studio-engine 0.48.0 → 0.49.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fa8ab90a0e1627e7150ed1e96a348bae677c3dc35891ccd2a46f99d857cd74d1
-  data.tar.gz: e2a354a9d1d0533a78c63cb19233ae387a4c71f747cd5bf4570fe8d2478979de
+  metadata.gz: 5cfb0ff6698fde0520d0d6e081ffd49d99801473831f92c18e86a9cb9dc177a1
+  data.tar.gz: 2a96a7e242ff9211d0307326e77258136b725a99d5d749a9664e5194336af72c
 SHA512:
-  metadata.gz: d7def604f1a4c19da8241953cee4bfa8e8047af2a2ae0e0113628aeed9f5d59ab5fa16bfe667e89687144f0f0afb5117e1bcd1f4747ab69db9c5b892e142c820
-  data.tar.gz: 7424031597c4168ac6a8172360b7dbc2ee584f0ddc5ac205a155fd11343f7e8f91002a40d3b0865eef0218096234aeaf1617ff2133677aa1e51c9b73d91a8cf3
+  metadata.gz: d142923e12b84afc01d96afda2cdaf578ef422a6e34f480cad0917671140ad99bf5eb73d70b0283eed6ba4a5eece21f98ea356662a963c504fdef758ccf3b857
+  data.tar.gz: 657e2a9742b8e92317a3128593fe50663cb2fd09ca004a1700d0dc0e0a4c6916d7f0d024c28b6098a93e6424cfacb174bdf46878cadcf9dab953b5532725e520

data/CHANGELOG.md

@@ -17,6 +17,36 @@ The format is [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). This pro
 
 ### Added
 
+- **`/profile` gains the Email row — changeable from any signed-in session.**
+  `PATCH /profile/email` (`profile_email_path`) applies the change directly.
+
+  **THE GOOGLE EXCEPTION.** An account with a linked Google identity **cannot**
+  change its email: Google is the authoritative source for that address, and
+  letting the two drift means the next OAuth sign-in either re-links to a
+  stranger's row or cannot find its own. The row shows the address with the
+  reason instead of a field, and the endpoint refuses independently — a disabled
+  input is a courtesy, and anyone can POST.
+
+  **What a direct change trades away, stated so nobody rediscovers it:** a
+  hijacked session can move the account to another inbox, and the old address has
+  no veto. Two protections are kept precisely BECAUSE the veto is gone —
+
+  - the **old address is mailed** after every change (OPSEC-046), so a change
+    nobody made is visible to the person losing the account, and
+  - **every other session is invalidated** (OPSEC-045), so a hijacker holding a
+    second cookie loses it the moment the address moves. The session that made
+    the change is re-established, so the person doing it is not signed out.
+
+- **`Studio::ProfileMailer`** with `email_change_notification`, plus a new
+  standard `Studio::EmailCatalog` entry so its copy, subject and banner are
+  operator-editable on `/admin/emails` like every other Studio email. **Namespaced deliberately:**
+  `app/mailers` is an autoload path and this engine is not isolated, so a host's
+  top-level `UserMailer` shadows the engine's — mcritchie-studio's fork defines no
+  `email_change_notification` at all (a bare call raises `NoMethodError`), and
+  turf-monster's defines one with the SAME signature — so there the call would
+  not raise, it would quietly send TURF's copy, banner and `account_url` instead
+  of the engine's. The silent case is the dangerous one.
+
 - **`/profile` gains the Google account row.** Shows the linked identity with an
   Unlink control, or a branded Connect button that POSTs to OmniAuth's own
   `/auth/google_oauth2` (the engine does not draw a link route — the middleware

data/app/controllers/studio/profiles_controller.rb

@@ -38,7 +38,7 @@ module Studio
 
     # PATCH /profile — the scalar fields. Today that is the first name.
     def update
-      return unsupported(:first_name) unless serves?(:first_name)
+      return unsupported("name") unless row_rendered?(:first_name)
 
       value = normalized_first_name
 
@@ -85,7 +85,7 @@ module Studio
     # this and branched inside its own #update; a separate route is the same
     # lesson expressed so the trap cannot be reintroduced.
     def avatar
-      return unsupported(:avatar) unless serves?(:avatar)
+      return unsupported("profile photo") unless row_rendered?(:avatar)
 
       file = params.dig(:profile, :avatar)
 
