fixed issues namely reveloved around chat

frontend/src/lib/server/migrate.ts

@@ -106,27 +106,30 @@ async function ensureUsers(ids: Record<string, string>): Promise<void> {
     changed = true;
   }
 
-  const listRule = "famId = @request.auth.famId";
-  const parentWrite = "famId = @request.auth.famId && @request.auth.role = 'parent'";
-  if (usersCol.listRule !== listRule || usersCol.viewRule !== listRule ||
-      usersCol.updateRule !== parentWrite || usersCol.deleteRule !== parentWrite) {
-    changed = true;
-  }
+	const listRule = "famId = @request.auth.famId";
+	const parentWrite = "famId = @request.auth.famId && @request.auth.role = 'parent'";
+	// Members can edit their own record (name/colour); parents can edit any
+	// family member. Delete stays parent-only.
+	const selfOrParentWrite = "@request.auth.id = id || (famId = @request.auth.famId && @request.auth.role = 'parent')";
+	if (usersCol.listRule !== listRule || usersCol.viewRule !== listRule ||
+	    usersCol.updateRule !== selfOrParentWrite || usersCol.deleteRule !== parentWrite) {
+		changed = true;
+	}
 
-  if (changed) {
-    await updateCollection(usersCol.id, {
-      name: "users",
-      type: "auth",
-      listRule,
-      viewRule: listRule,
-      createRule: usersCol.createRule || "",
-      updateRule: parentWrite,
-      deleteRule: parentWrite,
-      fields: usersCol.fields,
-      indexes,
-      passwordAuth: { enabled: true, identityFields },
-    });
-  }
+	if (changed) {
+		await updateCollection(usersCol.id, {
+			name: "users",
+			type: "auth",
+			listRule,
+			viewRule: listRule,
+			createRule: usersCol.createRule || "",
+			updateRule: selfOrParentWrite,
+			deleteRule: parentWrite,
+			fields: usersCol.fields,
+			indexes,
+			passwordAuth: { enabled: true, identityFields },
+		});
+	}
 }
 
 // Superuser-only OTP store for the child join gate. Holds the rotating code and