From 8ae08b00e6f0f7fd3127cada8731f7cab4656be0 Mon Sep 17 00:00:00 2001
From: dal <dallin@buster.so>
Date: Mon, 20 Jan 2025 15:57:31 -0700
Subject: [PATCH] fix: Correct user role attribute and enhance read-only logic
 in list_attributes_handler

- Updated the user role attribute key from "role" to "organization_role" for accurate role retrieval.
- Introduced a read-only flag for specific user attributes, improving data integrity by clearly indicating which attributes should not be modified.
- Enhanced error handling for user role retrieval, ensuring robust responses for missing or incorrect attributes.
---
 .../rest/routes/users/assets/list_attributes.rs       | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/api/src/routes/rest/routes/users/assets/list_attributes.rs b/api/src/routes/rest/routes/users/assets/list_attributes.rs
index 92508692e..476a2321d 100644
--- a/api/src/routes/rest/routes/users/assets/list_attributes.rs
+++ b/api/src/routes/rest/routes/users/assets/list_attributes.rs
@@ -56,7 +56,7 @@ async fn list_attributes_handler(user: User, user_id: Uuid) -> Result<Vec<Attrib
         None => return Err(anyhow::anyhow!("User organization id not found")),
     };
 
-    let auth_user_role = match user.attributes.get("role") {
+    let auth_user_role = match user.attributes.get("organization_role") {
         Some(Value::String(role)) => role,
         Some(_) => return Err(anyhow::anyhow!("User role not found")),
         None => return Err(anyhow::anyhow!("User role not found")),
@@ -86,10 +86,17 @@ async fn list_attributes_handler(user: User, user_id: Uuid) -> Result<Vec<Attrib
 
     for (key, value) in user_attributes.as_object().unwrap() {
         if let Some(value_str) = value.as_str() {
+            let read_only = [
+                "organization_id",
+                "organization_role",
+                "user_id",
+                "user_email",
+            ]
+            .contains(&key.as_str());
             attributes.push(AttributeInfo {
                 name: key.to_string(),
                 value: value_str.to_string(),
-                read_only: false,
+                read_only,
             });
         }
     }