[sevgibson]

Why

Resource#save always PUTs to {collection}/{id}.json — the users endpoint, which is account-admin-gated on p.core. So there was no way to write the singular self-service profile.json (Api::V3::ProfilesController), where a user updates their own record (including work_phone/mobile_number) without admin rights.

This unblocks p.int's Pipeline Phone work_phone sync (DP-206): it sets a provisioned user's work_phone as that user themselves.

What

A typed Pipeline::Profile resource, following the gem's existing inheritance (same shape as Pipeline::Import — a Resource subclass in its own file):

• pipeline.profile accessor mirrors the existing user/account singular accessors (loads profile.json).
• Pipeline::Profile#save overrides only what differs from Resource#save: the endpoint (profile.json, not profiles/:id) and the body key (:user, since ProfilesController#update reads params[:user]). Attributes + dirty-tracking are inherited, so save still sends only changed keys.

p = pipeline.profile          # GET /api/v3/profile.json (the authed user)
p.work_phone = "+15551234567"
p.save                        # PUT /api/v3/profile.json → { user: { work_phone } }

Version bump 1.0.11 → 1.0.12.

Tests

spec/pipeline/profile_spec.rb — loads from profile.json, saves changed attributes back under the :user key, and raises the mapped exception (403 → PermissionDeniedError) on refusal. WebMock, mirroring the existing endpoint spec style.

Consumers

p.int will bump to this revision and change sync_user_work_phone to pipeline_api_for_user(user_id).profile → set work_phone → save, guarding against the no-token fallback (which would otherwise write the admin's own profile).

🤖 Generated with Claude Code

[sevgibson]

@claude Please review this PR.