fixes user api attribute override error

apps/web/modules/ee/contacts/lib/attributes.test.ts

@@ -2,11 +2,7 @@ import { beforeEach, describe, expect, test, vi } from "vitest";
 import { prisma } from "@formbricks/database";
 import { TContactAttributeKey } from "@formbricks/types/contact-attribute-key";
 import { getContactAttributeKeys } from "@/modules/ee/contacts/lib/contact-attribute-keys";
-import {
-  getContactAttributes,
-  hasEmailAttribute,
-  hasUserIdAttribute,
-} from "@/modules/ee/contacts/lib/contact-attributes";
+import { getContactAttributes, hasEmailAttribute } from "@/modules/ee/contacts/lib/contact-attributes";
 import { updateAttributes } from "./attributes";
 
 vi.mock("@/lib/constants", () => ({
@@ -24,7 +20,6 @@ vi.mock("@/modules/ee/contacts/lib/contact-attributes", async () => {
     ...actual,
     getContactAttributes: vi.fn(),
     hasEmailAttribute: vi.fn(),
-    hasUserIdAttribute: vi.fn(),
   };
 });
 vi.mock("@formbricks/database", () => ({
@@ -80,7 +75,6 @@ describe("updateAttributes", () => {
     vi.clearAllMocks();
     // Set default mock return values - these will be overridden in individual tests
     vi.mocked(getContactAttributes).mockResolvedValue({});
-    vi.mocked(hasUserIdAttribute).mockResolvedValue(false);
     vi.mocked(prisma.contactAttribute.deleteMany).mockResolvedValue({ count: 0 });
     vi.mocked(prisma.$transaction).mockResolvedValue(undefined);
   });
@@ -89,21 +83,19 @@ describe("updateAttributes", () => {
     vi.mocked(getContactAttributeKeys).mockResolvedValue(attributeKeys);
     vi.mocked(getContactAttributes).mockResolvedValue({ name: "Jane", email: "jane@example.com" });
     vi.mocked(hasEmailAttribute).mockResolvedValue(false);
-    vi.mocked(hasUserIdAttribute).mockResolvedValue(false);
     vi.mocked(prisma.$transaction).mockResolvedValue(undefined);
     vi.mocked(prisma.contactAttribute.deleteMany).mockResolvedValue({ count: 0 });
     const attributes = { name: "John", email: "john@example.com" };
     const result = await updateAttributes(contactId, userId, environmentId, attributes);
     expect(prisma.$transaction).toHaveBeenCalled();
     expect(result.success).toBe(true);
-    expect(result.messages).toBeUndefined();
+    expect(result.messages).toEqual([]);
   });
 
   test("skips updating email if it already exists", async () => {
     vi.mocked(getContactAttributeKeys).mockResolvedValue(attributeKeys);
     vi.mocked(getContactAttributes).mockResolvedValue({ name: "Jane", email: "jane@example.com" });
     vi.mocked(hasEmailAttribute).mockResolvedValue(true);
-    vi.mocked(hasUserIdAttribute).mockResolvedValue(false);
     vi.mocked(prisma.$transaction).mockResolvedValue(undefined);
     vi.mocked(prisma.contactAttribute.deleteMany).mockResolvedValue({ count: 0 });
     const attributes = { name: "John", email: "john@example.com" };
@@ -114,77 +106,10 @@ describe("updateAttributes", () => {
     expect(result.messages).toContain("The email already exists for this environment and was not updated.");
   });
 
