studio-engine 0.48.0 → 0.50.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa8ab90a0e1627e7150ed1e96a348bae677c3dc35891ccd2a46f99d857cd74d1
-  data.tar.gz: e2a354a9d1d0533a78c63cb19233ae387a4c71f747cd5bf4570fe8d2478979de
+  metadata.gz: e29528d33a9e256697398f86592a44caa7631acee8034148bd1eb3d5c5a877ec
+  data.tar.gz: 62d6f242a0d5f147d99ef0fa378d0f79ec0b11b84af51928ae3a4fddbc5d4862
 SHA512:
-  metadata.gz: d7def604f1a4c19da8241953cee4bfa8e8047af2a2ae0e0113628aeed9f5d59ab5fa16bfe667e89687144f0f0afb5117e1bcd1f4747ab69db9c5b892e142c820
-  data.tar.gz: 7424031597c4168ac6a8172360b7dbc2ee584f0ddc5ac205a155fd11343f7e8f91002a40d3b0865eef0218096234aeaf1617ff2133677aa1e51c9b73d91a8cf3
+  metadata.gz: 359a84187b7b63daba90c5ee89e5dc25c52291b922e05ad6e991d1bc0da141b58e096b8a1ceb0b293c19faf0e35dd272bdd5c31b0e3dc2358dda82876e526c7d
+  data.tar.gz: d22644b76b30889cd712c02a188b63d0d7287ed368c40c27a797afc48058eca1cd4e97a60dc1e38e2321f31e4cab95acb5029112420f4a0f1953c1ae53362ed5

data/CHANGELOG.md

@@ -4,6 +4,41 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ## Unreleased
 
+### Added
+
+- **The link sidebar leads with a Profile link, shipped by the engine.** The
+  engine ships `/profile`, so it now ships the way in rather than asking five
+  apps to declare the same entry and watching them drift in wording and emoji.
+  `Studio::SidebarSections.resolve` prepends a `You` section; a host's own
+  sections follow in their declared order.
+
+  Two gates, both load-bearing:
+
+  - **`Studio.draw_profile_routes`** — an app that turned the page off must not
+    be handed a menu item pointing at a route that does not exist.
+  - **signed in** — `/profile` requires authentication, so offering it to a
+    signed-out visitor bounces them to login from something that looked like
+    navigation. Same shape as the existing `admin:` rule.
+
+  **WHO ACTUALLY RECEIVES THIS — check before assuming your app does.** The
+  trigger renders from `layouts/_navbar`, and two consumers fork that partial:
+
+  | Consumer | Effect |
+  |---|---|
+  | mcritchie-studio | Profile link added to the top of its existing sidebar |
+  | mcritchie-industries | same |
+  | acquisition-studio | **gains a sidebar it did not have** — it declared no sections, and now has one |
+  | turf-monster, moms-app | **no change** — both fork `layouts/_navbar` and render no sidebar trigger, so a bump does not deliver this |
+
+  That last row is the standing rule in this engine: a host view shadows the
+  engine's, so a partial change reaches only the apps that still render the
+  engine's copy.
+
+  **`studio_sidebar?` is now true in any signed-in app** that renders the engine
+  navbar, where it previously depended on the host declaring something. That is
+  the intended consequence — the sidebar always has at least the viewer's own
+  profile in it — but it is a visible change to a navbar every consumer inherits.
+
 ### Fixed
 
 - **`Studio.profile_sections`' `if:` gate no longer fails open on a Symbol.**
@@ -17,6 +52,65 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Added
 
