Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Admin edits to a user's info (name, dob, email, etc.) send no notification to the affected user

Aperta
  • Qualcosa non va?
#929 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
typescript
Ambito
authentication, backend-api-design

Direzione di ricerca

Start by reading UsersController.updateUser and ProfilesController.updateProfileById in application/backend/src/controllers/, then trace how the project sends notification emails and tests these update endpoints. The issue suggests notifying on admin-initiated profile changes, with both old and new addresses notified when email changes; confirm the notification scope with maintainers. Done when the agreed notifications are sent and covered by tests.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

backend bug Notifications

UsersController.updateUser and ProfilesController.updateProfileById in application/backend/src/controllers/ let an admin (OrganisationAdmin or StudyAdmin) update any of a user's or participant's fields — email, firstName, lastName, role, dob, mobile, address, next of kin, and so on. Neither endpoint sends any notification to the affected user (old or new email).

The user has no way to know their info was changed. If it's the email that got changed, they only find out when their next login attempt with the old address returns "invalid credentials".

Users cannot self-change their own email today. ProfilesController.updateCurrentProfile only writes firstName and lastName to the User table even when the body includes an email, so email changes are admin-only. That makes silent admin changes more concerning than they would be in a system where users can also update their own email.

Related to #928 which flags the same silent behaviour on password reset completion.

Suggested fix: on any admin-initiated change to a user's profile, send a notification email. At minimum on email changes, notify both the old and new addresses ("Your CTRL email was changed. If this wasn't you, contact support."). Other field changes can either share a single generic "your profile was updated by an admin" notification or notify per-field, depending on how noisy the team wants it.

Lingua principale
TypeScript
Stelle
4
Fork
0
Merge medio
14h 50m
PR unite (30g)
5

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Garvan-Data-Science-Platform/ctrl

Tutte le issue di Garvan-Data-Science-Platform/ctrl

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.