@@ -103,6 +103,79 @@ module Studio
       end
     end
 
+    # PATCH /profile/email — change the address, from any signed-in session.
+    #
+    # DIRECT, not out-of-band (operator's call, 2026-08-14). An earlier build
+    # mailed a confirmation link to the current address and applied the change
+    # only when the holder of that inbox clicked it. That is the stronger flow and
+    # it is gone on purpose: the session is now the authority.
+    #
+    # What that trades away, stated so nobody has to rediscover it: a hijacked
+    # session can move the account to another inbox, and the old address no
+    # longer gets a veto. Two things are kept BECAUSE the veto is gone —
+    #
+    #   * the OLD address is mailed after every change (OPSEC-046), so a change
+    #     nobody made is visible to the person losing the account, and
+    #   * every OTHER session is invalidated (OPSEC-045), so a hijacker holding a
+    #     second cookie loses it the moment the address moves.
+    #
+    # THE GOOGLE EXCEPTION. An account with a linked Google identity cannot
+    # change its email here: Google is the authoritative source for that address,
+    # and letting the two drift means the next OAuth sign-in either re-links to a
+    # stranger's row or fails to find its own. Unlink Google first, then change it.
+    def email
+      return unsupported("email") unless row_rendered?(:email)
+
+      if Studio::OauthIdentity.google_linked?(current_user)
+        return redirect_to profile_path, status: :see_other,
+                           alert: "Your email comes from your linked Google account. " \
+                                  "Unlink Google first if you want to change it."
+      end
+
+      value = params.dig(:profile, :email).to_s.strip
+      current = current_user.email.to_s
+
+      return redirect_to profile_path, alert: "Enter an email address.", status: :see_other if value.blank?
+
+      if value.casecmp?(current)
+        return redirect_to profile_path, alert: "That is already your email address.", status: :see_other
+      end
+
+      rescue_and_log(target: current_user) do
+        unless current_user.update(email: value)
+          next redirect_to profile_path, status: :see_other,
+                           alert: current_user.errors.full_messages.to_sentence.presence ||
+                                  "Could not save that address."
+        end
+
+        # The new address has not been proved yet; the host's own verification
+        # flow picks it up from here.
+        current_user.update_columns(email_verified_at: nil) if current_user.respond_to?(:email_verified_at)
+
+        # ROTATE FIRST, MAIL SECOND — the order matters and it was the other way
+        # round. Studio::Email.deliver can raise (a host's delivery record is a
+        # create! plus perform_later with no rescue at that level), and a mail
+        # failure between the write and the rotation would leave the address
+        # changed with every other session still live. That is the exact window
+        # OPSEC-045 exists to close, so it closes before anything that can throw.
+        # turf-monster's own apply_email_change rotates first for the same reason.
+        if current_user.respond_to?(:regenerate_session_token!)
+          current_user.regenerate_session_token!
+          # Re-establish THIS session. Rotating without it signs out the very
+          # person who just made the change — correct when the actor arrived from
+          # a confirmation link, wrong now that the actor IS the session.
+          session[:session_token] = current_user.session_token if current_user.respond_to?(:session_token)
+        end
+
+        if current.present?
+          Studio::Email.deliver(Studio::ProfileMailer, :email_change_notification,
+                                current_user, current, value, to: current, user: current_user)
+        end
+
+        redirect_to profile_path, notice: "Email changed to #{value}."
+      end
+    end
+
     # DELETE /profile/google — drop the linked Google identity.
     #
     # REFUSES WHEN IT WOULD ORPHAN THE ACCOUNT. turf-monster's version is an
@@ -116,7 +189,7 @@ module Studio
     # column: an app with an email column that does not offer magic-link sign-in
     # cannot use it to get back in.
     def unlink_google
-      return unsupported(:google_account) unless serves?(:provider) && serves?(:uid)
+      return unsupported("Google account") unless row_rendered?(:google)
 
       unless Studio::OauthIdentity.google_linked?(current_user)
         return redirect_to profile_path, alert: "No Google account is linked.", status: :see_other
@@ -136,28 +209,42 @@ module Studio
 
