Sayali: add updateYearsOfExperience endpoint with validation and upsert

[sayali-2308]

Description

Fixes # (Medium Priority) Task #20 — HGN Questionnaire Dashboard - User Profile Page – Fix Years of Experience Display Without Input Source
This backend PR adds a new PUT endpoint to save and retrieve Years of Experience for a user's skills profile.

Related PRS (if any):

This backend PR is related to frontend OneCommunityGlobal/HighestGoodNetworkApp#4874
To test this backend PR you need to checkout frontend OneCommunityGlobal/HighestGoodNetworkApp#4874
…

Main changes explained:

Updated userSkillsProfileController.js to add updateYearsOfExperience function with permission check, input validation, and upsert logic
Updated userSkillsProfileRouter.js to add PUT /skills/profile/updateYearsOfExperience/:userId route
…

How to test:

1. Checkout branch Sayali_Fix_Years_Of_Experience_Display on both frontend and backend
2. Backend: run npm install then npm run build then npm run start
3. Frontend: checkout Sayali: Fix Years of Experience display and edit functionality HighestGoodNetworkApp#4874 and run npm install then npm run start:local
4. Clear site data/cache
5. Log in as admin user
6. Go to your own profile http://localhost:5173/hgn/profile/skills/<your_user_id>
7. Click Edit, enter a valid number, click Save — verify success
8. Hard refresh — verify value persists
9. Click Edit, enter -1 or 1.5 — verify error toast
10. Go to another user's profile — verify Edit button is hidden

Screenshots or videos of changes:

Same screenshots as frontend PR

Note:

• updateYearsOfExperience uses upsert: true so it creates a skills profile document if one doesn't exist
• Permission check allows only the logged-in user to update their own profile unless they have updateUserSkillsProfileFollowUp admin permission

[nathanah]

The rest looks good.

[nathanah]

Suggested change

	const hasAccess = await hasPermission(req.body.requestor, 'updateUserSkillsProfileFollowUp');
	if (!hasAccess && req.body.requestor.requestorId !== req.params.userId) {
	const hasAccess = req.body.requestor.requestorId === req.params.userId || await hasPermission(req.body.requestor, 'updateUserSkillsProfileFollowUp');
	if (!hasAccess) {

Can do this to potentially short circuit eval and skip the await.

[sayali-2308]

Hi @nathanah,
Thank you for the suggestion! I've applied the short circuit evaluation fix in updateYearsOfExperience:
const hasAccess = req.body.requestor.requestorId === req.params.userId || await hasPermission(req.body.requestor, 'updateUserSkillsProfileFollowUp');
if (!hasAccess) {
Changes have been pushed to the branch. Please re-review when you get a chance!
Thanks

[Anusha-Gali]

Hi Sayali,

I have reviewed your PR locally and it works as per requirement.

[nathanah]

LGTM

[HemanthNidamanuru]

Hi Sayali,

I have tested this locally and everything is working as per requirement.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[one-community]

Thank you all, merging!