Profile and account (backlog)

Profile and account — backlog

Follow-up work for user profile, authentication, and account settings beyond the v1 initials avatar, email/password auth, and development-time profile editing.

Cross-links: Identity and Access, Onboarding, Files and Uploads, Security and Privacy.

Avatar image upload

Goal: Let users upload a profile photo; store a file reference on the user record and show it in the nav and profile header (replacing or supplementing computed initials).

v1 gap: v1 uses server-computed avatarInitials and avatarColor only — no users.avatar_path column or upload UI.

Dependencies:

• Presigned upload flow (Files and Uploads)
• Migration: users.avatar_path (or equivalent file ID)
• GraphQL: optional avatarUrl on User; mutation or upload-then-attach flow
• UI: profile section for image pick/crop; UserAvatar prefers image when present

Links: Files and Uploads, profile UI in ui/src/pages/profile/.

Email verification

Status: Shipped — confirmation mail before account creation for email/password signup; verification mail on email change for existing accounts; resendVerificationEmail, profile banner, and @ensureVerifiedEmail gating.

Remaining polish (if any): tighten which features require verification beyond current gates.

Links: Identity and Access — Authentication, Onboarding.

OAuth — Google (shipped)

Status: Google Sign-In on web (Socialite redirect + Sanctum cookies) and mobile login (Android Credential Manager and iOS GoogleSignIn SDK → loginWithGoogle bearer). Login does not create users; register is web-only. Profile link/unlink, OAuth-only accounts (nullable password), set password, and email-confirmed account deletion.

Operator setup: Google OAuth.

OAuth — Apple (shipped)

Status: Sign in with Apple on web (Socialite) and via loginWithApple / registerWithApple GraphQL. Mobile login on iOS uses AuthenticationServices → loginWithApple. Apple private relay is a valid registration email. Profile link/unlink with shared OAuth rules. Mobile registration is not implemented.

Operator setup: Apple OAuth.

OAuth — Facebook (shipped)

Status: Facebook Login on web and via loginWithFacebook / registerWithFacebook. Mobile login on Android and iOS sends an access token to loginWithFacebook. Missing/unverified email collects a confirmed address on web register finish. Meta data-deletion callback endpoint included. Mobile registration is not implemented.

Operator setup: Facebook OAuth.

Two-factor authentication

Status: Shipped — TOTP enrollment on Profile, recovery codes, optional WebAuthn passkeys/security keys, password-login MFA challenge, required admin session step-up, MFA gate when creating curriculum/MCP API tokens.

Remaining polish:

• Mobile: TOTP/recovery on password login (shipped); WebAuthn on mobile not in v1.
• Operator docs for WebAuthn RP ID / origins in production (MFA_WEBAUTHN_* env vars).

Links: Security and Privacy, Identity and Access — MFA.

Profile field edit policy

Goal: After development, restrict which profile fields users may self-edit; spiritual phase changes via reassessment/mentor flows, not free self-service.

v1 gap (development): config/profile.php editable_fields includes all onboarding fields (including spiritualPhase and dateOfBirth) so testers can iterate without re-onboarding. The profile page shows a dev notice (profile.devEditableNotice).

Production direction:

Field	Dev (current)	Later
name, email	Editable	Editable (email + verification when backlog ships)
personalityFocus, learningStyle, studyMotivation	Editable	TBD — likely editable with limits
spiritualPhase	Editable	Not freely editable; phase promotion via dedicated flow
dateOfBirth	Editable	Likely read-only after onboarding

Dependencies:

• Shrink api/config/profile.php editable_fields
• UI: OnboardingProfileFields readOnlyFields driven from shared constants
• Phase promotion UX per Study Methods and mentor flows
• Mentor/church override (phase_source) when mentorship ships

Links: Identity and Access — Spiritual phase, Study Methods, api/config/profile.php.