     private
 
-    # Can this host's user model serve this field?
+    # Would the page render this row for this viewer?
     #
-    # A HIDDEN ROW IS NOT A GUARD. Studio::ProfileSections drops a row the host
+    # A HIDDEN ROW IS NOT A GUARD. Studio::ProfileSections drops a row this host
     # cannot serve, so nobody SEES a first-name form in an app without the
     # column — but the endpoint stays open to anyone who posts to it, and
     # rescue_and_log RE-RAISES, so an unguarded write is a 500 plus an ErrorLog
-    # row. That is not hypothetical: three of the five consumers
-    # (mcritchie-industries, moms-app, acquisition-studio) have an avatar
-    # attachment and no first_name column right now.
+    # row. Three of the five consumers have an avatar attachment and no
+    # first_name column right now.
     #
-    # The endpoint asks the SAME question the row does, through the SAME method,
-    # so the two cannot drift into disagreeing about what this app supports.
-    def serves?(attribute)
-      Studio::ProfileSections.served_by?(current_user, attribute)
+    # ASKED OF THE RESOLVER, not of one of its rules — and that distinction was a
+    # real bug, caught in review. This used to call served_by?, which answers only
+    # the MODEL gate (`requires:`). Once rows also carried an APP gate (`if:`),
+    # the two questions came apart: mcritchie-industries drops the Google row
+    # because it offers no Google sign-in, while the endpoint — asking only about
+    # columns it does have — stayed open. The comment here claimed they "cannot
+    # drift" while they were already drifting.
+    #
+    # Asking the resolver makes that true rather than asserted: the page and the
+    # endpoint run the same code and get the same answer, whatever gates a row
+    # grows next.
+    def row_rendered?(key)
+      profile_rows.any? { |section| section[:key] == key.to_sym }
+    end
+
+    # Memoized per request: a host's `if:` may be a lambda doing real work, and a
+    # write should not pay for it more than once.
+    def profile_rows
+      @profile_rows ||= Studio.profile_sections_for(view_context)
     end
 
     # Land the person back on a page that works rather than on a bare 404. This
     # is unreachable through the UI — the row that posts here is not rendered —
     # so the wording is for whoever is poking at the endpoint directly.
-    def unsupported(attribute)
+    def unsupported(label)
       redirect_to profile_path,
-                  alert: "This app has no #{attribute.to_s.tr("_", " ")} to change.",
+                  alert: "This app has no #{label} to change.",
                   status: :see_other
     end
 

data/app/mailers/studio/profile_mailer.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Studio
+  # The two emails an email change sends.
+  #
+  # NAMESPACED, and that is load-bearing rather than tidiness. `app/mailers` is an
+  # autoload path and this engine is not isolated, so a host that defines a
+  # top-level `UserMailer` SHADOWS the engine's outright. Two consumers do:
+  # mcritchie-studio (which defines no email-change actions, so a bare call would
+  # raise NoMethodError) and turf-monster (which defines `email_change_confirmation`
+  # and `email_change_notification` ALREADY, with its own signature and its own
+  # `confirm_email_change_url` pointing at /account). That second case is the
+  # dangerous one: no exception, no warning, and the engine's flow quietly mails a
+  # link to turf's route instead of its own.
+  #
+  # Under `Studio::` nothing shadows it, following Studio::NewsletterMailer.
+  #
+  # ONE EMAIL, and it goes to the address being LEFT:
+  #
+  #   email_change_notification → the OLD address, after the change lands. With
+  #     the change applying directly from any signed-in session, this mail is the
+  #     only thing that makes a change nobody made VISIBLE to the person losing
+  #     the account. That is why it survives and why it is sent even though
+  #     nothing about it is required for the change to work.
+  class ProfileMailer < ApplicationMailer
+    layout "branded_mailer"
+
+    # To the OLD address, after the swap landed.
+    def email_change_notification(user, old_email, new_email)
+      @user      = user
+      @app_name  = Studio.app_name
+      @old_email = old_email
+      @new_email = new_email
+
+      @banner     = Studio::Banner.for(:email_change_notification, name: display_name_for(user))
+      @banner_url = Studio::EmailCatalog.resolved_url(:email_change_notification)
+      @banner_alt = [@banner&.header, "your #{@app_name} email was changed"].compact.join(" — ")
+
+      mail(to: old_email, subject: Studio::EmailCatalog.subject_for(:email_change_notification, name: display_name_for(user)))
+    end
+
+    private
+
+    # The engine's User contract guarantees display_name, but this mailer is also
+    # reachable from a host whose model is mid-migration; a name is a nicety and
+    # must never be the reason an email fails to send.
+    def display_name_for(user)
+      return nil unless user.respond_to?(:display_name)
+
+      user.display_name
+    rescue StandardError
+      nil
+    end
+  end
+end