+- **`/profile` splits into a read page and an edit page.** `/profile` is now "you
+  at a glance" — the identity header, and the rows you look at rather than type
+  into. `/profile/edit` (`edit_profile_path`) holds the fields, in ONE form with
+  ONE save.
+
+  A section declares which page it belongs to with **`page:`** — `:show` or
+  `:edit`. A row that says nothing defaults to `:edit`, because someone adding a
+  row is usually adding a field, and the read page is a curated surface. Existing
+  hosts need no change: `Studio.profile_sections_for(view)` without a `page:`
+  still returns every row.
+
+  **The identity header** (avatar, display name, address) renders on both pages
+  and is where the avatar now lives — it stopped being a row when it stopped
+  looking like one. On the read page the whole card is the link through to
+  editing, and its badge glyph fades in on hover; on the edit page the badge is a
+  button that opens the cropper.
+
+  **The save bar is sticky**, so it never depends on where the reader is in the
+  scroll, and it stays out of the way until a field is actually dirty. Without
+  JavaScript it renders as a plain always-visible submit — the form still saves.
+
+  **The header morphs on scroll.** Once the card leaves the viewport a compact
+  bar takes its place beneath the navbar, matched to the card's own width, so who
+  you are stays on screen down a long page. It is `aria-hidden` and
+  non-interactive: it duplicates what is already in the document rather than
+  adding a second copy for a screen reader to read out. Honors
+  `prefers-reduced-motion`.
+
+- **`/profile` gains the Email field — changeable from any signed-in session.**
+  It saves with the rest of the edit form through `PATCH /profile`.
+
+  **THE GOOGLE EXCEPTION.** An account with a linked Google identity **cannot**
+  change its email: Google is the authoritative source for that address, and
+  letting the two drift means the next OAuth sign-in either re-links to a
+  stranger's row or cannot find its own. The locked branch renders **no input at
+  all** — it shows the address, the reason, and a link to the read page where the
+  unlink control lives. The server refuses the change independently of what the
+  page drew, because anyone can POST.
+
+  **What a direct change trades away, stated so nobody rediscovers it:** a
+  hijacked session can move the account to another inbox, and the old address has
+  no veto. Two protections are kept precisely BECAUSE the veto is gone —
+
+  - the **old address is mailed** after every change (OPSEC-046), so a change
+    nobody made is visible to the person losing the account, and
+  - **every other session is invalidated** (OPSEC-045), so a hijacker holding a
+    second cookie loses it the moment the address moves. The session that made
+    the change is re-established, so the person doing it is not signed out.
+
+- **`Studio::ProfileMailer`** with `email_change_notification`, plus a new
+  standard `Studio::EmailCatalog` entry so its copy, subject and banner are
+  operator-editable on `/admin/emails` like every other Studio email. **Namespaced deliberately:**
+  `app/mailers` is an autoload path and this engine is not isolated, so a host's
+  top-level `UserMailer` shadows the engine's — mcritchie-studio's fork defines no
+  `email_change_notification` at all (a bare call raises `NoMethodError`), and
+  turf-monster's defines one with the SAME signature — so there the call would
+  not raise, it would quietly send TURF's copy, banner and `account_url` instead
+  of the engine's. The silent case is the dangerous one.
+
 - **`/profile` gains the Google account row.** Shows the linked identity with an
   Unlink control, or a branded Connect button that POSTs to OmniAuth's own
   `/auth/google_oauth2` (the engine does not draw a link route — the middleware

data/app/controllers/studio/profiles_controller.rb

@@ -33,73 +33,81 @@ module Studio
     MAX_FIRST_NAME = Studio::FIRST_NAME_MAX_LENGTH
 
     def show
-      @profile_sections = Studio.profile_sections_for(view_context)
+      @profile_sections = Studio.profile_sections_for(view_context, page: :show)
     end
 
-    # PATCH /profile — the scalar fields. Today that is the first name.
+    # GET /profile/edit — the form. Read and edit are separate pages (operator's
+    # call, 2026-08-14): /profile is "you at a glance", this is where you change
+    # things.
+    def edit
+      @profile_sections = Studio.profile_sections_for(view_context, page: :edit)
+    end
+
+    # PATCH /profile — every editable field, in one request.
+    #
+    # ONE FORM, ONE SAVE (operator's call). Email used to be its own action, and
+    # needed to be only while it was out-of-band; now that it applies directly
+    # there is no reason for a second mechanism on the same page. Its side
+    # effects stay here rather than moving into the form.
+    #
+    # Each field is applied only if its ROW would render — the same resolver the
+    # page uses — so a host that cannot serve a field cannot have one posted into
+    # it either.
     def update
-      return unsupported(:first_name) unless serves?(:first_name)
+      attrs = {}
+      attrs.merge!(name_attributes)     if row_rendered?(:name)
+      attrs.merge!(birthday_attributes) if row_rendered?(:birthday)
 
-      value = normalized_first_name
+      # May redirect (the Google lock); if it did, we are done.
+      prepare_email_change(attrs) if row_rendered?(:email)
+      return if performed?
 
