2026-04-06 09:12:59 +02:00
|
|
|
-- name: UpdateUserProfile :execresult
|
2026-08-01 22:06:14 +02:00
|
|
|
UPDATE users
|
|
|
|
|
SET username = ?, avatar = ?, display_name = ?, about = ?
|
|
|
|
|
WHERE id = ?;
|
2026-04-06 09:12:59 +02:00
|
|
|
|
|
|
|
|
-- name: UpdateUserPassword :exec
|
|
|
|
|
UPDATE users SET password = ? WHERE id = ?;
|
2026-08-01 22:06:14 +02:00
|
|
|
|
|
|
|
|
-- name: UpdateUserCustomStatus :exec
|
|
|
|
|
-- Separate from UpdateUserProfile because a custom status arrives over the
|
|
|
|
|
-- WebSocket presence path, not the REST profile PATCH, and must not be able to
|
|
|
|
|
-- clobber the username/avatar of a profile edit racing it.
|
|
|
|
|
UPDATE users SET custom_status = ? WHERE id = ?;
|
|
|
|
|
|
|
|
|
|
-- name: CountUsersWithAvatar :one
|
|
|
|
|
-- Authorization probe for the file route: an unlinked attachment is readable by
|
|
|
|
|
-- everyone exactly while some user's avatar points at it. Covered by the
|
|
|
|
|
-- partial index on users(avatar) added in migration 027.
|
|
|
|
|
SELECT COUNT(*) FROM users WHERE avatar = ?;
|