data/app/services/studio/email_catalog.rb

@@ -193,6 +193,27 @@ module Studio
         # inherited email with no preview is a row on every app's manager that
         # cannot be looked at.
         preview: -> { Studio::NewsletterMailer.subscribed("preview@example.com", name: "Alex") }
+      },
+      {
+        key: "email_change_notification",
+        label: "Email change — heads up",
+        description: "Sent to the OLD address after a change lands, so an unauthorized change is visible rather than silent.",
+        # Reuses the shipped email-change artwork. The asset is named for a
+        # confirmation email that no longer exists; the picture is right for the
+        # subject either way, and renaming a shipped asset is its own migration.
+        default_asset: "emails/email-change-confirmation.gif",
+        header: "Your email was changed",
+        header_fallback: "Your email was changed",
+        subtext: "a heads-up from {app}",
+        subject: "Your {app} email was changed",
+        body: "The email address on your {app} account was just changed. " \
+              "If you did not do this, contact us straight away — this message " \
+              "was sent to your previous address on purpose.",
+        # No button: there is nothing to click. The point is the notice itself.
+        supports_cta: false,
+        preview: lambda {
+          Studio::ProfileMailer.email_change_notification(nil, "old@example.com", "new@example.com")
+        }
       }
     ].freeze
 

data/app/views/studio/profile_mailer/email_change_notification.html.erb

@@ -0,0 +1,30 @@
+<%# Body only — branded_mailer supplies the banner + card.
+
+    NO BUTTON, deliberately: there is nothing to click. This email exists so an
+    unauthorised change is VISIBLE to the person losing the account, and the
+    catalogue entry sets supports_cta: false to match. Adding a CTA here would
+    invite someone to click their way somewhere from a message that may itself
+    be the first sign of a compromise.
+%>
+<%
+  body = @body.presence || Studio::EmailCatalog.body(:email_change_notification)
+%>
+<h1 style="margin:0 0 18px;font-size:22px;line-height:1.3;color:#1f2a1c;">Your email was changed</h1>
+
+<% if body.present? %>
+  <%= simple_format body, { style: "margin:0 0 24px;font-size:16px;line-height:1.6;color:#3f4a3c;" }, sanitize: true %>
+<% end %>
+
+<table role="presentation" cellpadding="0" cellspacing="0" border="0" width="100%" style="margin:0 0 24px;">
+  <tr>
+    <td style="padding:14px 16px;background:#f4f6f3;border-radius:10px;font-size:15px;line-height:1.6;color:#3f4a3c;">
+      <strong style="color:#2f3a2c;">Was:</strong> <%= @old_email %><br>
+      <strong style="color:#2f3a2c;">Now:</strong> <%= @new_email %>
+    </td>
+  </tr>
+</table>
+
+<p style="margin:28px 0 0;font-size:13px;line-height:1.5;color:#6b756a;text-align:center;">
+  This message was sent to <strong style="color:#2f3a2c;"><%= @old_email %></strong> — your previous
+  address — on purpose, so a change you did not make cannot happen quietly.
+</p>

data/app/views/studio/profile_mailer/email_change_notification.text.erb

@@ -0,0 +1,11 @@
+The email address on your <%= @app_name %> account was just changed.
+
+  Was: <%= @old_email %>
+  Now: <%= @new_email %>
+
+If you did not do this, contact us straight away.
+
+This message was sent to <%= @old_email %> — your previous address — on purpose,
+so a change you did not make cannot happen quietly.
+
+— <%= @app_name %>

