From 8d130908c2ca6dab11df1fb822e740cc44f4d95d Mon Sep 17 00:00:00 2001
From: ANKIT VARSHNEY <132201033+AVtheking@users.noreply.github.com>
Date: Tue, 30 Dec 2025 14:16:10 +0530
Subject: [PATCH] Allow user to update profile picture (#16812)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes [#16805](https://github.com/twentyhq/twenty/issues/16805)

User was not able to update his own profile picture it showed permisson
error while doing so.

Updated permission so that user is able to edit profile picture

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Ensures profile picture uploads succeed only with appropriate
permissions and clearer errors.
>
> - Tightens `UploadProfilePicturePermissionGuard` to handle missing
`workspace`, allow during workspace creation, and permit uploads when
user has `WORKSPACE_MEMBERS` or `PROFILE_INFORMATION` settings;
otherwise throws a `PermissionsException` with a user-friendly message
> - In `user-workspace.resolver.ts`, validates the upload result and
throws an error if no files were returned
>
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
3766bac15e340bdd467de3a9d923dbd697aab3db. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Félix Malfait <felix@twenty.com>
---
 .../guards/upload-profile-picture-permission.guard.ts | 11 +++++++++++
 .../user-workspace/user-workspace.resolver.ts         |  4 ++++
 2 files changed, 15 insertions(+)

diff --git a/packages/twenty-server/src/engine/core-modules/user-workspace/guards/upload-profile-picture-permission.guard.ts b/packages/twenty-server/src/engine/core-modules/user-workspace/guards/upload-profile-picture-permission.guard.ts
index 55d6b54105..84b0267496 100644
--- a/packages/twenty-server/src/engine/core-modules/user-workspace/guards/upload-profile-picture-permission.guard.ts
+++ b/packages/twenty-server/src/engine/core-modules/user-workspace/guards/upload-profile-picture-permission.guard.ts
@@ -6,6 +6,7 @@ import {
 import { GqlExecutionContext } from '@nestjs/graphql';
 
 import { msg } from '@lingui/core/macro';
+import { isDefined } from 'class-validator';
 import { PermissionFlagType } from 'twenty-shared/constants';
 import { WorkspaceActivationStatus } from 'twenty-shared/workspace';
 
@@ -24,6 +25,16 @@ export class UploadProfilePicturePermissionGuard implements CanActivate {
     const gqlContext = GqlExecutionContext.create(context);
     const request = gqlContext.getContext().req;
 
+    if (!isDefined(request.workspace)) {
+      throw new PermissionsException(
+        PermissionsExceptionMessage.PERMISSION_DENIED,
+        PermissionsExceptionCode.PERMISSION_DENIED,
+        {
+          userFriendlyMessage: msg`Workspace not found`,
+        },
+      );
+    }
+
     const workspaceId = request.workspace.id;
     const userWorkspaceId = request.userWorkspaceId;
     const workspaceActivationStatus = request.workspace.activationStatus;
diff --git a/packages/twenty-server/src/engine/core-modules/user-workspace/user-workspace.resolver.ts b/packages/twenty-server/src/engine/core-modules/user-workspace/user-workspace.resolver.ts
index 147179a9cd..07383f9706 100644
--- a/packages/twenty-server/src/engine/core-modules/user-workspace/user-workspace.resolver.ts
+++ b/packages/twenty-server/src/engine/core-modules/user-workspace/user-workspace.resolver.ts
@@ -38,6 +38,10 @@ export class UserWorkspaceResolver {
       workspaceId,
     });
 
+    if (!files.length) {
+      throw new Error('Failed to upload profile picture');
+    }
+
     return files[0];
   }
 }