-      if value.blank?
-        return redirect_to profile_path, alert: "Enter your first name.", status: :see_other
+      if attrs.empty?
+        return redirect_to edit_profile_path, alert: "Nothing to save.", status: :see_other
       end
 
+      previous_email = current_user.email.to_s if current_user.respond_to?(:email)
+
       rescue_and_log(target: current_user) do
-        attrs = { first_name: value }
-        # Backfill `name` when it is blank so the display-name chain has
-        # something better than an email prefix to show. Same rule as the
-        # onboarding step, which writes this column from the other direction.
-        attrs[:name] = value if current_user.respond_to?(:name) && current_user.name.blank?
-
-        if current_user.update(attrs)
-          # Read back rather than trusting the write. A host whose before_save
-          # DERIVES first_name from name (turf-monster's set_name_parts does
-          # exactly that) would silently discard the value, and a flash saying
-          # "Saved" over a discarded write is worse than a plain failure.
-          # Reporting what actually persisted keeps the page honest on a host the
-          # engine has not met yet.
-          persisted = current_user.reload.first_name.to_s
-
-          if persisted == value
-            redirect_to profile_path, notice: "Name updated."
-          else
-            redirect_to profile_path,
-                        alert: "This app derives your name from another field — it saved as #{persisted.presence || "blank"}.",
-                        status: :see_other
-          end
-        else
-          redirect_to profile_path,
-                      alert: current_user.errors.full_messages.to_sentence.presence || "Could not save that name.",
-                      status: :see_other
+        unless current_user.update(attrs)
+          next redirect_to edit_profile_path, status: :see_other,
+                           alert: current_user.errors.full_messages.to_sentence.presence ||
+                                  "Could not save those changes."
         end
+
+        after_email_change(previous_email) if attrs.key?(:email)
+
+        redirect_to profile_path, notice: "Profile updated."
       end
     end
 
     # PATCH /profile/avatar — the picture, on its own route.
     #
     # SEPARATE FROM #update deliberately: an attachment param submitted empty
-    # PURGES the attachment, so a combined form that carried both would delete
-    # someone's avatar every time they edited their name. turf-monster learned
-    # this and branched inside its own #update; a separate route is the same
-    # lesson expressed so the trap cannot be reintroduced.
+    # PURGES the attachment, so a combined form carrying both would delete
+    # someone's photo every time they saved a name. A separate route makes that
+    # unreachable rather than merely avoided.
+    #
+    # GUARDED DIFFERENTLY FROM THE FIELD ROWS, and the difference is real: the
+    # avatar stopped being a row when it moved into the identity header, so
+    # "would its row render?" has no answer for it. The MODEL gate is the right
+    # question here — can this host's user hold an attachment at all.
     def avatar
-      return unsupported(:avatar) unless serves?(:avatar)
+      return unsupported("profile photo") unless avatar_supported?
 
       file = params.dig(:profile, :avatar)
 
       if file.blank?
-        return redirect_to profile_path, alert: "Choose an image first.", status: :see_other
+        return redirect_to edit_profile_path, alert: "Choose an image first.", status: :see_other
       end
 
       unless Studio::ProfileImage.acceptable?(file)
-        return redirect_to profile_path, alert: Studio::ProfileImage::MESSAGE, status: :see_other
+        return redirect_to edit_profile_path, alert: Studio::ProfileImage::MESSAGE, status: :see_other
       end
 
       rescue_and_log(target: current_user) do
         current_user.avatar.attach(file)
-        redirect_to profile_path, notice: "Photo updated."
+        redirect_to edit_profile_path, notice: "Photo updated."
       end
     end
 
@@ -116,7 +124,7 @@ module Studio
     # column: an app with an email column that does not offer magic-link sign-in
     # cannot use it to get back in.
     def unlink_google
-      return unsupported(:google_account) unless serves?(:provider) && serves?(:uid)
+      return unsupported("Google account") unless row_rendered?(:google)
 
       unless Studio::OauthIdentity.google_linked?(current_user)
         return redirect_to profile_path, alert: "No Google account is linked.", status: :see_other
@@ -136,35 +144,147 @@ module Studio
 
