Leave name and email to 3AG Accounts

[SourovCodes]

Why

The profile page offered a name and an email address to edit, and neither was this app's to change. The SSO callback force-fills both from the Accounts claims on every login, so an edit here survived exactly until the user signed in again.

The email field was worse than useless. Invitations are found by pendingFor($user->email) and accepted on a lowercased string comparison — so typing a colleague's address into this form and hitting Save was enough to be offered their pending invitations, with no verification anywhere in the path.

The page already said password, two-factor and passkeys live in 3AG Accounts. Name and email always belonged in that sentence too.

What changed

• resources/js/pages/settings/profile.tsx is now a read-only view of what Accounts holds, with a "Manage in 3AG Accounts" link.
• Removed ProfileController::update, ProfileUpdateRequest, the ProfileValidationRules concern (used by nothing else), and the PATCH settings/profile route.
• Account deletion is untouched — that is still the user's own.

Defence in depth

The SSO callback now refuses an email_verified of false.

3agApp/Accounts#4 stops Accounts issuing a code for an unverified address, so this should never fire. It is here because the address decides which invitations the signer can accept and which pre-existing local account they adopt — more than should rest on the identity provider alone holding its end up.

A missing claim still signs in. OIDC makes email_verified optional, so its absence means the issuer did not say, not that it said no; refusing on that would empty the app the day Accounts stopped sending it. There is a test pinning each of the three cases.

Suite consistency

AccountsOidc.php, AccountsUser.php, AccountsOidcException.php, the new profile.tsx and the new browser test are byte-identical across ProductSyncManager, SalesReport and CompliancePlatform.

Testing

Feature, Browser, Pint, PHPStan, npm run check and tsc --noEmit all clean. Also walked the whole flow by hand in the browser against local Accounts: sign in through SSO, land on the profile page, confirm the name and email render and that no name/email input exists on the page.

🤖 Generated with Claude Code