-  test("skips updating userId if it already exists", async () => {
-    const attributeKeysWithUserId: TContactAttributeKey[] = [
-      ...attributeKeys,
-      {
-        id: "key-4",
-        key: "userId",
-        createdAt: new Date(),
-        updatedAt: new Date(),
-        isUnique: true,
-        name: "User ID",
-        description: null,
-        type: "default",
-        environmentId,
-      },
-    ];
-    vi.mocked(getContactAttributeKeys).mockResolvedValue(attributeKeysWithUserId);
-    vi.mocked(getContactAttributes).mockResolvedValue({ name: "Jane", userId: "old-user-id" });
-    vi.mocked(hasEmailAttribute).mockResolvedValue(false);
-    vi.mocked(hasUserIdAttribute).mockResolvedValue(true);
-    vi.mocked(prisma.$transaction).mockResolvedValue(undefined);
-    vi.mocked(prisma.contactAttribute.deleteMany).mockResolvedValue({ count: 0 });
-    const attributes = { name: "John", userId: "duplicate-user-id" };
-    const result = await updateAttributes(contactId, userId, environmentId, attributes);
-    expect(prisma.$transaction).toHaveBeenCalled();
-
-    expect(result.success).toBe(true);
-    expect(result.messages).toContain("The userId already exists for this environment and was not updated.");
-    expect(result.ignoreUserIdAttribute).toBe(true);
-  });
-
-  test("skips updating both email and userId if both already exist", async () => {
-    const attributeKeysWithUserId: TContactAttributeKey[] = [
-      ...attributeKeys,
-      {
-        id: "key-4",
-        key: "userId",
-        createdAt: new Date(),
-        updatedAt: new Date(),
-        isUnique: true,
-        name: "User ID",
-        description: null,
-        type: "default",
-        environmentId,
-      },
-    ];
-    vi.mocked(getContactAttributeKeys).mockResolvedValue(attributeKeysWithUserId);
-    vi.mocked(getContactAttributes).mockResolvedValue({
-      name: "Jane",
-      email: "old@example.com",
-      userId: "old-user-id",
-    });
-    vi.mocked(hasEmailAttribute).mockResolvedValue(true);
-    vi.mocked(hasUserIdAttribute).mockResolvedValue(true);
-    vi.mocked(prisma.$transaction).mockResolvedValue(undefined);
-    vi.mocked(prisma.contactAttribute.deleteMany).mockResolvedValue({ count: 0 });
-    const attributes = { name: "John", email: "duplicate@example.com", userId: "duplicate-user-id" };
-    const result = await updateAttributes(contactId, userId, environmentId, attributes);
-    expect(prisma.$transaction).toHaveBeenCalled();
-
-    expect(result.success).toBe(true);
-    expect(result.messages).toContain("The email already exists for this environment and was not updated.");
-    expect(result.messages).toContain("The userId already exists for this environment and was not updated.");
-    expect(result.ignoreEmailAttribute).toBe(true);
-    expect(result.ignoreUserIdAttribute).toBe(true);
-  });
-
   test("creates new attributes if under limit", async () => {
     vi.mocked(getContactAttributeKeys).mockResolvedValue([attributeKeys[0]]);
     vi.mocked(getContactAttributes).mockResolvedValue({ name: "Jane" });
     vi.mocked(hasEmailAttribute).mockResolvedValue(false);
-    vi.mocked(hasUserIdAttribute).mockResolvedValue(false);
     vi.mocked(prisma.$transaction).mockResolvedValue(undefined);
     vi.mocked(prisma.contactAttribute.deleteMany).mockResolvedValue({ count: 0 });
     const attributes = { name: "John", newAttr: "val" };
@@ -192,14 +117,13 @@ describe("updateAttributes", () => {
     expect(prisma.$transaction).toHaveBeenCalled();
 
     expect(result.success).toBe(true);
-    expect(result.messages).toBeUndefined();
+    expect(result.messages).toEqual([]);
   });
 
