Add session-bound personal profile editing

2026-09-05 02:37:38 -04:00
parent 7c68a3499a
commit a16283efd7
12 changed files with 499 additions and 8 deletions
@@ -8,6 +8,18 @@ application concern belongs in the shared module.

 ## Gamertan accounts and commerce

+- Personal identity editing is not instance administration. `OwnProfileRepository`
+  derives self-access from the active session; `ProfileEdit` is a trusted internal
+  command, never a browser request model. SQLite schema 11 adds a monotonic
+  revision because timestamps alone cannot distinguish two edits in one second.
+  Session/account/revision checks, mutation and audit share one write transaction.
+  Username edits invalidate other sessions without changing immutable IDs,
+  memberships, credentials, orders or provider billing identities. A password
+  proof binds the verified hash into that transaction; passkey proofs must bind
+  the exact user/session/field/value/revision before calling it. The application
+  chooses account-specific reauthentication and owns its credential-work limits.
+  Email requires a separate verified change protocol, not another accepted field.
+
 - Instance operators need all-user/all-organization directories, not a staff
  roster or implicit membership in every business. Optional bounded readers now
  expose identity/profile records without credentials, independent of membership.
@@ -47,8 +59,8 @@ application concern belongs in the shared module.
  policy; there is no new database schema or commerce dependency in Foundations.

 - The account email remains required and unique. Gamertan uses normalized
-  email as the canonical login identifier and keeps username as a stable public
-  identity. Until a mail package exists, the application must not describe an
+  email as the canonical login identifier; the immutable user ID, not the editable
+  username, owns account relationships. Until a mail package exists, it must not describe an
  address as verified merely because it was entered during registration.
 - Password authentication is sufficient for an ordinary customer base
  session. Privileged application actions use an exact operation binding with