# Account Settings Backend

Account Settings does not have a separate backend base module. It uses the Admin backend module's current-user profile endpoint.

## Route

| Method | Route                   | Controller                      | Purpose                                   |
| ------ | ----------------------- | ------------------------------- | ----------------------------------------- |
| `PUT`  | `/admin/update-profile` | `AdminController.updateProfile` | Update the currently authenticated admin. |

Source:

```txt
backend/app/base_modules/Admin/routes.ts
backend/app/base_modules/Admin/controller/admin_controller.ts
```

The route uses `middleware.auth()`.

## Request Flow

```txt
PUT /admin/update-profile
  -> auth middleware
  -> AdminController.updateProfile
  -> admin_update_profile_validator
  -> current auth user merge/save
  -> reload roles
  -> query role_permissions
  -> return { user, permissions }
```

## Validation

Validator:

```txt
backend/app/base_modules/Admin/validators/admin_update_profile_validator.ts
```

Keep frontend validation compatible with this validator. Backend validation is authoritative.

## Response Contract

The endpoint returns the same shape consumed by Auth:

```ts
type GetUserResponse = {
  user: {
    id: number;
    email: string;
    firstName: string;
    lastName: string;
    status: string;
    createdAt: string;
    roles: Array<{ id: number; name: string }>;
  };
  permissions: string[];
};
```

AuthProvider maps this response into `AuthUser` and updates current user state.

## Ownership Rules

- AccountSettings owns the UI and form behavior.
- Auth owns `updateUser` and current user state updates.
- Backend Admin owns profile persistence and response shape.
- AccessControl owns managing other admin accounts.