Profile management

What this feature does

The profile page lets an authenticated user maintain non-sensitive account details while immutable identity and privileged fields stay server-controlled.

This guide describes the behavior implemented by Mallello, the people allowed to use it, and the operational checks that keep it dependable.

Detailed workflow

1. Open the account profile.
2. Edit supported display or contact details.
3. Submit validated values.
4. The API authorizes the current user and persists only allowed fields.
5. The session view refreshes to show the update.

Rules and permissions

• Role, super-admin, verification, and provider identifiers are never editable through the ordinary profile form.
• Email changes require a separate re-verification workflow if enabled.
• Input length and content are validated.
• Audit-worthy privileged changes belong in admin management.

Failure handling and edge cases

• Concurrent edits may overwrite stale values unless versioning is used.
• Provider identity and application profile mismatches require operator reconciliation.
• A suspended account cannot use profile editing as an authorization bypass.