   test("does not create new attributes if over the limit", async () => {
     vi.mocked(getContactAttributeKeys).mockResolvedValue(attributeKeys);
     vi.mocked(getContactAttributes).mockResolvedValue({ name: "Jane", email: "jane@example.com" });
     vi.mocked(hasEmailAttribute).mockResolvedValue(false);
-    vi.mocked(hasUserIdAttribute).mockResolvedValue(false);
     vi.mocked(prisma.$transaction).mockResolvedValue(undefined);
     vi.mocked(prisma.contactAttribute.deleteMany).mockResolvedValue({ count: 0 });
     const attributes = { name: "John", newAttr: "val" };
@@ -212,16 +136,15 @@ describe("updateAttributes", () => {
     vi.mocked(getContactAttributeKeys).mockResolvedValue([]);
     vi.mocked(getContactAttributes).mockResolvedValue({});
     vi.mocked(hasEmailAttribute).mockResolvedValue(false);
-    vi.mocked(hasUserIdAttribute).mockResolvedValue(false);
     vi.mocked(prisma.$transaction).mockResolvedValue(undefined);
     vi.mocked(prisma.contactAttribute.deleteMany).mockResolvedValue({ count: 0 });
     const attributes = {};
     const result = await updateAttributes(contactId, userId, environmentId, attributes);
     expect(result.success).toBe(true);
-    expect(result.messages).toBeUndefined();
+    expect(result.messages).toEqual([]);
   });
 
-  test("deletes non-default attributes that are removed from payload", async () => {
+  test("deletes non-default attributes when deleteRemovedAttributes is true", async () => {
     // Reset mocks explicitly for this test
     vi.mocked(prisma.contactAttribute.deleteMany).mockClear();
 
@@ -232,11 +155,11 @@ describe("updateAttributes", () => {
       customAttr: "oldValue",
     });
     vi.mocked(hasEmailAttribute).mockResolvedValue(false);
-    vi.mocked(hasUserIdAttribute).mockResolvedValue(false);
     vi.mocked(prisma.$transaction).mockResolvedValue(undefined);
     vi.mocked(prisma.contactAttribute.deleteMany).mockResolvedValue({ count: 1 });
     const attributes = { name: "John", email: "john@example.com" };
-    const result = await updateAttributes(contactId, userId, environmentId, attributes);
+    // Pass deleteRemovedAttributes: true to enable deletion behavior
+    const result = await updateAttributes(contactId, userId, environmentId, attributes, true);
     // Only customAttr (key-3) should be deleted, not name (key-1) or email (key-2)
     expect(prisma.contactAttribute.deleteMany).toHaveBeenCalledWith({
       where: {
@@ -247,14 +170,34 @@ describe("updateAttributes", () => {
       },
     });
     expect(result.success).toBe(true);
-    expect(result.messages).toBeUndefined();
+    expect(result.messages).toEqual([]);
   });
 
-  test("does not delete default attributes even if removed from payload", async () => {
+  test("does not delete attributes when deleteRemovedAttributes is false (default behavior)", async () => {
+    // Reset mocks explicitly for this test
+    vi.mocked(prisma.contactAttribute.deleteMany).mockClear();
+
+    vi.mocked(getContactAttributeKeys).mockResolvedValue(attributeKeys);
+    vi.mocked(getContactAttributes).mockResolvedValue({
+      name: "Jane",
+      email: "jane@example.com",
+      customAttr: "oldValue",
+    });
+    vi.mocked(hasEmailAttribute).mockResolvedValue(false);
+    vi.mocked(prisma.$transaction).mockResolvedValue(undefined);
+    const attributes = { name: "John", email: "john@example.com" };
+    // Default behavior (deleteRemovedAttributes: false) should NOT delete existing attributes
+    const result = await updateAttributes(contactId, userId, environmentId, attributes);
+    // deleteMany should NOT be called since we're merging, not replacing
+    expect(prisma.contactAttribute.deleteMany).not.toHaveBeenCalled();
+    expect(result.success).toBe(true);
+    expect(result.messages).toEqual([]);
+  });
+
+  test("does not delete default attributes even when deleteRemovedAttributes is true", async () => {
     // Reset mocks explicitly for this test
     vi.mocked(prisma.contactAttribute.deleteMany).mockClear();
 
