fix: make organization contact email editable

[alukach]

Allow organization accounts to set/update their contact email in the profile settings form. Individual account emails remain read-only as they are managed through identity/authentication.

Closes #215

Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
source-cooperative	Ready	Preview, Comment	Jul 21, 2026 5:40am

[claude]

Claude finished @alukach's task in 1m 42s —— View job

---

✅ No blocking issues — safe to merge.

• src/lib/actions/account.ts:249 — the rebuilt email entry always sets verified: false, even when the submitted address is unchanged from the current primary email. This isn't a regression in practice: organization accounts have no identity_id and no verification flow (verification is only synced from Ory for individual accounts via email-verification.ts), so verified was already always false for orgs before this change.
• src/lib/actions/account.ts:240 — the email format check (/^[^\s@]+@[^\s@]+\.[^\s@]+$/) duplicates validation logic instead of reusing the existing AccountEmailSchema's z.string().email() used elsewhere in src/types/account.ts. Not a bug, just a minor inconsistency worth converging on if this pattern grows.

Both are non-blocking observations, not correctness or security bugs. The core change (allowing organizations to edit their contact email while keeping individual emails read-only/Ory-managed) is implemented correctly:

• EditProfileForm.tsx:91 correctly scopes readOnly to individual accounts only.
• account.ts only applies the new email-processing branch for AccountType.ORGANIZATION, leaving individual account emails untouched.
• Existing added_at and is_primary primary-email metadata are preserved correctly when the address doesn't change.
• Authorization is unchanged — still gated by the existing isAuthorized(session, currentAccount, Actions.PutAccountProfile) check before any field is processed.