     private
 
-    # Can this host's user model serve this field?
+    # Would the page render this row for this viewer?
     #
-    # A HIDDEN ROW IS NOT A GUARD. Studio::ProfileSections drops a row the host
+    # A HIDDEN ROW IS NOT A GUARD. Studio::ProfileSections drops a row this host
     # cannot serve, so nobody SEES a first-name form in an app without the
     # column — but the endpoint stays open to anyone who posts to it, and
     # rescue_and_log RE-RAISES, so an unguarded write is a 500 plus an ErrorLog
-    # row. That is not hypothetical: three of the five consumers
-    # (mcritchie-industries, moms-app, acquisition-studio) have an avatar
-    # attachment and no first_name column right now.
+    # row. Three of the five consumers have an avatar attachment and no
+    # first_name column right now.
     #
-    # The endpoint asks the SAME question the row does, through the SAME method,
-    # so the two cannot drift into disagreeing about what this app supports.
-    def serves?(attribute)
-      Studio::ProfileSections.served_by?(current_user, attribute)
+    # ASKED OF THE RESOLVER, not of one of its rules — and that distinction was a
+    # real bug, caught in review. This used to call served_by?, which answers only
+    # the MODEL gate (`requires:`). Once rows also carried an APP gate (`if:`),
+    # the two questions came apart: mcritchie-industries drops the Google row
+    # because it offers no Google sign-in, while the endpoint — asking only about
+    # columns it does have — stayed open. The comment here claimed they "cannot
+    # drift" while they were already drifting.
+    #
+    # Asking the resolver makes that true rather than asserted: the page and the
+    # endpoint run the same code and get the same answer, whatever gates a row
+    # grows next.
+    def row_rendered?(key)
+      profile_rows.any? { |section| section[:key] == key.to_sym }
+    end
+
+    # The avatar is not a row, so it asks the MODEL gate directly — see #avatar.
+    def avatar_supported?
+      Studio::ProfileSections.served_by?(current_user, :avatar)
+    end
+
+    # Memoized per request: a host's `if:` may be a lambda doing real work, and a
+    # write should not pay for it more than once.
+    def profile_rows
+      @profile_rows ||= Studio.profile_sections_for(view_context)
     end
 
     # Land the person back on a page that works rather than on a bare 404. This
     # is unreachable through the UI — the row that posts here is not rendered —
     # so the wording is for whoever is poking at the endpoint directly.
-    def unsupported(attribute)
+    def unsupported(label)
       redirect_to profile_path,
-                  alert: "This app has no #{attribute.to_s.tr("_", " ")} to change.",
+                  alert: "This app has no #{label} to change.",
                   status: :see_other
     end
 