-    // Need to include userId and firstName in attributeKeys for this test
     // Note: DEFAULT_ATTRIBUTES includes: email, userId, firstName, lastName (not "name")
     const attributeKeysWithDefaults: TContactAttributeKey[] = [
       {
@@ -309,11 +252,11 @@ describe("updateAttributes", () => {
       firstName: "John",
     });
     vi.mocked(hasEmailAttribute).mockResolvedValue(false);
-    vi.mocked(hasUserIdAttribute).mockResolvedValue(false);
     vi.mocked(prisma.$transaction).mockResolvedValue(undefined);
     vi.mocked(prisma.contactAttribute.deleteMany).mockResolvedValue({ count: 0 });
     const attributes = { customAttr: "value" };
-    const result = await updateAttributes(contactId, userId, environmentId, attributes);
+    // Pass deleteRemovedAttributes: true to test that default attributes are still preserved
+    const result = await updateAttributes(contactId, userId, environmentId, attributes, true);
     // Should not delete default attributes (email, userId, firstName) - deleteMany should not be called
     // since all current attributes are default attributes
     expect(prisma.contactAttribute.deleteMany).not.toHaveBeenCalled();

apps/web/modules/ee/contacts/lib/attributes.ts

@@ -5,11 +5,7 @@ import { TContactAttributeKey } from "@formbricks/types/contact-attribute-key";
 import { MAX_ATTRIBUTE_CLASSES_PER_ENVIRONMENT } from "@/lib/constants";
 import { validateInputs } from "@/lib/utils/validate";
 import { getContactAttributeKeys } from "@/modules/ee/contacts/lib/contact-attribute-keys";
-import {
-  getContactAttributes,
-  hasEmailAttribute,
-  hasUserIdAttribute,
-} from "@/modules/ee/contacts/lib/contact-attributes";
+import { getContactAttributes, hasEmailAttribute } from "@/modules/ee/contacts/lib/contact-attributes";
 
 // Default/system attributes that should not be deleted even if missing from payload
 const DEFAULT_ATTRIBUTES = new Set(["email", "userId", "firstName", "lastName"]);
@@ -51,17 +47,23 @@ const deleteAttributes = async (
   };
 };
 
+/**
+ * Updates or creates contact attributes.
+ *
+ * @param contactId - The ID of the contact to update
+ * @param userId - The user ID of the contact
+ * @param environmentId - The environment ID
+ * @param contactAttributesParam - The attributes to update/create
+ * @param deleteRemovedAttributes - When true, deletes attributes that exist in DB but are not in the payload.
+ * Use this for UI forms where all attributes are submitted. Default is false (merge behavior) for API calls.
+ */
 export const updateAttributes = async (
   contactId: string,
   userId: string,
   environmentId: string,
-  contactAttributesParam: TContactAttributes
-): Promise<{
-  success: boolean;
-  messages?: string[];
-  ignoreEmailAttribute?: boolean;
-  ignoreUserIdAttribute?: boolean;
-}> => {
+  contactAttributesParam: TContactAttributes,
+  deleteRemovedAttributes: boolean = false
+): Promise<{ success: boolean; messages?: string[]; ignoreEmailAttribute?: boolean }> => {
   validateInputs(
     [contactId, ZId],
     [userId, ZString],
@@ -70,43 +72,28 @@ export const updateAttributes = async (
   );
 
   let ignoreEmailAttribute = false;
-  let ignoreUserIdAttribute = false;
 
-  // Fetch current attributes, contact attribute keys, and email/userId checks in parallel
-  const [currentAttributes, contactAttributeKeys, existingEmailAttribute, existingUserIdAttribute] =
-    await Promise.all([
-      getContactAttributes(contactId),
-      getContactAttributeKeys(environmentId),
-      contactAttributesParam.email
-        ? hasEmailAttribute(contactAttributesParam.email, environmentId, contactId)
-        : Promise.resolve(null),
-      contactAttributesParam.userId
-        ? hasUserIdAttribute(contactAttributesParam.userId, environmentId, contactId)
-        : Promise.resolve(null),
-    ]);
+  // Fetch current attributes, contact attribute keys, and email check in parallel
+  const [currentAttributes, contactAttributeKeys, existingEmailAttribute] = await Promise.all([
+    getContactAttributes(contactId),
+    getContactAttributeKeys(environmentId),
+    contactAttributesParam.email
+      ? hasEmailAttribute(contactAttributesParam.email, environmentId, contactId)
+      : Promise.resolve(null),
+  ]);
 
