- Shipped
- September 4, 2026 at 10:51 PM UTC
- Author
- Kamo
- Commit
- 58327d4
Two changes to the member profile, both about the same confusion: which person a question is being asked about. The personal email card is no longer self-only. A god-eligible operator and the System User can set anybody's, because the member who needs it changed is usually the one who has just said their old mailbox is unreachable — the case the member's own flow cannot serve, since it works by mailing that address. Deliberately not MANAGE_MEMBERS or MANAGE_MEMBER_SECURITY: this is one of the three identifiers sign-in accepts and the one password recovery writes to, so setting it is taking the account over. Same line the password card draws. The card reads through the member-scoped endpoint even on the reader's own profile, so there is ONE code path and the SERVER decides whether it may be edited and in which shape. `mode` picks the wording, the write, and whether a password is asked for — an operator has already proved who they are, and asking them for a password they do not have would be theatre. Three things the operator variant must not do, each of which it did first: - render the pending-change panel. Its Confirm, Send-again and Discard call SELF-scoped endpoints, so an operator would have been handed three buttons that silently act on their OWN account while showing a colleague's address. - be suppressed by a change the member had pending. Overriding it is the point; the operator is told about it instead, including that setting an address cancels it. - offer the member's "where your account lives" explainer. An operator knows what a user account is; what they cannot see is that this write is not verified and does not stay quiet, so they are told that instead. Separately, isSecurityProviderOrg now means "this org owns the account behind the MEMBER BEING VIEWED" and comes from the server. It used to be derived in the browser from the READER's own account, which is a fact about whoever is looking: an administrator entitled to fix a colleague's legal name could be refused because their own account came from elsewhere, and one who was not entitled could be offered the box. For a member on their own profile the two readings coincide, so nothing about the self case changes. The banner that says "your account is managed by X" keeps the reader-scoped answer, because it is the one thing here genuinely about the reader — and it now renders only on their own profile. Telling somebody their account lives elsewhere while they are looking at a colleague's record answers a question they did not ask. Six tests pin the gate as a boundary, the sharpest being that an administrator holding both MANAGE_MEMBERS and MANAGE_MEMBER_SECURITY can neither see nor edit the address.