data/app/views/studio/profiles/_email_section.html.erb

@@ -0,0 +1,55 @@
+<%# Email row.
+
+    Locals: user (required).
+
+    DIRECT CHANGE from any signed-in session (operator's call, 2026-08-14). The
+    earlier build mailed a confirmation link to the current address and applied
+    the change only when someone clicked it; the session is the authority now.
+    The row therefore saves what you type, and the copy says so plainly rather
+    than implying a pending step that no longer exists.
+
+    THE GOOGLE EXCEPTION. An account with a linked Google identity cannot change
+    its email here — Google is the authoritative source for that address, and
+    letting the two drift means the next OAuth sign-in either re-links to a
+    stranger's row or cannot find its own. The locked branch renders NO form at
+    all — there is nothing to type into and nothing to submit — and
+    ProfilesController#email refuses the request independently anyway, because a
+    missing form is a courtesy and anyone can POST.
+
+    Gated on a real delta for the same reason the name row is — an empty field,
+    or the address you already have, is not a change.
+%>
+<% locked = Studio::OauthIdentity.google_linked?(user) %>
+<% current = user.email.to_s.strip %>
+
+<% if locked %>
+  <p class="text-sm text-secondary mb-1">Current address</p>
+  <p class="text-heading font-semibold mb-3 break-all"><%= user.email %></p>
+  <div class="rounded-lg p-3 flex items-start gap-2" style="background: var(--color-surface-alt);">
+    <span aria-hidden="true">🔒</span>
+    <p class="text-muted text-xs">
+      This comes from your linked Google account. Unlink Google below if you want to change it.
+    </p>
+  </div>
+<% else %>
+  <%= form_with url: profile_email_path, method: :patch, scope: :profile,
+                data: { turbo: false },
+                html: { "x-data": "{ current: #{current.downcase.to_json}, value: #{current.to_json} }" },
+                class: "flex flex-wrap items-end gap-3" do |form| %>
+    <div class="flex-1 min-w-0" style="min-width: 14rem;">
+      <label class="block text-sm text-secondary mb-2 font-medium" for="profile_email">Email</label>
+      <%= form.email_field :email, value: user.email, autocomplete: "email",
+                           placeholder: "you@example.com", class: "input-field",
+                           "x-model": "value" %>
+    </div>
+    <%= form.submit "Update",
+                    class: "btn btn-primary",
+                    ":disabled": "value.trim() === '' || value.trim().toLowerCase() === current",
+                    ":class": "(value.trim() === '' || value.trim().toLowerCase() === current) && 'opacity-50 cursor-not-allowed'" %>
+  <% end %>
+  <% if current.present? %>
+    <p class="text-muted text-xs mt-2">
+      We'll let <span class="font-semibold"><%= user.email %></span> know it changed, and sign out your other devices.
+    </p>
+  <% end %>
+<% end %>

data/app/views/studio/profiles/_first_name_section.html.erb

@@ -2,17 +2,29 @@
 
     Locals: user (required).
 
-    This row only renders when the host's user model actually answers
-    `first_name` — Studio::ProfileSections drops it otherwise, so an app that has
-    not installed the standard profile columns gets a page without this row
-    rather than a NoMethodError on every visit. Nothing here needs to re-check.
+    PREFILLED, with the Update button to the right of the input and DISABLED
+    until the value actually differs (operator's call, 2026-08-14). A blank field
+    made you retype a name you had already set just to see what it was, and an
+    always-live Save invited a no-op write that flashed "Name updated." over a
+    change nobody made.
 