-  // Process email and userId existence early
+  // Process email existence early
+  const { email, ...remainingAttributes } = contactAttributesParam;
+  const contactAttributes = existingEmailAttribute ? remainingAttributes : contactAttributesParam;
   const emailExists = !!existingEmailAttribute;
-  const userIdExists = !!existingUserIdAttribute;
 
-  // Remove email and/or userId from attributes if they already exist on another contact
-  let contactAttributes = { ...contactAttributesParam };
-
-  if (emailExists) {
-    const { email: _email, ...rest } = contactAttributes;
-    contactAttributes = rest;
-    ignoreEmailAttribute = true;
+  // Delete attributes that were removed (only when explicitly requested)
+  // This is used by UI forms where all attributes are submitted
+  // For API calls, we want merge behavior by default (only update passed attributes)
+  if (deleteRemovedAttributes) {
+    await deleteAttributes(contactId, currentAttributes, contactAttributesParam, contactAttributeKeys);
   }
 
-  if (userIdExists) {
-    const { userId: _userId, ...rest } = contactAttributes;
-    contactAttributes = rest;
-    ignoreUserIdAttribute = true;
-  }
-
-  // Delete attributes that were removed (using the deleteAttributes service)
-  await deleteAttributes(contactId, currentAttributes, contactAttributesParam, contactAttributeKeys);
-
   // Create lookup map for attribute keys
   const contactAttributeKeyMap = new Map(contactAttributeKeys.map((ack) => [ack.key, ack]));
 
@@ -127,14 +114,12 @@ export const updateAttributes = async (
     }
   );
 
-  const messages: string[] = [];
+  let messages: string[] = emailExists
+    ? ["The email already exists for this environment and was not updated."]
+    : [];
 
   if (emailExists) {
-    messages.push("The email already exists for this environment and was not updated.");
-  }
-
-  if (userIdExists) {
-    messages.push("The userId already exists for this environment and was not updated.");
+    ignoreEmailAttribute = true;
   }
 
   // Update all existing attributes
@@ -189,8 +174,7 @@ export const updateAttributes = async (
 
   return {
     success: true,
-    messages: messages.length > 0 ? messages : undefined,
+    messages,
     ignoreEmailAttribute,
-    ignoreUserIdAttribute,
   };
 };

apps/web/modules/ee/contacts/lib/contact-attributes.ts

@@ -1,7 +1,7 @@
 import { Prisma } from "@prisma/client";
 import { cache as reactCache } from "react";
 import { prisma } from "@formbricks/database";
-import { ZId, ZString } from "@formbricks/types/common";
+import { ZId } from "@formbricks/types/common";
 import { TContactAttributes } from "@formbricks/types/contact-attribute";
 import { DatabaseError } from "@formbricks/types/errors";
 import { ZUserEmail } from "@formbricks/types/user";
@@ -68,31 +68,3 @@ export const hasEmailAttribute = reactCache(
     return !!contactAttribute;
   }
 );
-
-export const hasUserIdAttribute = reactCache(
-  async (userId: string, environmentId: string, contactId: string): Promise<boolean> => {
-    validateInputs([userId, ZString], [environmentId, ZId], [contactId, ZId]);
-
-    const contactAttribute = await prisma.contactAttribute.findFirst({
-      where: {
-        AND: [
-          {
-            attributeKey: {
-              key: "userId",
-              environmentId,
-            },
-            value: userId,
-          },
-          {
-            NOT: {
-              contactId,
-            },
-          },
-        ],
-      },
-      select: { id: true },
-    });
-
-    return !!contactAttribute;
-  }
-);

apps/web/modules/ee/contacts/lib/update-contact-attributes.test.ts

@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { beforeEach, describe, expect, test, vi } from "vitest";
 import { updateAttributes } from "./attributes";
 import { getContactAttributeKeys } from "./contact-attribute-keys";
 import { getContactAttributes } from "./contact-attributes";
@@ -16,7 +16,7 @@ describe("updateContactAttributes", () => {
     vi.clearAllMocks();
   });
 
