feat: PATCH /v1/user/me — профиль и смена пароля. Refs EventHub/EventHubBack#48

2026-07-19 23:26:34 +03:00
parent 5b638de450
commit 0934e2c413
6 changed files with 652 additions and 25 deletions
@@ -1,7 +1,8 @@
 %%%-------------------------------------------------------------------
 %%% @doc Обработчик профиля текущего пользователя (клиентский API).
 %%%
-%%% GET – получить информацию о своём профиле.
+%%% GET   – получить информацию о своём профиле.
+%%% PATCH – частичное обновление профиля / смена пароля.
 %%% @end
 %%%-------------------------------------------------------------------
 -module(handler_user_me).
@@ -34,6 +35,26 @@ trails() ->
        401 => #{description => <<"Unauthorized">>},
        404 => #{description => <<"User not found">>}
      }
+    },
+    #{
+      path        => <<"/v1/user/me">>,
+      method      => <<"PATCH">>,
+      description => <<"Update current user profile (partial) or change password">>,
+      tags        => [<<"Users">>],
+      requestBody => #{
+        required => true,
+        content  => #{<<"application/json">> => #{schema => user_update_schema()}}
+      },
+      responses => #{
+        200 => #{
+          description => <<"Updated profile">>,
+          content     => #{<<"application/json">> => #{schema => user_schema()}}
+        },
+        400 => #{description => <<"Invalid body / unknown field">>},
+        401 => #{description => <<"Unauthorized">>},
+        403 => #{description => <<"Wrong current password or account not active">>},
+        404 => #{description => <<"User not found">>}
+      }
    }
  ].

@@ -49,7 +70,7 @@ user_schema() ->
      nickname        => #{type => string, nullable => true},
      avatar_url      => #{type => string, nullable => true},
      timezone        => #{type => string, nullable => true},
-      language        => #{type => string, nullable => true},
+      language        => #{type => string, enum => [<<"ru">>, <<"en">>], nullable => true},
      social_links    => #{type => array, items => #{type => string}, nullable => true},
      phone           => #{type => string, nullable => true},
      preferences     => #{type => object, nullable => true},
@@ -59,6 +80,23 @@ user_schema() ->
    }
  }.

+user_update_schema() ->
+  #{
+    type       => object,
+    properties => #{
+      language         => #{type => string, enum => [<<"ru">>, <<"en">>]},
+      nickname         => #{type => string, nullable => true},
+      timezone         => #{type => string, nullable => true},
+      phone            => #{type => string, nullable => true},
+      avatar_url       => #{type => string, nullable => true},
+      preferences      => #{type => object, nullable => true},
+      password         => #{type => string, format => <<"password">>,
+        description => <<"New password; requires current_password">>},
+      current_password => #{type => string, format => <<"password">>,
+        description => <<"Current password; required with password">>}
+    }
+  }.
+
 %%%===================================================================
 %%% HTTP-методы
 %%%===================================================================
@@ -67,8 +105,9 @@ user_schema() ->
 -spec handle(cowboy_req:req(), any()) -> {ok, cowboy_req:req(), any()}.
 handle(Req, _Opts) ->
  case cowboy_req:method(Req) of
-    <<"GET">>  -> get_me(Req);
-    _          -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
+    <<"GET">>   -> get_me(Req);
+    <<"PATCH">> -> patch_me(Req);
+    _           -> handler_utils:send_error(Req, 405, <<"Method not allowed">>)
  end.

 %% @doc GET /v1/user/me — получение профиля текущего пользователя.
@@ -84,4 +123,46 @@ get_me(Req) ->
      end;
    {error, Code, Message, Req1} ->
      handler_utils:send_error(Req1, Code, Message)
-  end.
+  end.
+
+%% @doc PATCH /v1/user/me — частичное обновление профиля / смена пароля.
+-spec patch_me(cowboy_req:req()) -> {ok, binary(), cowboy_req:req()}.
+patch_me(Req) ->
+  case handler_utils:auth_user(Req) of
+    {ok, UserId, Req1} ->
+      {ok, Body, Req2} = cowboy_req:read_body(Req1),
+      try jsx:decode(Body, [return_maps]) of
+        Decoded when is_map(Decoded) ->
+          case logic_user:update_me(UserId, Decoded) of
+            {ok, User} ->
+              handler_utils:send_json(Req2, 200, handler_utils:user_to_json(User));
+            {error, not_found} ->
+              handler_utils:send_error(Req2, 404, <<"User not found">>);
+            {error, wrong_password} ->
+              handler_utils:send_error(Req2, 403, <<"Wrong current password">>);
+            {error, forbidden} ->
+              handler_utils:send_error(Req2, 403, <<"Account is not active">>);
+            {error, unknown_field} ->
+              handler_utils:send_error(Req2, 400, <<"Unknown field">>);
+            {error, empty_body} ->
+              handler_utils:send_error(Req2, 400, <<"Empty update body">>);
+            {error, password_pair_required} ->
+              handler_utils:send_error(Req2, 400,
+                <<"password and current_password must be sent together">>);
+            {error, invalid_password} ->
+              handler_utils:send_error(Req2, 400, <<"Invalid password fields">>);
+            {error, invalid_language} ->
+              handler_utils:send_error(Req2, 400, <<"language must be ru or en">>);
+            {error, Reason} when is_atom(Reason) ->
+              handler_utils:send_error(Req2, 400, atom_to_binary(Reason, utf8));
+            {error, _} ->
+              handler_utils:send_error(Req2, 400, <<"Invalid request">>)
+          end;
+        _ ->
+          handler_utils:send_error(Req2, 400, <<"Invalid JSON">>)
+      catch
+        _:_ -> handler_utils:send_error(Req2, 400, <<"Invalid JSON format">>)
+      end;
+    {error, Code, Message, Req1} ->
+      handler_utils:send_error(Req1, Code, Message)
+  end.
@@ -1,6 +1,7 @@
 -module(logic_user).