-    The same column is written by the onboarding step
-    (Studio::OnboardingController#first_name); this is the surface for changing it
-    later.
+    The delta is computed against the value the server rendered, and both sides
+    are trimmed — leading or trailing whitespace is not a change, and the
+    controller trims on the way in too, so the button agrees with what the server
+    would actually do.
+
+    NO-JS FALLBACK: the button carries no `disabled` attribute in the markup;
+    Alpine adds it on init. A page whose JS never ran therefore gets a working,
+    always-enabled Save rather than a control it can never turn on — the server
+    re-checks anyway.
+
+    This row only renders when the host's user model answers `first_name`
+    (Studio::ProfileSections drops it otherwise), so nothing here re-checks.
 %>
 <%= form_with url: profile_path, method: :patch, scope: :profile,
-              data: { turbo: false }, class: "flex flex-wrap items-end gap-3" do |form| %>
+              data: { turbo: false },
+              html: { "x-data": "{ initial: #{user.first_name.to_s.strip.to_json}, value: #{user.first_name.to_s.strip.to_json} }" },
+              class: "flex flex-wrap items-end gap-3" do |form| %>
   <div class="flex-1 min-w-0" style="min-width: 12rem;">
     <label class="block text-sm text-secondary mb-2 font-medium" for="profile_first_name">First name</label>
     <%= form.text_field :first_name,
@@ -20,7 +32,11 @@
                         maxlength: Studio::FIRST_NAME_MAX_LENGTH,
                         autocomplete: "given-name",
                         placeholder: "What should we call you?",
-                        class: "input-field" %>
+                        class: "input-field",
+                        "x-model": "value" %>
   </div>
-  <%= form.submit "Save", class: "btn btn-primary" %>
+  <%= form.submit "Update",
+                  class: "btn btn-primary",
+                  ":disabled": "value.trim() === initial.trim()",
+                  ":class": "value.trim() === initial.trim() && 'opacity-50 cursor-not-allowed'" %>
 <% end %>

data/app/views/studio/profiles/show.html.erb

@@ -4,10 +4,15 @@
     application layout and inherits that app's navbar, theme and flash. Same
     shape as /admin/style and /admin/emails.
 
-    The page is nothing but its sections. @profile_sections is already resolved
-    and filtered by the controller (Studio.profile_sections_for) — rows the host
-    cannot serve, and admin rows for non-admins, are gone before we get here — so
-    this template makes no decisions of its own beyond an empty state.
+    ONE CARD, rows inside it (operator's call, 2026-08-14). Each row used to be
+    its own card, which read as four unrelated settings pages stacked up rather
+    than one profile. Rows are separated by a hairline instead, so the page has a
+    single edge and the eye runs down one column.
+
+    The page is still nothing but its sections. @profile_sections is already
+    resolved and filtered by the controller (Studio.profile_sections_for) — rows
+    the host cannot serve, and admin rows for non-admins, are gone before we get
+    here — so this template makes no decisions of its own beyond the empty state.
 %>
 <% content_for(:title, "Profile") %>
 
@@ -21,10 +26,10 @@
     each ship their OWN app/views/studio/modals/_host.html.erb, which shadows the
     engine's in this non-isolated engine, so the page would silently get their
     fork and its registrations. studio/modals/_scoped_host is unforked in every
-    app. /admin/emails reached the same conclusion first.
-
-    Mounted once per page rather than once per row: two hosts sharing a store
-    name would register the same modal ids twice and render duplicate cards. %>
+    app. /admin/emails reached the same conclusion first. %>
+<%# Mounted ONCE per page, not once per row. Two hosts sharing a store name
+    would register the same modal ids twice and render duplicate cards, so the
+    page owns the host and the rows only ask for it. %>
 <% profile_needs_modals = Array(@profile_sections).any? { |section| section[:modals] } %>
 
 <% if profile_needs_modals %>
@@ -46,11 +51,14 @@
                message: "Nothing to edit yet",
                detail: "This app has not enabled any profile fields." %>
   <% else %>
-    <div class="space-y-6">
-      <% @profile_sections.each do |section| %>
-        <section class="card p-6" data-profile-section="<%= section[:key] %>">
+    <div class="card p-0 overflow-hidden">
+      <% @profile_sections.each_with_index do |section, index| %>
+        <%# The divider is a TOP border on every row but the first, so a row can
+            be added or dropped anywhere without leaving a trailing rule. %>
+        <section class="p-6 <%= "border-t border-subtle" unless index.zero? %>"
+                 data-profile-section="<%= section[:key] %>">
           <% if section[:title].present? %>
-            <h2 class="text-lg font-bold text-heading mb-4"><%= section[:title] %></h2>
+            <h2 class="text-sm font-bold text-heading mb-4"><%= section[:title] %></h2>
           <% end %>
           <%= render section[:partial], **section.fetch(:locals, {}).merge(user: current_user) %>
         </section>

