feat(account): Account Settings page (/account/settings) — closes #74

[ismetcahangirov]

Summary

Builds the customer Settings page at /{locale}/account/settings under the shared account/ shell, fixing the header dropdown "Ayarlar / Settings" which previously 404'd. Consolidates the old /profile UI into a proper sectioned settings page and removes the duplicated profile logic.

Closes #74.

What's included

Sectioned page (AccountSettingsClient) with four cards, each extracted into a reusable component:

1. Profile (ProfileSection) — avatar upload (useUpdateAvatar), name/email edit (useUpdateProfile), role + verified badges, member-since.
2. Security (SecuritySection) — change-password form (useUpdatePassword) with client-side match validation and "min 8 chars" hint. Google-only accounts see a clear notice instead of a form.
3. Addresses — embeds the existing AddressListClient (full CRUD) via a new backward-compatible embedded prop (renders as a card with an h2; standalone /profile/addresses is unchanged).
4. Preferences (PreferencesSection) — language (LanguageSwitcher) + theme (ThemeToggle), client-only.

Consolidation

• Profile/password/avatar logic moved out of ProfilePageClient (deleted) into the section components — no duplicated logic.
• /profile now redirects to /account/settings.

Backend (small addition)

• GET /auth/me now returns a computed hasPassword boolean (Google-only accounts have none) so the UI can hide the password form. The password hash is never exposed. Regression tests added to auth.test.ts.

i18n — new keys added to all three messages/{az,en,ru}.json under the profile namespace.

Acceptance criteria

• Header dropdown "Ayarlar" opens a working page (no 404) at /{locale}/account/settings.
• Update profile (name/email/avatar), change password, and manage addresses from this page.
• Language + theme toggles (reused, persist via next-intl / next-themes).
• Google-only accounts get a clear message instead of a broken password form.
• Unauthenticated → /login (via the account layout.tsx ProtectedRoute); page is noindex.
• az / en / ru + dark mode correct; no duplicated profile logic.
• lint, client test, and next build pass with new tests.

Out of scope (follow-up)

• Danger zone / delete account — requires a new DELETE /users/me endpoint. Omitted per the issue's "optional/follow-up" note; recommend a separate backend task.
• Phone field — the User model has no phone column, so it's omitted (as the issue instructed).

Testing

• Unit (vitest): new suites for ProfileSection, SecuritySection, PreferencesSection, and AccountSettingsClient (loading / error / loaded / Google-only). Full suite green: 388 tests. next lint clean, next build succeeds.
• Backend: tsc --noEmit + eslint clean. hasPassword verified live via curl against a local server (returns true for a password account, hash not present). Jest regression tests added (run in CI's dedicated test DB — the local suite is intentionally not run since its global setup wipes whatever DB it connects to).
• E2E (Playwright, local backend + frontend): logged in as the seeded customer and verified the page renders all four sections, the password form reveals, the header dropdown "Ayarlar" link opens the page, and /profile redirects to /account/settings.

Note: on a hard page reload the in-memory access token (window.__accessToken) is gone, so the page briefly shows the loading skeleton while the axios interceptor refreshes the token — existing app behaviour, not specific to this page.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
api-shopflow	Ready	Preview, Comment	Jul 9, 2026 10:38am
shopflow	Ready	Preview, Comment	Jul 9, 2026 10:38am