User Account

Account profile

Account startup restores local auth state, validates the session, then loads the user into userProvider from /api/v1/app/me. The Freezed User model includes name, email, role, UUID, verification state, avatar, phone number, joined date, and optional profile counters/metadata.

Guest projects do not restore a remote user. They clear stale Account tokens and use local onboarding/profile state.

Editing the profile

AuthNotifier.updateProfile sends the supported fields to:

PUT /api/v1/app/users/{uuid}

The Dio/API result layer maps Laravel validation and unauthorized responses into provider state. Profile/media uploads use Laravel's authenticated /api/v1/uploads route.

Preferences

user_preferences_provider.dart persists language, region, timezone, usage-data, and personalized-experience settings through SharedPreferences. Account mode debounces and synchronizes supported values through /api/v1/app/preferences, queues failures, and retries on resume/connectivity. Guest mode keeps values local and must not send requests.

Notification settings use their own local provider and Account sync service at /api/v1/app/notifications/preferences.

Security and deletion

The security providers expose:

• Active-session listing with single-session and revoke-all actions.
• Login history.
• Password change.
• Account deletion followed by local auth cleanup.

Laravel owns destructive security mutations; Go serves the protected security reads in performance mode.

Logout and 401

DioService invokes the registered unauthorized handler on a 401. AuthNotifier.localLogout clears the token, cached user, FCM token, and related Account state before AutoRoute returns to Login. Guest has no active remote session.

Relevant files

• models/user.dart
• providers/auth_provider.dart
• providers/user_provider.dart
• providers/user_preferences_provider.dart
• providers/security_provider.dart
• providers/sync/user_preferences_sync.dart
• services/fcm_service.dart
• helpers/storage.dart