 -export([list_users_admin/2, get_user_admin/1, update_user_admin/2, delete_user_admin/1]).
+-export([update_me/2]).

 -include("records.hrl").

@@ -51,10 +52,139 @@ delete_user_admin(UserId) ->
      Error
  end.

+%%%-------------------------------------------------------------------
+%%% @doc Обновление собственного профиля (whitelist + смена пароля).
+%%% BodyMap — JSON map с бинарными ключами.
+%%% @end
+%%%-------------------------------------------------------------------
+-spec update_me(UserId :: binary(), BodyMap :: map()) ->
+  {ok, #user{}} | {error, term()}.
+update_me(UserId, BodyMap) when is_map(BodyMap) ->
+  case parse_me_body(BodyMap) of
+    {error, _} = Err ->
+      Err;
+    {ok, ProfileUpdates, PasswordOpt} ->
+      case core_user:get_by_id(UserId) of
+        {error, _} = Err ->
+          Err;
+        {ok, #user{status = Status}} when Status =/= active ->
+          {error, forbidden};
+        {ok, User} ->
+          case apply_password_change(User, PasswordOpt) of
+            {error, _} = Err ->
+              Err;
+            {ok, PassUpdates} ->
+              Updates = ProfileUpdates ++ PassUpdates,
+              case Updates of
+                [] ->
+                  {error, empty_body};
+                _ ->
+                  core_user:update(UserId, Updates)
+              end
+          end
+      end
+  end;
+update_me(_, _) ->
+  {error, invalid_json}.
+
 %%%===================================================================
 %%% Внутренние функции
 %%%===================================================================

