fix: make organization contact email editable

[alukach]

Allow organization accounts to set/update their contact email in the profile settings form. Individual account emails remain read-only as they are managed through identity/authentication.

Closes #215

Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
source-cooperative	Ready	Preview, Comment	Apr 20, 2026 7:25pm

[claude]

Claude finished @alukach's task in 1m 5s —— View job

---

PR Review

• Gather context and read changed files
• Review EditProfileForm.tsx changes
• Review account.ts changes
• Post final review feedback

---

Summary

This is a clean, focused change that correctly makes the email field editable for organization accounts while keeping it read-only for individuals. The implementation is straightforward with no major issues.

EditProfileForm.tsx

The single-line change at line 77 is correct:

readOnly: initialAccount.type === "individual",

The description text already handles both cases conditionally, so the UX is consistent.

account.ts

Minor issue — re-submitting the same email resets verified: false

In account.ts:242, verified: false is set unconditionally:

updatedEmails = [
  {
    address: email,
    verified: false,   // ← always false, even if existing email was verified
    is_primary: true,
    added_at: currentAccount.emails?.find((e) => e.is_primary)?.added_at || new Date().toISOString(),
  },
];

If an org's email was previously verified and the admin saves the profile without changing the email, it will silently reset to verified: false. Consider preserving the existing verified state when the email hasn't changed:

const existingPrimary = currentAccount.emails?.find((e) => e.is_primary);
const emailUnchanged = existingPrimary?.address === email;
updatedEmails = [{
  address: email,
  verified: emailUnchanged ? (existingPrimary?.verified ?? false) : false,
  verified_at: emailUnchanged ? existingPrimary?.verified_at : undefined,
  is_primary: true,
  added_at: existingPrimary?.added_at || new Date().toISOString(),
}];

Fix this →

Note — empty email clears all org emails

account.ts:250: updatedEmails = [] removes all emails when the field is blank. This is likely intentional (allowing orgs to opt out of a contact email), but worth verifying that's the desired product behavior.

Simplistic email regex

The regex /^[^\s@]+@[^\s@]+\.[^\s@]+$/ is a loose validator. It's fine for basic use, but the AccountEmailSchema uses z.string().email() (Zod's RFC-compliant validator). The inconsistency is harmless here since org email updates bypass Zod schema validation at the action layer, but it's worth noting.

---

Verdict

The change is correct and the PR accomplishes its goal. The only meaningful concern is the verified state regression on unchanged-email saves. Everything else is minor.