zero-fucks-given/docs/core/account-settings/backend.md

Account Settings Backend

Account Settings does not have a separate backend base module. It uses the Admin backend module's current-user profile endpoint.

Route

Method	Route	Controller	Purpose
PUT	/admin/update-profile	AdminController.updateProfile	Update the currently authenticated admin.

Source:

apps/backend/app/base_modules/Admin/routes.ts
apps/backend/app/base_modules/Admin/controller/admin_controller.ts

The route uses middleware.auth().

Request Flow

PUT /admin/update-profile
  -> auth middleware
  -> AdminController.updateProfile
  -> admin_update_profile_validator
  -> current auth user merge/save
  -> reload roles
  -> query role_permissions
  -> return { user, permissions }

Validation

Validator:

apps/backend/app/base_modules/Admin/validators/admin_update_profile_validator.ts

Keep frontend validation compatible with this validator. Backend validation is authoritative.

Response Contract

The endpoint returns the same shape consumed by Auth:

type GetUserResponse = {
  user: {
    id: number;
    email: string;
    firstName: string;
    lastName: string;
    status: string;
    createdAt: string;
    roles: Array<{ id: number; name: string }>;
  };
  permissions: string[];
};

AuthProvider maps this response into AuthUser and updates current user state.

Ownership Rules

• AccountSettings owns the UI and form behavior.
• Auth owns updateUser and current user state updates.
• Backend Admin owns profile persistence and response shape.
• AccessControl owns managing other admin accounts.