The account page asserted several things that were not backed by real state:
- Two-Factor Authentication was hardcoded to "ENABLED" for every signed-in user.
Now derives from the real Firebase multiFactor enrollment and shows "NOT ENABLED"
(enroll in the mobile app) unless a factor is actually enrolled.
- "App Connections & Sync" showed a hardcoded connected iOS app (iPhone 16 Pro, v4.1.0,
"14m ago") and a paired "Cardo Packtalk Edge". Replaced with truthful states: real
Google account link, authenticated-device count from the real /api/account/sessions
data, and an honest "Unavailable on web" for Bluetooth comms/accessories (a browser
cannot observe hardware pairing). Header status reflects real sign-in state.
- Dashboard metrics initialised to fabricated totals (12,480 mi / 184 rides / 56.4 deg).
Now initialise to zero; AppCloudData replaces them with the rider's real ride totals.
- Dead controls fixed: "Manage Devices" and "Review active sessions" now anchor the real
Active Device Sessions panel; the telemetry-privacy control no longer presents an
unverified setting with a no-op "Change" button (managed in the mobile app).
Also adds the Phase 1 website feature audit matrix (docs/).
Tests: account-truthful-states asserts no fabricated device/pairing/sync claims render
and that 2FA is never shown as ENABLED without a real enrolled factor.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
217e5a11c0