+-define(ME_KEYS, [<<"language">>, <<"nickname">>, <<"timezone">>, <<"phone">>,
+  <<"avatar_url">>, <<"preferences">>, <<"password">>, <<"current_password">>]).
+
+parse_me_body(BodyMap) ->
+  case maps:keys(BodyMap) -- ?ME_KEYS of
+    [_ | _] ->
+      {error, unknown_field};
+    [] ->
+      case parse_password_pair(BodyMap) of
+        {error, _} = Err ->
+          Err;
+        {ok, PasswordOpt} ->
+          case parse_profile_fields(BodyMap) of
+            {error, _} = Err ->
+              Err;
+            {ok, ProfileUpdates} ->
+              {ok, ProfileUpdates, PasswordOpt}
+          end
+      end
+  end.
+
+parse_password_pair(BodyMap) ->
+  HasNew = maps:is_key(<<"password">>, BodyMap),
+  HasCur = maps:is_key(<<"current_password">>, BodyMap),
+  case {HasNew, HasCur} of
+    {false, false} ->
+      {ok, undefined};
+    {true, true} ->
+      New = maps:get(<<"password">>, BodyMap),
+      Cur = maps:get(<<"current_password">>, BodyMap),
+      case {New, Cur} of
+        {N, C} when is_binary(N), N =/= <<>>, is_binary(C), C =/= <<>> ->
+          {ok, {C, N}};
+        _ ->
+          {error, invalid_password}
+      end;
+    _ ->
+      {error, password_pair_required}
+  end.
+
+parse_profile_fields(BodyMap) ->
+  Keys = [<<"language">>, <<"nickname">>, <<"timezone">>, <<"phone">>,
+    <<"avatar_url">>, <<"preferences">>],
+  try
+    Updates = lists:filtermap(fun(Key) ->
+      case maps:find(Key, BodyMap) of
+        error -> false;
+        {ok, Val} ->
+          case normalize_me_field(Key, Val) of
+            {ok, Atom, Norm} -> {true, {Atom, Norm}};
+            {error, Reason} -> throw({invalid_field, Reason})
+          end
+      end
+              end, Keys),
+    {ok, Updates}
+  catch
+    throw:{invalid_field, Reason} -> {error, Reason}
+  end.
+
+normalize_me_field(<<"language">>, <<"ru">>) -> {ok, language, <<"ru">>};
+normalize_me_field(<<"language">>, <<"en">>) -> {ok, language, <<"en">>};
+normalize_me_field(<<"language">>, _) -> {error, invalid_language};
+normalize_me_field(<<"nickname">>, null) -> {ok, nickname, <<>>};
+normalize_me_field(<<"nickname">>, V) when is_binary(V) -> {ok, nickname, V};
+normalize_me_field(<<"nickname">>, _) -> {error, invalid_nickname};
+normalize_me_field(<<"timezone">>, null) -> {ok, timezone, <<>>};
+normalize_me_field(<<"timezone">>, V) when is_binary(V) -> {ok, timezone, V};
+normalize_me_field(<<"timezone">>, _) -> {error, invalid_timezone};
+normalize_me_field(<<"phone">>, null) -> {ok, phone, <<>>};
+normalize_me_field(<<"phone">>, V) when is_binary(V) -> {ok, phone, V};
+normalize_me_field(<<"phone">>, _) -> {error, invalid_phone};
+normalize_me_field(<<"avatar_url">>, null) -> {ok, avatar_url, <<>>};
+normalize_me_field(<<"avatar_url">>, V) when is_binary(V) -> {ok, avatar_url, V};
+normalize_me_field(<<"avatar_url">>, _) -> {error, invalid_avatar_url};
+normalize_me_field(<<"preferences">>, null) -> {ok, preferences, #{}};
+normalize_me_field(<<"preferences">>, V) when is_map(V) -> {ok, preferences, V};
+normalize_me_field(<<"preferences">>, _) -> {error, invalid_preferences};
+normalize_me_field(_, _) -> {error, unknown_field}.
+
+apply_password_change(_User, undefined) ->
+  {ok, []};
+apply_password_change(#user{password_hash = Hash}, {Current, New}) ->
+  case logic_auth:verify_password(Current, Hash) of
+    {ok, true} ->
+      case logic_auth:hash_password(New) of
+        {ok, NewHash} ->
+          {ok, [{password_hash, NewHash}]};
+        _ ->
+          {error, password_hash_failed}
+      end;
+    _ ->
+      {error, wrong_password}
+  end.
+
 apply_filters(Users, Filters) ->
  Role = maps:get(role, Filters, undefined),
  StatusBin = maps:get(status, Filters, undefined),
@@ -106,4 +236,4 @@ validate_user_update({timezone, V}) when is_binary(V); V =:= undefined -> true;
 validate_user_update({language, V}) when is_binary(V); V =:= undefined -> true;
 validate_user_update({phone, V}) when is_binary(V); V =:= undefined -> true;
 validate_user_update({preferences, V}) when is_map(V); V =:= undefined -> true;
-validate_user_update(_) -> false.
+validate_user_update(_) -> false.
@@ -2638,6 +2638,158 @@
            "description": "User not found"
          }
        }
+      },
+      "patch": {
+        "description": "Update current user profile (partial) or change password",
+        "tags": [
+          "Users"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "language": {
+                    "type": "string",
+                    "enum": [
+                      "ru",
+                      "en"
+                    ]
+                  },
+                  "nickname": {
+                    "type": "string",
+                    "nullable": true
+                  },
+                  "timezone": {
+                    "type": "string",
+                    "nullable": true
+                  },
+                  "phone": {
+                    "type": "string",
+                    "nullable": true
+                  },
+                  "avatar_url": {
+                    "type": "string",
+                    "nullable": true
+                  },
+                  "preferences": {
+                    "type": "object",
+                    "nullable": true
+                  },
+                  "password": {
+                    "type": "string",
+                    "format": "password"
+                  },
+                  "current_password": {
+                    "type": "string",
+                    "format": "password"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Updated profile",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "id": {
+                      "type": "string"
+                    },
+                    "email": {
+                      "type": "string",
+                      "format": "email"
+                    },
+                    "role": {
+                      "type": "string",
+                      "enum": [
+                        "user",
+                        "bot"
+                      ]
+                    },
+                    "status": {
+                      "type": "string",
+                      "enum": [
+                        "active",
+                        "frozen",
+                        "deleted"
+                      ]
+                    },
+                    "reason": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "nickname": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "avatar_url": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "timezone": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "language": {
+                      "type": "string",
+                      "enum": [
+                        "ru",
+                        "en"
+                      ],
+                      "nullable": true
+                    },
+                    "social_links": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true
+                    },
+                    "phone": {
+                      "type": "string",
+                      "nullable": true
+                    },
+                    "preferences": {
+                      "type": "object",
+                      "nullable": true
+                    },
+                    "last_login": {
+                      "type": "string",
+                      "format": "date-time"
+                    },
+                    "created_at": {
+                      "type": "string",
+                      "format": "date-time"
+                    },
+                    "updated_at": {
+                      "type": "string",
+                      "format": "date-time"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid body / unknown field"
+          },
+          "401": {
+            "description": "Unauthorized"
+          },
+          "403": {
+            "description": "Wrong current password or account not active"
+          },
+          "404": {
+            "description": "User not found"
+          }
+        }
      }
    },
    "/v1/user/reviews": {