slapd refuses to remove an RDN value, and every legacy account is
cn=<name>,ou=People, so a name edit there always failed. Those accounts
now see their name read-only (the view rejects the profile action and
update_profile refuses as a backstop); uid-named accounts from website
registration can still edit it. README documents the cn/mail self-write
ACL and mail uniqueness overlay now applied in production.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Dex LDAP connector publishes uid, cn and mail as claims, so the
profile page now offers just Name (cn), the verified email change and
the password. The photo endpoint, SSH keys, addresses, phones and
other extended attributes are no longer read or written; existing LDAP
values are left untouched. Apache's profile upload limit drops back to
the 256 KiB used by other member routes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An unticked checkbox on registration subscribes the verified address to
the listmonk list (preconfirmed) once the account exists. The profile
page gets a subscribe/unsubscribe toggle, and verified email changes
follow through to listmonk. Newsletter outages never block accounts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Count every membership account (free and paid together) on each page
load and show it under the headline; no per-tier numbers. Hidden when
there are no members.
Also correct the reference tiers.eom.json and service-groups.eom.json
to the real LDAP DNs (ou=Memberships; ou=<Service>,ou=Services), which
now match the ansible-role-www defaults.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>