+    # --- field assembly ---------------------------------------------------------
+
+    def name_attributes
+      attrs = {}
+      first = normalized_name(params.dig(:profile, :first_name))
+      attrs[:first_name] = first if first.present?
+
+      if current_user.respond_to?(:last_name)
+        last = normalized_name(params.dig(:profile, :last_name))
+        attrs[:last_name] = last if last.present?
+      end
+
+      # Backfill `name` when it is blank so the display-name chain has something
+      # better than an email prefix to show. Same rule as the onboarding step.
+      if attrs[:first_name].present? && current_user.respond_to?(:name) && current_user.name.blank?
+        attrs[:name] = [attrs[:first_name], attrs[:last_name]].compact_blank.join(" ")
+      end
+
+      attrs
+    end
+
+    # ONE date input, THREE integer columns. The split is deliberate upstream —
+    # it keeps "how old are they" and "whose birthday is today" both cheap — so
+    # the form joins them and this takes them apart again.
+    #
+    # A blank date CLEARS all three rather than being ignored: someone deleting
+    # their birthday means it, and leaving a stale year behind would be the
+    # wrong answer to both questions above.
+    def birthday_attributes
+      raw = params.dig(:profile, :birthday)
+      return {} if raw.nil?
+
+      if raw.to_s.strip.blank?
+        return { birth_year: nil, birth_month: nil, birth_day: nil }
+      end
+
+      date = begin
+        Date.iso8601(raw.to_s)
+      rescue ArgumentError, TypeError
+        nil
+      end
+      return {} if date.nil? || date > Date.current
+
+      { birth_year: date.year, birth_month: date.month, birth_day: date.day }
+    end
+
+    # Adds :email to attrs, or REDIRECTS when the change must be refused — the
+    # caller checks performed? rather than a return value.
+    def prepare_email_change(attrs)
+      value = params.dig(:profile, :email).to_s.strip
+      return nil if value.blank?
+      return nil if value.casecmp?(current_user.email.to_s)
+
+      # THE GOOGLE EXCEPTION. Google is the authoritative source for a linked
+      # account's address; letting the two drift means the next OAuth sign-in
+      # either re-links to a stranger's row or cannot find its own. The field is
+      # locked in the row and refused here — a disabled input is a courtesy, and
+      # anyone can POST.
+      if Studio::OauthIdentity.google_linked?(current_user)
+        redirect_to edit_profile_path, status: :see_other,
+                    alert: "Your email comes from your linked Google account. " \
+                           "Unlink Google on your profile first if you want to change it."
+        return
+      end
+
+      attrs[:email] = value
+      nil
+    end
+
+    # The two protections kept BECAUSE a direct change leaves the old address no
+    # veto: tell it, and invalidate every other session.
+    def after_email_change(previous_email)
+      current_user.update_columns(email_verified_at: nil) if current_user.respond_to?(:email_verified_at)
+
+      # ROTATE FIRST, MAIL SECOND. Studio::Email.deliver can raise, and a mail
+      # failure between the write and the rotation would leave the address
+      # changed with every other session still live — the exact window OPSEC-045
+      # exists to close, so it closes before anything that can throw.
+      # turf-monster's own apply_email_change rotates first for the same reason.
+      if current_user.respond_to?(:regenerate_session_token!)
+        current_user.regenerate_session_token!
+        # Re-establish THIS session. Rotating without it signs out the very
+        # person who just made the change.
+        session[:session_token] = current_user.session_token if current_user.respond_to?(:session_token)
+      end
+
+      return if previous_email.blank?
+
+      Studio::Email.deliver(Studio::ProfileMailer, :email_change_notification,
+                            current_user, previous_email, current_user.email,
+                            to: previous_email, user: current_user)
+    end
+
     # Collapse runs of whitespace and cap the length. Done here rather than in a
     # model validation because the engine does not own the host's User class.
-    def normalized_first_name
-      params.dig(:profile, :first_name).to_s.strip.gsub(/\s+/, " ")[0, MAX_FIRST_NAME].to_s
+    def normalized_name(raw)
+      raw.to_s.strip.gsub(/\s+/, " ")[0, MAX_FIRST_NAME].to_s
     end
   end
 end

data/app/mailers/studio/profile_mailer.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Studio
+  # The one email an email change sends.
+  #
+  # NAMESPACED, and that is load-bearing rather than tidiness. `app/mailers` is an
+  # autoload path and this engine is not isolated, so a host that defines a
+  # top-level `UserMailer` SHADOWS the engine's outright. Two consumers do:
+  # mcritchie-studio (which defines no email-change actions, so a bare call would
+  # raise NoMethodError) and turf-monster (which defines `email_change_confirmation`
+  # and `email_change_notification` ALREADY, with its own signature and its own
+  # `confirm_email_change_url` pointing at /account). That second case is the
+  # dangerous one: no exception, no warning, and the engine's flow quietly mails a
+  # link to turf's route instead of its own.
+  #
+  # Under `Studio::` nothing shadows it, following Studio::NewsletterMailer.
+  #
+  # ONE EMAIL, and it goes to the address being LEFT:
+  #
+  #   email_change_notification → the OLD address, after the change lands. With
+  #     the change applying directly from any signed-in session, this mail is the
+  #     only thing that makes a change nobody made VISIBLE to the person losing
+  #     the account. That is why it survives and why it is sent even though
+  #     nothing about it is required for the change to work.
+  class ProfileMailer < ApplicationMailer
+    layout "branded_mailer"
+
+    # To the OLD address, after the swap landed.
+    def email_change_notification(user, old_email, new_email)
+      @user      = user
+      @app_name  = Studio.app_name
+      @old_email = old_email
+      @new_email = new_email
+
+      @banner     = Studio::Banner.for(:email_change_notification, name: display_name_for(user))
+      @banner_url = Studio::EmailCatalog.resolved_url(:email_change_notification)
+      @banner_alt = [@banner&.header, "your #{@app_name} email was changed"].compact.join(" — ")
+
+      mail(to: old_email, subject: Studio::EmailCatalog.subject_for(:email_change_notification, name: display_name_for(user)))
+    end
+
+    private
+
+    # The engine's User contract guarantees display_name, but this mailer is also
+    # reachable from a host whose model is mid-migration; a name is a nicety and
+    # must never be the reason an email fails to send.
+    def display_name_for(user)
+      return nil unless user.respond_to?(:display_name)
+
+      user.display_name
+    rescue StandardError
+      nil
+    end
+  end
+end

