Convert updateUser mutation to updateCurrentUser

tests/test_graphql_api/test_user/helpers.py

@@ -4,5 +4,5 @@
 
 current_user_query = partial(build_query, "currentUser")
 
-UPDATE_MUTATION = build_mutation("updateUser", "UserUpdateMutation")
+UPDATE_MUTATION = build_mutation("updateCurrentUser", "CurrentUserUpdateMutation")
 STAFF_UPDATE_MUTATION = build_mutation("updateStaffUser", "UserStaffUpdateMutation")

tests/test_graphql_api/test_user/test_update.py

@@ -15,7 +15,6 @@ def test_user__update__language(graphql):
     user = UserFactory.create_superuser(preferred_language=Language.EN.value)
 
     data = {
-        "pk": user.pk,
         "preferredLanguage": Language.FI.value.upper(),
     }
 
@@ -33,11 +32,25 @@ def test_user__update__language_not_available(graphql):
     user = UserFactory.create_superuser(preferred_language=Language.EN.value)
 
     data = {
-        "pk": user.pk,
         "preferredLanguage": "UK",
     }
 
     graphql.force_login(user)
     response = graphql(UPDATE_MUTATION, input_data=data)
 
     assert response.has_schema_errors is True, response
+
+
+def test_user__update__pk_user_not_an_input(graphql):
+    user = UserFactory.create_superuser(preferred_language=Language.EN.value)
+    other_user = UserFactory.create_superuser(preferred_language=Language.EN.value)
+
+    data = {
+        "pk": other_user.pk,
+        "preferredLanguage": Language.FI.value.upper(),
+    }
+
+    graphql.force_login(user)
+    response = graphql(UPDATE_MUTATION, input_data=data)
+
+    assert response.has_schema_errors

tests/test_graphql_api/test_user/test_update_permissions.py

@@ -15,7 +15,6 @@ def test_user__update__language__superuser(graphql):
     user = UserFactory.create_superuser()
 
     data = {
-        "pk": user.pk,
         "preferredLanguage": Language.FI.value.upper(),
     }
 
@@ -29,7 +28,6 @@ def test_user__update__language__regular_user(graphql):
     user = UserFactory.create()
 
     data = {
-        "pk": user.pk,
         "preferredLanguage": Language.FI.value.upper(),
     }
 
@@ -39,25 +37,10 @@ def test_user__update__language__regular_user(graphql):
     assert response.has_errors is False
 
 
-def test_user__update__language__other_user(graphql):
-    user = UserFactory.create_superuser()
-
-    data = {
-        "pk": user.pk,
-        "preferredLanguage": Language.FI.value.upper(),
-    }
-
-    graphql.login_with_regular_user()
-    response = graphql(UPDATE_MUTATION, input_data=data)
-
-    assert response.error_message() == "No permission to update."
-
-
 def test_user__update__language__admin(graphql):
     user = UserFactory.create_with_general_role()
 
     data = {
-        "pk": user.pk,
         "preferredLanguage": Language.FI.value.upper(),
     }
 

tilavarauspalvelu/api/graphql/mutations.py

@@ -76,7 +76,7 @@
 from .types.resource.mutations import ResourceCreateMutation, ResourceDeleteMutation, ResourceUpdateMutation
 from .types.space.mutations import SpaceCreateMutation, SpaceDeleteMutation, SpaceUpdateMutation
 from .types.unit.mutations import UnitUpdateMutation
-from .types.user.mutations import UserStaffUpdateMutation, UserUpdateMutation
+from .types.user.mutations import CurrentUserUpdateMutation, UserStaffUpdateMutation
 
