feat(profile): align settings with dashboard layout

tests/Feature/Auth/TwoFactorAuthenticationTest.php

@@ -48,22 +48,22 @@ function enableTwoFactorForTest(User $user): array
     ];
 }
 
-it('keeps the profile available while two-factor settings are disabled', function () {
+it('keeps profile security available while two-factor settings are disabled', function () {
     config(['auth-ui.features.two_factor' => false]);
 
     $this->actingAs(User::factory()->create())
-        ->get('/profile')
+        ->get('/profile/security')
         ->assertInertia(fn (Assert $page) => $page
-            ->component('Profile/Show')
+            ->component('Profile/Security')
             ->where('twoFactor.available', false)
             ->where('twoFactor.enabled', false)
             ->where('twoFactor.pending', false));
 });
 
-it('redirects the former security page to the profile', function () {
+it('redirects the former security page to profile security', function () {
     $this->actingAs(User::factory()->create())
         ->get('/security')
-        ->assertRedirect('/profile');
+        ->assertRedirect('/profile/security');
 });
 
 it('bypasses stored two-factor configuration when the feature is disabled', function () {
@@ -248,15 +248,15 @@ it('requires the current password before a password user can enroll', function (
 
     $this->actingAs($user)
         ->post('/profile/two-factor', ['password' => 'password123'])
-        ->assertRedirect('/profile');
+        ->assertRedirect('/profile/security');
 
     expect($user->fresh()->two_factor_secret)->not->toBeNull()
         ->and($user->fresh()->two_factor_confirmed_at)->toBeNull();
 
     $this->actingAs($user)
-        ->get('/profile')
+        ->get('/profile/security')
         ->assertInertia(fn (Assert $page) => $page
-            ->component('Profile/Show')
+            ->component('Profile/Security')
             ->where('twoFactor.pending', true)
             ->where('twoFactor.enabled', false)
             ->where('twoFactor.requiresPassword', true)
@@ -274,7 +274,7 @@ it('confirms enrollment and returns recovery codes once', function () {
 
     $this->actingAs($user)
         ->post('/profile/two-factor/confirm', ['code' => $code])
-        ->assertRedirect('/profile')
+        ->assertRedirect('/profile/security')
         ->assertSessionHas('recoveryCodes', fn (array $codes) => count($codes) === 8);
 
     expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeTrue();
@@ -366,7 +366,7 @@ it('requires a valid second factor for social-only users to disable protection',
 
     $this->actingAs($user)
         ->delete('/profile/two-factor', ['code' => $twoFactor['code']])
-        ->assertRedirect('/profile');
+        ->assertRedirect('/profile/security');
 
     expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeFalse();
 });
@@ -387,7 +387,7 @@ it('requires both password and second factor for password users to disable prote
             'password' => 'password123',
             'code' => $twoFactor['code'],
         ])
-        ->assertRedirect('/profile');
+        ->assertRedirect('/profile/security');
 
     expect($user->fresh()->hasEnabledTwoFactorAuthentication())->toBeFalse();
     Notification::assertSentTo($user, TwoFactorSecurityNotification::class);
@@ -410,7 +410,7 @@ it('requires both password and second factor to reveal recovery codes', function
             'code' => $twoFactor['code'],
             'regenerate' => false,
         ])
-        ->assertRedirect('/profile')
+        ->assertRedirect('/profile/security')
         ->assertSessionHas('recoveryCodes');
 });
 
@@ -469,7 +469,7 @@ it('consumes recovery codes used to authorize a sensitive settings action', func
             'code' => $recoveryCode,
             'regenerate' => false,
         ])
-        ->assertRedirect('/profile')
+        ->assertRedirect('/profile/security')
         ->assertSessionHas('recoveryCodes');
 
     expect($user->fresh()->recoveryCodes())->not->toContain($recoveryCode);