data/app/services/studio/email_catalog.rb

@@ -193,6 +193,27 @@ module Studio
         # inherited email with no preview is a row on every app's manager that
         # cannot be looked at.
         preview: -> { Studio::NewsletterMailer.subscribed("preview@example.com", name: "Alex") }
+      },
+      {
+        key: "email_change_notification",
+        label: "Email change — heads up",
+        description: "Sent to the OLD address after a change lands, so an unauthorized change is visible rather than silent.",
+        # Reuses the shipped email-change artwork. The asset is named for a
+        # confirmation email that no longer exists; the picture is right for the
+        # subject either way, and renaming a shipped asset is its own migration.
+        default_asset: "emails/email-change-confirmation.gif",
+        header: "Your email was changed",
+        header_fallback: "Your email was changed",
+        subtext: "a heads-up from {app}",
+        subject: "Your {app} email was changed",
+        body: "The email address on your {app} account was just changed. " \
+              "If you did not do this, contact us straight away — this message " \
+              "was sent to your previous address on purpose.",
+        # No button: there is nothing to click. The point is the notice itself.
+        supports_cta: false,
+        preview: lambda {
+          Studio::ProfileMailer.email_change_notification(nil, "old@example.com", "new@example.com")
+        }
       }
     ].freeze
 

data/app/views/studio/profile_mailer/email_change_notification.html.erb

@@ -0,0 +1,30 @@
+<%# Body only — branded_mailer supplies the banner + card.
+
+    NO BUTTON, deliberately: there is nothing to click. This email exists so an
+    unauthorised change is VISIBLE to the person losing the account, and the
+    catalogue entry sets supports_cta: false to match. Adding a CTA here would
+    invite someone to click their way somewhere from a message that may itself
+    be the first sign of a compromise.
+%>
+<%
+  body = @body.presence || Studio::EmailCatalog.body(:email_change_notification)
+%>
+<h1 style="margin:0 0 18px;font-size:22px;line-height:1.3;color:#1f2a1c;">Your email was changed</h1>
+
+<% if body.present? %>
+  <%= simple_format body, { style: "margin:0 0 24px;font-size:16px;line-height:1.6;color:#3f4a3c;" }, sanitize: true %>
+<% end %>
+
+<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" style="margin:0 0 24px;">
+  <tr>
+    <td style="padding:14px 16px;background:#f4f6f3;border-radius:10px;font-size:15px;line-height:1.6;color:#3f4a3c;">
+      <strong style="color:#2f3a2c;">Was:</strong> <%= @old_email %><br>
+      <strong style="color:#2f3a2c;">Now:</strong> <%= @new_email %>
+    </td>
+  </tr>
+</table>
+
+<p style="margin:28px 0 0;font-size:13px;line-height:1.5;color:#6b756a;text-align:center;">
+  This message was sent to <strong style="color:#2f3a2c;"><%= @old_email %></strong> — your previous
+  address — on purpose, so a change you did not make cannot happen quietly.
+</p>

data/app/views/studio/profile_mailer/email_change_notification.text.erb

@@ -0,0 +1,11 @@
+The email address on your <%= @app_name %> account was just changed.
+
+  Was: <%= @old_email %>
+  Now: <%= @new_email %>
+
+If you did not do this, contact us straight away.
+
+This message was sent to <%= @old_email %> — your previous address — on purpose,
+so a change you did not make cannot happen quietly.
+
+— <%= @app_name %>

