Skip to content

[Fix] Profile offers email changes without verification delivery - #3699

Open
roomote-roomote[bot] wants to merge 2 commits into
developfrom
fix/profile-email-capability-1112
Open

roomote-roomote[bot] wants to merge 2 commits into
developfrom
fix/profile-email-capability-1112

Conversation

@roomote-roomote

@roomote-roomote roomote-roomote Bot commented Nov 12, 2026 •

Copy link
Copy Markdown
Contributor

​Opened on behalf of Daniel Riccio. Follow up by mentioning @roomote-roomote, in the web UI, or in Telegram.

Related issue

Internal settings-journey correctness work; no separate issue.

Why this PR exists

  • A maintainer explicitly invited this PR in the linked issue or discussion
  • I am a maintainer / this is internal Roomote work

What changed

The Personal profile editor offered email changes even when the deployment's email channel was disabled. Saving an otherwise valid new email always failed with “Verification email isn't enabled.” The existing account-capabilities query now supplies email-change availability; unavailable email stays readable and selectable with a compact explanation while name editing remains usable. Enabled email editing follows the existing verification path.

The change propagates one boolean through the existing route/page and guards email submission. No new API endpoint, state machine, dependency, schema, configuration option or verification bypass. Capability loading/failure defaults to read-only email. Disabling capability during an edit shows the saved address and prevents submitting its old draft. Public Personal settings documentation explains the verification prerequisite. The separate open profile display-layout fix #3631 remains independent.

How it was tested

  • Current develop 73fc55cc7: actual dev-login → Personal → Edit → synthetic new email → Save reproduces the verification-disabled failure, before any message delivery or account change.
  • Head cd3e570ef7c326f59bdb531bdd232d1e037e972c: 16 focused profile/page/route/server-capability tests pass again; the only follow-up is five lines of public prerequisite documentation. Mintlify build validation/broken links, rendered docs preview, formatting/diff and normal precommit/pre-push gates pass. Renewed exact-head hosted tests, app build, static/security/docs/deployment/upgrade/backup gates and automated re-review are clean; no unresolved threads. Normal human-review/protection gates remain.
  • Real local desktop1440×1000/mobile390×844 interactions exercised read-only email, successful name save/restoration and Cancel. Enabled-channel email requests traversed actual UI/auth/PostgreSQL/SDK into the checked-in disposable AgentMail harness; one verification message per submission to a synthetic address, zero inbound emails/webhooks and no live-provider delivery. Account email remained unchanged pending verification. The exact committed diff matches the inspected capture snapshot byte-for-byte after hooks.
  • Fresh disabled-state desktop/mobile and docs screenshots were opened and independently checked. Original enabled-state screenshots are explicitly retained: all apps/web blobs are unchanged by the documentation follow-up, and the renewed full diff matches its capture snapshot after hooks. Images prove layout/state only, not save success, read-only semantics, timing, persistence, authorization, software keyboards, all themes/widths or real delivery. Supporting interactions and database assertions establish the narrower behavior claims. Verification-link completion and misconfigured/suppressed sender recovery are unchanged and outside this fix.

Screenshots

Actual local unavailable-email editor; name editing remains usable:
Desktop unavailable email
Mobile unavailable email

Retained original enabled-channel editor with synthetic email and disposable mock-provider routing; unchanged application source, not recaptured for the docs-only follow-up. These frames do not show completed verification:
Mobile enabled email
Desktop enabled email

Actual Mintlify preview of the prerequisite:
Profile email prerequisite documentation

Related PRs

Checklist

  • The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
  • This PR is small and scoped to one change
  • pnpm lint and pnpm check-types pass locally (normal broad fast equivalents passed)
  • I added tests or included a clear manual validation note above
  • I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
  • If this change should appear in the changelog, I ran pnpm changeset (bounded correction to existing settings)

@roomote-community

roomote-community Bot commented Nov 12, 2026 •

Copy link
Copy Markdown
Contributor

No new code issues found. See session

Reviewed the five-line documentation update in apps/docs/personal-settings.mdx against the profile editor and verification configuration. It accurately describes read-only email, continued name editing, and verification before an address change takes effect. The prior clean application review remains applicable; no application files changed since that review and no review threads are outstanding.

Current-head docs validation, tests, lint, types, and Knip passed. App Docker build and JavaScript/TypeScript security analysis were still running when checked. No local validation suites were run.

Reviewed cd3e570

@roomote-roomote
roomote-roomote Bot marked this pull request as ready for review November 12, 2026 05:26
@roomote-roomote
roomote-roomote Bot marked this pull request as draft November 12, 2026 05:59
@roomote-roomote
roomote-roomote Bot marked this pull request as ready for review November 12, 2026 06:11

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant