Use the reviewed profile contract
Driver App Profile composes current session user data, configurable validation fields, photo-library updates, availability, schedule, sessions, language, logout and account deletion. These are independent reads, mutations and provider handoffs, not one atomic profile transaction.
This contract is source-only. It does not certify PII currentness, successful photo/profile/availability/delete/session effects or deployed behavior.
Availability
Profile is an authenticated tab and can refresh current user information on a navigation-state event. Field editing for a Driver requires explicit update configuration. Availability is shown unless its configuration explicitly hides it. Deletion is configuration/role-dependent. Sessions, schedule, language and logout have separate contracts.
Prerequisites
- Authenticated self scope and current validation-field configuration.
- Minimum PII access and explicit field/photo/delete authorization.
- Synthetic photo/provider tests; no camera assumption.
- Separate API receipts and late-result protection for each mutation.
- Session/account cleanup plan before deletion or logout.
Responsibility boundaries
| Boundary | Responsibility | Limit |
|---|---|---|
| Profile wrapper | Supply session user, focus refresh, config and navigation. | Refresh/navigation is not currentness. |
| Profile UI | Render configured fields, photo, availability and account entries. | Visibility is not mutation eligibility. |
| Validation fields | Define visible/required/editable form fields. | Client config is not server authorization. |
| Photo library | Select a photo asset and return URI/base64 metadata. | No reviewed camera path; selection is not persistence. |
| User controller/API | Read/update fields/photo/availability/delete with self/manager rules and follow-ons. | Mutations can settle independently. |
| Session/storage | Replace local user or clear state after results. | Local state is not server completion. |
| Schedule/sessions/language/logout | Separate account workflows. | Profile composition does not merge their contracts. |
Inputs and result
| Input/action | Client result | Limit |
|---|---|---|
| Focus/current session | User refresh/read mode. | PII currentness unproven. |
| Validation fields | Read/edit form and local validation. | Missing field does not authorize bypass. |
| Edit fields/password/phone | Partial change request. | Server validation/history/jobs/socket separate. |
| Avatar press | Photo library; selected asset can immediately request save. | Independent of Edit config; no preview confirmation. |
| Availability toggle | User availability request/local state. | Order eligibility/broadcast/currentness separate. |
| Delete account | Confirmation then destructive request/local cleanup intent. | Server delete, session, storage, jobs/socket/provider cleanup separate. |
| Sessions/schedule/language/logout | Navigate or invoke dedicated workflow. | Each requires own acceptance. |
Security and privacy
- Never log or expose names, email, phone, password, photo/base64, schedule, session, availability or deletion payloads.
- Enforce self/manager/field/photo/delete authorization server-side.
- Require explicit preview/confirmation before photo upload and complete destructive confirmation before deletion.
- Bind late refresh/mutation/picker results to current account generation.
Limits and failure states
| State | Meaning | Maintainer response |
|---|---|---|
| Profile loading/error | User/validation read unsettled. | No mutation. |
| Edit hidden | Config does not admit field editing. | Do not bypass. |
| Avatar still pressable | Photo path independent of edit config. | Treat as authorization/confirmation gap. |
| Picker canceled/error | Provider returned no usable asset. | No retry/camera workaround. |
| Availability result | One mutation/local result. | Order/broadcast/follow-ons unproven. |
| Delete accepted locally | Request/cleanup may be in progress. | Destructive completion unproven. |
| Session/profile divergence | Late result or partial cleanup. | Stop and reconcile account ownership. |
Troubleshooting
Use synthetic fields/users/assets and intercepted API/session/storage/picker. Never enter real PII, toggle real availability, delete an account, inspect live sessions or open a real picker for diagnostics.
Re-review whenever profile refresh, validation fields, edit authorization, photo picker/save, availability, deletion, local session replacement or related account entry changes.
Related guides: View profile · Edit profile · Availability · Schedule · Sessions · Sign out · Delete account