Nextjs-auth0: How do you update user profile?

[semyou]

Description

I am getting this error whenever a user tries to update their profile data. What and where should I set the scope to allow the user to update their profile?

{ statusCode: 403,
  error: 'Forbidden',
  message: 'Insufficient scope, expected any of: update:users,update:users_app_metadata,update:current_user_metadata',
  errorCode: 'insufficient_scope' }

To reproduce, I have a form that the user fills and then submits to an api behind /pages/api/ of next v9. This is the api content:

````
import fetch from "isomorphic-unfetch";
import auth0 from "../../utils/auth0";

export default async function editUser(req, res) {
try {
const tokenCache = await auth0.tokenCache(req, res);
const { accessToken } = await tokenCache.getAccessToken({
scope:['update:current_user']
});
const values = JSON.parse(req.body);
const url = process.env.AUTH0_AUDIENCE + "users/" + values.id;
console.log("url", url);
console.log("accessToken", accessToken);
const response = await fetch(url, {
method: "PATCH",
body: JSON.stringify(values),
json: true,
headers: {
authorization: "Bearer " + accessToken,
"content-type": "application/json"
}
});
const data = await response.json();
console.log("data", data);

res.status(200).json(data);

} catch (error) {
console.error(error);
res
.status(error.status || 500)
.json({ code: error.code, error: error.message });
}
}
````

Environment

Using v0.10.0 version

[semyou]

@sandrinodimattia any guidance will be very much appreciated.

[mottet-dev]

Have you tried adding update:users or any of the other permissions mentioned in the error to the scope settings that you pass to the initAuth0 function?

[semyou]

I tried it. No success.
@sandrinodimattia can you please help by providing guidance?

Thanks,

[semyou]

I am thinking to dump auth0 completely. There is 0 answers to issues/questions and even worst you cannot comment on the community website on auth0.com because your account is new. That's a catch 22. What a terrible experience!

[KatSick]

any updates on the issue?

[paulolramos]

Just ran into a similar issue. Looks like SPA applications can only use certain scopes.

https://auth0.com/docs/tokens/management-api-access-tokens/get-management-api-tokens-for-single-page-applications#available-scopes-and-endpoints

I was trying to use update:users and that didn't work, but update:current_user_metadata worked.

[semyou]

I simply got away from auth0 and did my own authentication with bcrypt and cookies. Everything is now in my DB. Less steps. More consistency. And no need to beg for someone's support.

[ptpavankumar]

Im getting the same issue and now when I apply @paulolramos suggestion Im getting 400 error saying { "statusCode": 400, "error": "Bad Request", "message": "Invalid token (link_with).", "errorCode": "invalid_body" }

[ptpavankumar]

Ok, after enormous amount of time it started working.
Primary user should have audience along with scopes such as "openid profile email update:current_user_metadata update:current_user_identities"
Secondary user should also have audience along with scope such as "profile".

NOTE: The catch is to get an IdTokenClaims() and not access token
const a0 = new Auth0Client({ domain: process.env.AUTH0_DOMAIN, client_id: process.env.AUTH0_KEY, audience: "https://xxxxxx.yyy.auth0.com/api/v2/" }); await a0.loginWithPopup({ max_age: 0, scope: "profile", }); const { __raw: targetUserIdToken, email } = await a0.getIdTokenClaims();

[callmephilip]

@ptpavankumar thanks for taking time to sort this out and report back! saved me tons of headache 🥇

[Widcket]

Thanks @ptpavankumar for the guidance here.