so email changes are admin-only. That makes silent admin changes more concerning than they would be in a system where users can also update their own email.

Related to #928 which flags the same silent behaviour on password reset completion.

Suggested fix: on any admin-initiated change to a user's profile, send a notification email. At minimum on email changes, notify both the old and new addresses ("Your CTRL email was changed. If this wasn't you, contact support."). Other field changes can either share a single generic "your profile was updated by an admin" notification or notify per-field, depending on how noisy the team wants it.

Langage dominant
TypeScript
Étoiles
4
Forks
0
Merge moyen
14 h 50 min
PR mergées (30 j)
5

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de Garvan-Data-Science-Platform/ctrl

Toutes les issues de Garvan-Data-Science-Platform/ctrl

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.