 __all__ = [
     "AllocatedTimeSlotCreateMutation",
@@ -91,6 +91,7 @@
     "BannerNotificationCreateMutation",
     "BannerNotificationDeleteMutation",
     "BannerNotificationUpdateMutation",
+    "CurrentUserUpdateMutation",
     "EquipmentCategoryCreateMutation",
     "EquipmentCategoryDeleteMutation",
     "EquipmentCategoryUpdateMutation",
@@ -138,5 +139,4 @@
     "SpaceUpdateMutation",
     "UnitUpdateMutation",
     "UserStaffUpdateMutation",
-    "UserUpdateMutation",
 ]

tilavarauspalvelu/api/graphql/schema.py

@@ -31,6 +31,7 @@
     BannerNotificationCreateMutation,
     BannerNotificationDeleteMutation,
     BannerNotificationUpdateMutation,
+    CurrentUserUpdateMutation,
     EquipmentCategoryCreateMutation,
     EquipmentCategoryDeleteMutation,
     EquipmentCategoryUpdateMutation,
@@ -78,7 +79,6 @@
     SpaceUpdateMutation,
     UnitUpdateMutation,
     UserStaffUpdateMutation,
-    UserUpdateMutation,
 )
 from .queries import (
     AgeGroupNode,
@@ -356,7 +356,7 @@ class Mutation(graphene.ObjectType):
     refresh_order = RefreshOrderMutation.Field()
     #
     # User
-    update_user = UserUpdateMutation.Field()
+    update_current_user = CurrentUserUpdateMutation.Field()
     update_staff_user = UserStaffUpdateMutation.Field()
     #
     # Misc.

tilavarauspalvelu/api/graphql/types/user/mutations.py

@@ -1,19 +1,35 @@
+from typing import TYPE_CHECKING, Any, Self
+
 from graphene_django_extensions import UpdateMutation
+from graphene_django_extensions.bases import DjangoMutation
+
+from tilavarauspalvelu.typing import GQLInfo
 
 from .permissions import UserPermission, UserStaffPermission
-from .serializers import UserStaffUpdateSerializer, UserUpdateSerializer
+from .serializers import CurrentUserUpdateSerializer, UserStaffUpdateSerializer
+
+if TYPE_CHECKING:
+    from tilavarauspalvelu.models import User
 
 __all__ = [
+    "CurrentUserUpdateMutation",
     "UserStaffUpdateMutation",
-    "UserUpdateMutation",
 ]
 
 
-class UserUpdateMutation(UpdateMutation):
+class CurrentUserUpdateMutation(DjangoMutation):
     class Meta:
-        serializer_class = UserUpdateSerializer
+        serializer_class = CurrentUserUpdateSerializer
         permission_classes = [UserPermission]
 
+    @classmethod
+    def custom_mutation(cls, info: GQLInfo, input_data: dict[str, Any]) -> Self:
+        user: User = info.context.user
+        user.preferred_language = input_data["preferred_language"]
+        user.save(update_fields=["preferred_language"])
+        output = cls.get_serializer_output(user)
+        return cls(**output)
+
 
 class UserStaffUpdateMutation(UpdateMutation):
     class Meta:

tilavarauspalvelu/api/graphql/types/user/permissions.py

@@ -26,11 +26,8 @@ def has_filter_permission(cls, user: AnyUser, filters: GraphQLFilterInfo) -> boo
 
     @classmethod
     def has_mutation_permission(cls, user: AnyUser, input_data: dict[str, Any]) -> bool:
-        return False
-
-    @classmethod
-    def has_update_permission(cls, instance: User, user: AnyUser, input_data: dict[str, Any]) -> bool:
-        return user == instance  # Can only update own information.
+        # For updating current user information.
+        return not user.is_anonymous
 
 
 class UserStaffPermission(BasePermission):

tilavarauspalvelu/api/graphql/types/user/serializers.py

@@ -3,18 +3,23 @@
 from tilavarauspalvelu.models import User
 
 __all__ = [
+    "CurrentUserUpdateSerializer",
     "UserStaffUpdateSerializer",
-    "UserUpdateSerializer",
 ]
 
 
-class UserUpdateSerializer(NestingModelSerializer):
+class CurrentUserUpdateSerializer(NestingModelSerializer):
     class Meta:
         model = User
         fields = [
             "pk",
             "preferred_language",
         ]
+        extra_kwargs = {
+            "pk": {
+                "read_only": True,
+            },
+        }
 
 
 class UserStaffUpdateSerializer(NestingModelSerializer):