-  it("should update contact attributes successfully", async () => {
+  test("should update contact attributes with deleteRemovedAttributes: true", async () => {
     const contactId = "contact123";
     const environmentId = "env123";
     const userId = "user123";
@@ -91,13 +91,14 @@ describe("updateContactAttributes", () => {
 
     expect(getContact).toHaveBeenCalledWith(contactId);
     expect(getContactAttributeKeys).toHaveBeenCalledWith(environmentId);
-    expect(updateAttributes).toHaveBeenCalledWith(contactId, userId, environmentId, attributes);
+    // Should call updateAttributes with deleteRemovedAttributes: true for UI form updates
+    expect(updateAttributes).toHaveBeenCalledWith(contactId, userId, environmentId, attributes, true);
     expect(getContactAttributes).toHaveBeenCalledWith(contactId);
     expect(result.updatedAttributes).toEqual(mockUpdatedAttributes);
     expect(result.updatedAttributeKeys).toBeUndefined();
   });
 
-  it("should detect new attribute keys when created", async () => {
+  test("should detect new attribute keys when created", async () => {
     const contactId = "contact123";
     const environmentId = "env123";
     const userId = "user123";
@@ -184,7 +185,7 @@ describe("updateContactAttributes", () => {
     ]);
   });
 
-  it("should handle missing userId with warning message", async () => {
+  test("should handle missing userId with warning message", async () => {
     const contactId = "contact123";
     const environmentId = "env123";
     const attributes = {
@@ -226,13 +227,13 @@ describe("updateContactAttributes", () => {
 
     const result = await updateContactAttributes(contactId, attributes);
 
-    expect(updateAttributes).toHaveBeenCalledWith(contactId, "", environmentId, attributes);
+    expect(updateAttributes).toHaveBeenCalledWith(contactId, "", environmentId, attributes, true);
     expect(result.messages).toContain(
       "Warning: userId attribute is missing. Some operations may not work correctly."
     );
   });
 
-  it("should merge messages from updateAttributes", async () => {
+  test("should merge messages from updateAttributes", async () => {
     const contactId = "contact123";
     const environmentId = "env123";
     const userId = "user123";
@@ -279,7 +280,7 @@ describe("updateContactAttributes", () => {
     expect(result.messages).toContain("The email already exists for this environment and was not updated.");
   });
 
-  it("should throw error if contact not found", async () => {
+  test("should throw error if contact not found", async () => {
     const contactId = "contact123";
     const attributes = {
       firstName: "John",

apps/web/modules/ee/contacts/lib/update-contact-attributes.ts

@@ -13,11 +13,6 @@ export interface UpdateContactAttributesResult {
   updatedAttributeKeys?: TContactAttributeKey[];
 }
 
-/**
- * Updates contact attributes for a single contact.
- * Handles loading contact data, extracting userId, calling updateAttributes,
- * and detecting if new attribute keys were created.
- */
 export const updateContactAttributes = async (
   contactId: string,
   attributes: TContactAttributes
@@ -43,8 +38,9 @@ export const updateContactAttributes = async (
   const currentAttributeKeys = await getContactAttributeKeys(environmentId);
   const currentKeysSet = new Set(currentAttributeKeys.map((key) => key.key));
 
-  // Call the existing updateAttributes function
-  const updateResult = await updateAttributes(contactId, userId, environmentId, attributes);
+  // Call updateAttributes with deleteRemovedAttributes: true
+  // UI forms submit all attributes, so any missing attribute should be deleted
+  const updateResult = await updateAttributes(contactId, userId, environmentId, attributes, true);
 
   // Merge any messages from updateAttributes
   if (updateResult.messages) {