Repository navigation
[Fix] Profile offers email changes without verification delivery - #3699
Open
roomote-roomote[bot] wants to merge 2 commits into
Open
roomote-roomote[bot] wants to merge 2 commits into
roomote-roomote[bot] wants to merge 2 commits into
Conversation
Contributor
|
No new code issues found. See session Reviewed the five-line documentation update in Current-head docs validation, tests, lint, types, and Knip passed. App Docker build and JavaScript/TypeScript security analysis were still running when checked. No local validation suites were run. Reviewed cd3e570 |
roomote-roomote
Bot
requested review from
brunobergher,
daniel-lxs and
mrubens
as code owners
November 12, 2026 05:26
5 of 8 tasks
5 of 8 tasks
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue
Internal settings-journey correctness work; no separate issue.
Why this PR exists
What changed
The Personal profile editor offered email changes even when the deployment's email channel was disabled. Saving an otherwise valid new email always failed with “Verification email isn't enabled.” The existing account-capabilities query now supplies email-change availability; unavailable email stays readable and selectable with a compact explanation while name editing remains usable. Enabled email editing follows the existing verification path.
The change propagates one boolean through the existing route/page and guards email submission. No new API endpoint, state machine, dependency, schema, configuration option or verification bypass. Capability loading/failure defaults to read-only email. Disabling capability during an edit shows the saved address and prevents submitting its old draft. Public Personal settings documentation explains the verification prerequisite. The separate open profile display-layout fix #3631 remains independent.
How it was tested
73fc55cc7: actual dev-login → Personal → Edit → synthetic new email → Save reproduces the verification-disabled failure, before any message delivery or account change.cd3e570ef7c326f59bdb531bdd232d1e037e972c: 16 focused profile/page/route/server-capability tests pass again; the only follow-up is five lines of public prerequisite documentation. Mintlify build validation/broken links, rendered docs preview, formatting/diff and normal precommit/pre-push gates pass. Renewed exact-head hosted tests, app build, static/security/docs/deployment/upgrade/backup gates and automated re-review are clean; no unresolved threads. Normal human-review/protection gates remain.apps/webblobs are unchanged by the documentation follow-up, and the renewed full diff matches its capture snapshot after hooks. Images prove layout/state only, not save success, read-only semantics, timing, persistence, authorization, software keyboards, all themes/widths or real delivery. Supporting interactions and database assertions establish the narrower behavior claims. Verification-link completion and misconfigured/suppressed sender recovery are unchanged and outside this fix.Screenshots
Actual local unavailable-email editor; name editing remains usable:


Retained original enabled-channel editor with synthetic email and disposable mock-provider routing; unchanged application source, not recaptured for the docs-only follow-up. These frames do not show completed verification:


Actual Mintlify preview of the prerequisite:

Related PRs
Checklist
[Fix],[Feat],[Improve],[Refactor],[Docs], or[Chore]followed by a user-facing descriptionpnpm lintandpnpm check-typespass locally (normal broad fast equivalents passed)pnpm changeset(bounded correction to existing settings)