Renamed and modified the unsecure update method to only update the last seen field of a member profile to reduce the security impact.

Author: ocielliottc

server/src/main/java/com/objectcomputing/checkins/services/memberprofile/MemberProfileServices.java

@@ -28,5 +28,5 @@ Set<MemberProfile> findByValues(String firstName, String lastName, String title,
 
     MemberProfile updateProfile(MemberProfile memberProfile);
 
-    MemberProfile unsecureUpdateProfile(MemberProfile memberProfile);
+    void updateLastSeen(UUID id);
 }

server/src/main/java/com/objectcomputing/checkins/services/memberprofile/MemberProfileServicesImpl.java

@@ -24,6 +24,7 @@
 import org.slf4j.LoggerFactory;
 
 import java.util.*;
+import java.time.LocalDate;
 
 import static com.objectcomputing.checkins.util.Util.nullSafeUUIDToString;
 import static com.objectcomputing.checkins.services.validate.PermissionsValidation.NOT_AUTHORIZED_MSG;
@@ -258,7 +259,12 @@ public MemberProfile updateProfile(MemberProfile memberProfile) {
 
     @Override
     @CacheInvalidate(cacheNames = {"member-cache"})
-    public MemberProfile unsecureUpdateProfile(MemberProfile memberProfile) {
-        return memberProfileRepository.update(memberProfile);
+    public void updateLastSeen(UUID id) {
+        Optional<MemberProfile> profile = memberProfileRepository.findById(id);
+        if (profile.isPresent()) {
+          MemberProfile memberProfile = profile.get();
+          memberProfile.setLastSeen(LocalDate.now());
+          memberProfileRepository.update(memberProfile);
+        }
     }
 }

server/src/main/java/com/objectcomputing/checkins/services/memberprofile/currentuser/CurrentUserController.java

@@ -19,7 +19,6 @@
 import io.swagger.v3.oas.annotations.tags.Tag;
 
 import java.net.URI;
-import java.time.LocalDate;
 import java.util.List;
 import java.util.Set;
 import java.util.UUID;
@@ -63,8 +62,7 @@ public HttpResponse<CurrentUserDTO> currentUser(@Nullable Authentication authent
 
         MemberProfile user = currentUserServices.findOrSaveUser(firstName, lastName, workEmail);
 
-        user.setLastSeen(LocalDate.now());
-        memberProfileServices.unsecureUpdateProfile(user);
+        memberProfileServices.updateLastSeen(user.getId());
         List<Permission> permissions = rolePermissionServices.findUserPermissions(user.getId());
 
         Set<Role> roles = roleServices.findUserRoles(user.getId());