Error when updating display name and avatar URL

[justdueck]

• Sourcegraph version:
• Platform information:

Steps to reproduce:

1. Update Display Name and Avatar URL in user settings
2. Hit 'Save'

Expected behavior:

Saves successfully and updates display name and avatar

Actual behavior:

Receives Error: unable to change username because auth.enableUsernameChanges is false in site configuration

Customer support ticket: https://sourcegraph.atlassian.net/jira/servicedesk/projects/SG/queues/custom/2/SG-420

[github-actions]

Heads up @tsenart - the "team/cloud" label was applied to this issue.

[flying-robot]

Going to pick this up.

[flying-robot]

What I think is happening is that the viewerCanChangeUsername function below falls through incorrectly:

sourcegraph/cmd/frontend/graphqlbackend/user.go

Lines 338 to 347 in d37737a

	func viewerCanChangeUsername(ctx context.Context, userID int32) bool {
	if err := backend.CheckSiteAdminOrSameUser(ctx, userID); err != nil {
	return false
	}
	if conf.Get().AuthEnableUsernameChanges {
	return true
	}
	// 🚨 SECURITY: Only site admins are allowed to change a user's username when auth.enableUsernameChanges == false.
	return backend.CheckCurrentUserIsSiteAdmin(ctx) == nil
	}

If the user is a site admin or it's a user updating themselves, nothing is returned from CheckSiteAdminOrSameUser. In that case we fall through to the configuration check, which then falls through to the site admin check which triggers the error that was reported. A site admin then proceeds as expected, but a regular user is unable to update something like displayName as a result.

/cc @unknwon

[unknwon]

A site admin then proceeds as expected,...

I don't think so? Both site admins and regular users are blocked by this config check. (but this is not important, just a minor detail) We have confused logic flow that I misunderstood.