data/app/views/studio/profiles/_birthday_fields.html.erb

@@ -0,0 +1,31 @@
+<%# Birthday — ONE date input over THREE integer columns.
+
+    Locals: user (required).
+
+    The split is deliberate in the standard-columns migration and worth not
+    undoing: birth_day / birth_month / birth_year keep the two questions apps
+    actually ask cheap and separable — how old is this person (needs the year,
+    and the month and day for the boundary case) and whose birthday is today
+    (needs month and day, and no year at all). A single date column answers the
+    second one badly.
+
+    So the UI joins them and ProfilesController#update splits them again. A
+    native date input is used rather than three selects because a date is one
+    idea to the person entering it, and the browser already knows how to enter
+    one on every platform.
+
+    The row renders only when the host has all three columns, so nothing here
+    re-checks.
+%>
+<%
+  y = user.birth_year
+  m = user.birth_month
+  d = user.birth_day
+  value = (y.present? && m.present? && d.present?) ? format("%04d-%02d-%02d", y, m, d) : nil
+%>
+<label class="block text-sm text-secondary mb-2 font-medium" for="profile_birthday">Date of birth</label>
+<input type="date" name="profile[birthday]" id="profile_birthday"
+       value="<%= value %>" class="input-field"
+       autocomplete="bday" max="<%= Date.current.iso8601 %>"
+       x-model="fields.birthday">
+<p class="text-muted text-xs mt-2">Stored as day, month and year — we use it for birthdays and age checks.</p>

data/app/views/studio/profiles/_editable_identity.html.erb

@@ -0,0 +1,35 @@
+<%# The identity header on the EDIT page, wrapped in the uploader's Alpine scope.
+
+    Locals: user (required).
+
+    ONE COMPONENT, and it has to be: the header's badge button calls
+    `$refs.filePicker`, and Alpine resolves $refs only within the same x-data.
+    Rendering the header and the picker as siblings — which is how this was first
+    written — leaves the badge pointing at a ref that does not exist in its
+    scope, so clicking it does nothing at all. Silently.
+
+    The avatar SAVES ON ITS OWN, outside the field form. An attachment param
+    submitted empty PURGES the attachment, so an avatar input inside the bulk
+    form would delete someone's photo every time they saved a name. Nesting
+    forms is invalid HTML anyway; this sits alongside.
+%>
+<div x-data="imageUploadHost({
+       store: 'profileModals',
+       aspectRatio: 1,
+       filename: 'avatar.png',
+       saving: 'Saving photo…',
+       toast: false
+     })"
+     @crop-photo-confirmed.window="onCropConfirmed($event.detail)">
+
+  <%= render "studio/profiles/identity", user: user, editable: true %>
+
+  <%# Auto-submitted once a crop is confirmed; the person never touches it. %>
+  <%= form_with url: profile_avatar_path, method: :patch, scope: :profile, multipart: true,
+                html: { "x-ref": "form", class: "hidden" } do %>
+    <input type="file" name="profile[avatar]" x-ref="fileInput">
+  <% end %>
+
+  <input type="file" x-ref="filePicker" @change="onFileSelected($event)"
+         accept="<%= Studio::ProfileImage::ALLOWED_CONTENT_TYPES.join(",") %>" class="hidden">
+</div>

data/app/views/studio/profiles/_email_fields.html.erb

@@ -0,0 +1,37 @@
+<%# Email field.
+
+    Locals: user (required).
+
+    LOCKED WHEN GOOGLE IS LINKED, and the message points at /profile — because
+    that is where the unlink lives. The two surfaces work in conjunction: Google
+    is read-level and visible on the read page, and unlinking it there is what
+    frees this field. A lock that does not say where the key is is just a wall.
+
+    Changing this address has consequences the form does not show: the old
+    address is told, and every other session is signed out. The line underneath
+    says so, because a field that quietly logs out your other devices is a
+    surprise worth spending two lines on.
+%>
+<% locked = Studio::OauthIdentity.google_linked?(user) %>
+
+<% if locked %>
+  <p class="text-heading font-semibold mb-2 break-all"><%= user.email %></p>
+  <div class="rounded-lg p-3 flex items-start gap-2" style="background: var(--color-surface-alt);">
+    <span aria-hidden="true">🔒</span>
+    <p class="text-muted text-xs">
+      This comes from your linked Google account.
+      <%= link_to "Unlink Google on your profile", profile_path, class: "text-primary hover:underline" %>
+      to change it.
+    </p>
+  </div>
+<% else %>
+  <input type="email" name="profile[email]" id="profile_email"
+         value="<%= user.email %>" class="input-field"
+         autocomplete="email" placeholder="you@example.com"
+         x-model="fields.email">
+  <% if user.email.present? %>
+    <p class="text-muted text-xs mt-2">
+      Changing this tells <span class="font-semibold"><%= user.email %></span> and signs out your other devices.
+    </p>
+  <% end %>
+<% end %>