User Profiles with Multi-Factor Authentication

Users can set a display name, preferred language, and enrol in MFA — without leaving the portal.

The Intellixer portal now has a full user profile page. Identity settings that used to require a support ticket are self-service in seconds.

Profile fields

Display name — shown in the portal header and audit logs instead of your raw UID
Preferred language — switch the portal UI between English and Italian; stored per account
Email — read-only, managed by Firebase Authentication

Multi-Factor Authentication

Users can enrol a second factor (TOTP or SMS) directly from the profile page using Firebase's MFA enrollment flow. Once enrolled, every new login session requires the second factor before the portal is accessible. MFA can be unenrolled from the same page — the portal immediately invalidates the active session to force re-authentication.

Implementation

Migration 012 adds display_name TEXT and preferred_lang TEXT to the users table. Profile updates are validated server-side; display names are length-capped and HTML-escaped before storage. MFA state is owned entirely by Firebase — no MFA secrets touch the Intellixer database.