From 8deca918e31e85bff7e4d0e985cfadaed7bd9a87 Mon Sep 17 00:00:00 2001
From: julia-weppler-1 <156942916+julia-weppler-1@users.noreply.github.com>
Date: Sun, 19 Jul 2026 21:08:57 -0400
Subject: [PATCH] Enhance user profile update comment

Added a comment regarding uniqueness enforcement for profile updates.
---
 server/routes/users.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/server/routes/users.js b/server/routes/users.js
index cdc3d5f..223eb29 100644
--- a/server/routes/users.js
+++ b/server/routes/users.js
@@ -30,6 +30,8 @@ router.get("/:id", requireValidId, async (req, res) => {
 });
 
 // UPDATE a profile — only the logged-in user can edit their own profile
+// this update does not enforce uniqueness, so even though a user must create a profile with a unique email/username,
+// they can change it to an existing one. I would recommend adding the same checks that the register path has.
 router.put("/:id", requireValidId, async (req, res) => {
   try {
     if (req.params.id !== req.user._id.toString()) {