M2-06 User Self-Service — Profile Update, Password Reset, Linked Accounts

Milestone: M2 — Platform and Client Admin SOW Reference: FR6 Requirement Clarity: ✅ Clear Dev Status: 🟡 Partially prototyped — password reset/MFA delegated entirely to Auth0's hosted flows today; no in-app profile-edit screen

Overview

Let any authenticated user update their own profile details, reset their password, and manage their linked accounts/authentication factors — as opposed to an admin managing other users (see M2-05).

Backend Tasks

• Add/confirm a PATCH /users/me (or equivalent) endpoint for self-service profile updates, properly guarded to "self only"
• Decide whether password reset stays fully Auth0-hosted (redirect flow) or needs an in-app "change password" screen
• Confirm linked-account management (MfaMethod entity relations) is exposed via API, not just schema

Frontend Tasks

• Build a "My Profile" page for name/contact-detail edits
• Add a "Change Password" action (Auth0-hosted redirect is acceptable for MVP if that's the confirmed approach)
• Show linked authentication methods/accounts with manage/remove actions

Dependencies

• M2-10 session management — shares the same Auth0 foundation.
• M2-07 MFA — linked-accounts UI overlaps with MFA method management.

Acceptance Criteria

• User can update profile
• User can change password
• User can reset password
• User can manage MFA methods (per SOW Appendix 3, FR6 acceptance criteria)

Existing Reference Material

• ../../requirements/user_stories/user-management/user-profile-management.md
• ../../requirements/user_stories/user-management/password-management.md

Blockers & Risks

• Risk: if password reset stays purely Auth0-hosted, confirm that satisfies "Password reset from user dashboard" in the original requirements doc — otherwise this needs an in-app flow.