{"record":{"id":"beeb8f068fb4fa4a","repo":"SigNoz/signoz","slug":"codeinvalidinput-beeb8f","errorCode":"CodeInvalidInput","errorMessage":"users cannot call this api on self","messagePattern":"users cannot call this api on self","errorType":"http","errorClass":"errors.Error","httpStatus":400,"severity":"error","filePath":"pkg/modules/user/impluser/handler.go","lineNumber":188,"sourceCode":"\t}\n\n\trender.Success(w, http.StatusOK, users)\n}\n\nfunc (handler *handler) UpdateUser(w http.ResponseWriter, r *http.Request) {\n\tctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)\n\tdefer cancel()\n\n\tuserID := mux.Vars(r)[\"id\"]\n\n\tclaims, err := authtypes.ClaimsFromContext(ctx)\n\tif err != nil {\n\t\trender.Error(w, err)\n\t\treturn\n\t}\n\n\tif userID == claims.UserID {\n\t\trender.Error(w, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, \"users cannot call this api on self\"))\n\t\treturn\n\t}\n\n\tupdatableUser := new(types.UpdatableUser)\n\tif err := json.NewDecoder(r.Body).Decode(&updatableUser); err != nil {\n\t\trender.Error(w, err)\n\t\treturn\n\t}\n\n\t_, err = handler.setter.UpdateUser(ctx, valuer.MustNewUUID(claims.OrgID), valuer.MustNewUUID(userID), updatableUser)\n\tif err != nil {\n\t\trender.Error(w, err)\n\t\treturn\n\t}\n\n\trender.Success(w, http.StatusNoContent, nil)\n}\n","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/modules/user/impluser/handler.go#L170-L206","documentation":"UpdateUser rejects requests where the target userID equals the authenticated caller's userID — self-updates must go through the 'update my user' endpoint instead (different validation/fields apply).","triggerScenarios":"PUT/PATCH /api/v1/users/{userID} where {userID} == claims.UserID of the JWT used; also triggered when UpdateMyUser forwards to UpdateUser with the same ID.","commonSituations":"Frontend reusing the admin user-edit form for the logged-in profile page; passing the wrong ID (defaulting to current user) in automation scripts.","solutions":["Use the dedicated 'update my user' endpoint for self-updates (UpdateMyUser route)","Pass the target user's actual ID (not the caller's) when admins edit other users","Check claims.UserID vs path param before sending the request"],"exampleFix":"// before\nif claims.UserID == userID { updateUser(userID, patch) } // 400\n// after\nif claims.UserID == userID { updateMyUser(patch) } else { updateUser(userID, patch) }","handlingStrategy":"validation","validationCode":"if targetUserID == claims.UserID {\n    err := updateMyUser(patch) // self endpoint\n} else {\n    err := updateUser(targetUserID, patch)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Route self-edits to the profile endpoint in UI code","Assert userID != claims.UserID in API wrapper helpers"],"tags":["self-operation-guard","user-module","validation"],"backgroundTag":"self-operation-forbidden","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}