[carlbennett]

Adds a staff page for editing users at /user/edit, revamps the self-service profile editor at /user/update, and fixes several account and session bugs found along the way. Each commit stands alone so the branch can be fast-forwarded onto develop.

Staff user editor (/user/edit)

• Account: username, display name, and email address.
• Status: Disabled and Verified, with a button to resend the verification email.
• Public profile: the same fields as /user/update, from a shared template.
• Permissions: a grid of the options bitmask with None, Default, and Staff presets and a hex readout. Cells without an option read Public or Automatic.
• Reset password: clears the password, expires every session of the user, and emails a link to choose a new one. A confirmation box must be ticked first.
• Access rules:
  • The page requires OPTION_ACL_USER_MODIFY.
  • Staff can only grant or revoke permissions they hold.
  • Staff cannot edit an account that holds permissions they lack, since changing its email would allow taking it over.
  • On your own account you cannot disable yourself or remove your own user-modify permission. You also cannot reset your own password there; use Change password.
• Email changes: changing a user's email unverifies the account and sends a verification link to the new address. A change of letter case alone does not.
• Logging: every edit is logged as USER_EDITED by the logged-in staff member, with the changed fields and the permissions granted or revoked. Resets are logged as USER_PASSWORD_RESET. The Discord embed says "Email: Changed" without the address.
• Links: every link to the page uses the 🛡️ emoji, including from the user list and profile pages.

Profile editor (/user/update)

• All-or-nothing saving: if any field is invalid, nothing is saved, and errors show under each field.
  • A taken username or email now shows an error instead of a 500.
  • The minimum username length is now enforced.
  • The page no longer returns 500 for new users.
• Email changes need a confirmation field, shown only once the address is edited. They also require verifying the new address; the session continues, but logging in again waits for verification.
• Resending verification: unverified users get a button to resend the email. Self-sent verification emails are limited to one every 2 minutes.
• Staff redirect: ?id=N for another user redirects staff to /user/edit.
• Help text: the username and email help texts now say correctly which one is used to log in.

Fixes

• Disabled users: existing sessions now end on their next request.
• Logging out never ended the session server-side: the delete compared the binary session id with its hex form. Logging out now sets the session's expiry to the current time. Session records are no longer deleted by the site; removing them is left to a separate cleanup job.
• Session lookup used expires_datetime = NULL, so sessions without an expiry date were rejected. It now uses IS NULL.
• Password reset links could be reused after a successful reset by an already verified user. They now work once.
• Accounts without a password were told their password was incorrect at login. They are now told to reset it.
• Verify links:
  • Following one again shows a friendly 409 page instead of an error.
  • Array query parameters no longer cause a 500.
  • Verification without a pending token is refused.
  • Staff toggling Verified keeps the verified date and token consistent.
• new Profile(null) left its fields uninitialized.

Also

• The verification and password reset emails moved into the VerificationEmail and ResetPasswordEmail libraries. Their wording now depends on why they were sent: registration, a resend, an email change, or a staff action.
• The emails no longer claim verification links expire after 24 hours.
• Social link bubbles on profiles are colored by platform.
• The profile page's password button is captioned "Change password".
• Everything works without JavaScript; the permission presets, which need it, are hidden unless scripts run.

Testing

• Lint, PHPStan, and PHPUnit (847 tests) pass locally and in CI.
• Every flow was exercised live on dev.bnetdocs.org with throwaway accounts, which were then deleted with their events and sessions.
• Email sending was tested against a local SMTP sink, and the failure path with the relay blocked.
• Not yet tested: a real delivery through the production relay of the email-change verification email and the staff password reset email.

🤖 Generated with Claude Code