tests/Feature/ProfileSettingsTest.php

@@ -0,0 +1,132 @@
+<?php
+
+use App\Models\User;
+use App\Notifications\PasswordChangedNotification;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Notification;
+use Inertia\Testing\AssertableInertia as Assert;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'auth-ui.features.email_verification' => false,
+        'auth-ui.features.two_factor_required' => false,
+    ]);
+});
+
+it('renders separate general and security profile pages', function () {
+    $user = User::factory()->create();
+
+    $this->actingAs($user)
+        ->get('/profile')
+        ->assertInertia(fn (Assert $page) => $page
+            ->component('Profile/Show'));
+
+    $this->actingAs($user)
+        ->get('/profile/security')
+        ->assertInertia(fn (Assert $page) => $page
+            ->component('Profile/Security')
+            ->where('twoFactor.requiresPassword', true));
+});
+
+it('updates profile details and requires email reverification after an email change', function () {
+    $user = User::factory()->create([
+        'email' => 'before@example.com',
+        'email_verified_at' => now(),
+    ]);
+
+    $this->actingAs($user)
+        ->patch('/profile', [
+            'first_name' => 'Updated',
+            'last_name' => 'Person',
+            'username' => 'updated-person',
+            'email' => 'after@example.com',
+        ])
+        ->assertRedirect('/profile')
+        ->assertSessionHas('success');
+
+    $user->refresh();
+
+    expect($user->first_name)->toBe('Updated')
+        ->and($user->last_name)->toBe('Person')
+        ->and($user->username)->toBe('updated-person')
+        ->and($user->email)->toBe('after@example.com')
+        ->and($user->email_verified_at)->toBeNull();
+});
+
+it('rejects a case-insensitive duplicate username on profile update', function () {
+    User::factory()->create(['username' => 'ExistingUser']);
+    $user = User::factory()->create(['username' => 'different-user']);
+
+    $this->actingAs($user)
+        ->patch('/profile', [
+            'first_name' => $user->first_name,
+            'last_name' => $user->last_name,
+            'username' => 'existinguser',
+            'email' => $user->email,
+        ])
+        ->assertSessionHasErrors('username');
+
+    expect($user->fresh()->username)->toBe('different-user');
+});
+
+it('requires the current password and revokes other sessions after a password change', function () {
+    Notification::fake();
+    config(['session.driver' => 'database']);
+    $user = User::factory()->create(['password' => 'current secure password']);
+
+    DB::table('sessions')->insert([
+        'id' => 'another-authenticated-session',
+        'user_id' => $user->id,
+        'ip_address' => '192.0.2.10',
+        'user_agent' => 'Test',
+        'payload' => 'payload',
+        'last_activity' => now()->timestamp,
+    ]);
+
+    $this->actingAs($user)
+        ->put('/profile/password', [
+            'current_password' => 'incorrect password',
+            'password' => 'a completely new secure password',
+            'password_confirmation' => 'a completely new secure password',
+        ])
+        ->assertSessionHasErrors('current_password');
+
+    $this->actingAs($user)
+        ->put('/profile/password', [
+            'current_password' => 'current secure password',
+            'password' => 'a completely new secure password',
+            'password_confirmation' => 'a completely new secure password',
+        ])
+        ->assertRedirect('/profile/security')
+        ->assertSessionHas('auth.session_version', 1);
+
+    $user->refresh();
+
+    expect(Hash::check('a completely new secure password', $user->password))->toBeTrue()
+        ->and($user->auth_session_version)->toBe(1)
+        ->and(DB::table('sessions')->where('id', 'another-authenticated-session')->exists())->toBeFalse();
+    $this->assertAuthenticatedAs($user);
+    Notification::assertSentTo($user, PasswordChangedNotification::class);
+});
+
+it('allows a social-only user to establish a password', function () {
+    Notification::fake();
+    $user = User::factory()->social()->create();
+
+    $this->actingAs($user)
+        ->put('/profile/password', [
+            'current_password' => '',
+            'password' => 'a secure password for social login',
+            'password_confirmation' => 'a secure password for social login',
+        ])
+        ->assertRedirect('/profile/security');
+
+    expect(Hash::check(
+        'a secure password for social login',
+        $user->fresh()->password
+    ))->toBeTrue();
+});