data/lib/studio/profile_sections.rb

@@ -63,8 +63,10 @@ module Studio
         partial: "studio/profiles/avatar_section", requires: :avatar, modals: true },
       { key: :first_name, title: "Your name",
         partial: "studio/profiles/first_name_section", requires: :first_name },
+      { key: :email, title: "Email",
+        partial: "studio/profiles/email_section", requires: :email },
       # Gated on the app OFFERING Google, not merely on having the columns —
-      # the same question app/views/sessions/new.html.erb:79 already asks before
+      # the same question app/views/sessions/new.html.erb already asks before
       # drawing this identical button on the login page.
       { key: :google, title: "Google account",
         partial: "studio/profiles/google_section", requires: %i[provider uid],
@@ -116,9 +118,21 @@ module Studio
       # that silently does nothing, in the same permissive direction as the bug
       # this whole `if:` key was added to fix. A host would have had no signal.
       if condition.is_a?(Symbol) || condition.is_a?(String)
-        return false unless view.respond_to?(condition)
+        unless view.respond_to?(condition)
+          # SILENT would repeat the bug this key was added to fix. The old
+          # coercion gave the host no signal; dropping the row without one only
+          # moves the silence somewhere safer. A typo'd gate now says so.
+          warn_gate("profile_sections: `if: #{condition.inspect}` names a method the view " \
+                    "does not answer — the row was dropped. Check the spelling.")
+          return false
+        end
 
-        return !!view.public_send(condition)
+        # Arity-aware, matching the lambda branch below: a predicate written as
+        # `def visible?(view)` is as natural as one written without an argument,
+        # and calling it wrong raises ArgumentError — which surfaces as a 500 on
+        # /profile rather than as a dropped row.
+        method = view.method(condition)
+        return !!(method.arity.zero? ? view.public_send(condition) : view.public_send(condition, view))
       end
 
       return !!condition unless condition.respond_to?(:call)
@@ -137,6 +151,15 @@ module Studio
       needed.all? { |attribute| user.respond_to?(attribute) }
     end
 
+    # Pure Ruby: this file loads without Rails, so it cannot assume a logger.
+    def warn_gate(message)
+      if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+        Rails.logger.warn(message)
+      else
+        Kernel.warn(message)
+      end
+    end
+
     def symbolize(hash)
       out = hash.to_h.each_with_object({}) { |(key, value), acc| acc[key.to_sym] = value }
 

data/lib/studio/version.rb

@@ -1,3 +1,3 @@
 module Studio
-  VERSION = "0.48.0"
+  VERSION = "0.49.0"
 end

data/lib/studio.rb

@@ -687,8 +687,10 @@ module Studio
         patch  "profile/avatar", to: "studio/profiles#avatar", as: :profile_avatar
         # DELETE, because unlinking removes an identity. Linking is not drawn
         # here: it is OmniAuth's own /auth/:provider, which the middleware owns.
+        patch  "profile/email",  to: "studio/profiles#email", as: :profile_email
         delete "profile/google", to: "studio/profiles#unlink_google",
                as: :profile_unlink_google
+
       end
 
       resources :error_logs, only: [:index, :show]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: studio-engine
 version: !ruby/object:Gem::Version
-  version: 0.48.0
+  version: 0.49.0
 platform: ruby
 authors:
 - Alex McRitchie
@@ -216,6 +216,7 @@ files:
 - app/jobs/studio/email_delivery_job.rb
 - app/mailers/application_mailer.rb
 - app/mailers/studio/newsletter_mailer.rb
+- app/mailers/studio/profile_mailer.rb
 - app/mailers/user_mailer.rb
 - app/models/concerns/sluggable.rb
 - app/models/concerns/studio/board/rankable.rb
@@ -335,7 +336,10 @@ files:
 - app/views/studio/models/show.html.erb
 - app/views/studio/newsletter_mailer/subscribed.html.erb
 - app/views/studio/newsletter_mailer/subscribed.text.erb
+- app/views/studio/profile_mailer/email_change_notification.html.erb
+- app/views/studio/profile_mailer/email_change_notification.text.erb
 - app/views/studio/profiles/_avatar_section.html.erb
+- app/views/studio/profiles/_email_section.html.erb
 - app/views/studio/profiles/_first_name_section.html.erb
 - app/views/studio/profiles/_google_section.html.erb
 - app/views/studio/profiles/show.html.erb