feat: add password reset email

app/(app)/(auth)/layout.tsx

@@ -1,13 +1,47 @@
+"use client";
+
 /**
  * Shared layout for the auth pages (login, signup, forgot-password,
  * reset-password). Provides the centered card frame so each page only
  * has to render its own form.
+ *
+ * Also gates the routes: a signed-in user landing on any /login, /signup,
+ * etc. URL is bounced to /u/me (or the `next` query param if present).
+ * The check happens client-side because auth state lives in
+ * AuthProvider — there's no server-side cookie inspection here yet, and
+ * the redirect is purely cosmetic (logged-in users don't gain anything
+ * from re-seeing these forms, and signing in over an existing session
+ * would just no-op).
  */
+
+import { useEffect } from "react";
+import { useRouter, useSearchParams } from "next/navigation";
+import { useAuth } from "@/components/auth/auth-provider";
+
 export default function AuthLayout({
   children,
 }: {
   children: React.ReactNode;
 }) {
+  const { user, loading } = useAuth();
+  const router = useRouter();
+  const params = useSearchParams();
+
+  useEffect(() => {
+    if (loading || !user) return;
+    const next = params.get("next");
+    router.replace(next && next.startsWith("/") ? next : "/u/me");
+  }, [loading, user, router, params]);
+
+  // Don't flash the form for an instant before the redirect fires.
+  if (!loading && user) {
+    return (
+      <main className="flex items-center justify-center px-4 py-12 min-h-[90vh]">
+        <p className="text-sm text-muted-foreground">Redirecting…</p>
+      </main>
+    );
+  }
+
   return (
     <main className="flex items-center justify-center px-4 py-12 min-h-[90vh]">
       <div className="w-full max-w-md">{children}</div>

app/(app)/(auth)/login/page.tsx

@@ -37,8 +37,6 @@ function LoginContent() {
 
 function oauthErrorMessage(code: string): string {
   switch (code) {
-    case "email_required":
-      return "We couldn't sign you in because the provider didn't share an email. Please use the email/password form below.";
     case "invalid_state":
     case "missing_state":
       return "Your sign-in link expired. Please try again.";

app/(app)/settings/page.tsx

@@ -0,0 +1,218 @@
+"use client";
+
+/**
+ * /settings — the top-level user-settings screen.
+ *
+ * Lives outside the /u/me profile layout so it doesn't carry the
+ * ProfileHeader + tabs that frame the profile views. It sits directly
+ * under (app)/, which gives it the default site chrome (sidebar, header,
+ * etc.) without the profile-specific frame on top.
+ *
+ * Sections are stacked plain — no per-section card chrome — so the page
+ * reads as a single ordered list of preferences rather than a dashboard
+ * of widgets. To add a new section, drop another <Section> in the
+ * `<main>` below.
+ */
+
+import { useState } from "react";
+import Link from "next/link";
+import { ChevronLeft, ChevronRight } from "lucide-react";
+import { ChangePasswordModal } from "@/components/auth/change-password-modal";
+import { ReadingSettings } from "@/components/reading-settings";
+
+const BFF_BASE =
+  process.env.NEXT_PUBLIC_BFF_URL || "http://localhost:8080";
+
+export default function SettingsPage() {
+  return (
+    <main className="flex-1 max-w-3xl w-full mx-auto px-4 sm:px-6 py-6 space-y-10">
+      <header className="space-y-1">
+        <Link
+          href="/u/me"
+          className="inline-flex items-center gap-1 text-sm text-muted-foreground hover:text-foreground transition-colors"
+        >
+          <ChevronLeft className="size-4" />
+          Back to profile
+        </Link>
+        <h1 className="font-[family-name:var(--font-title)] text-3xl font-semibold text-foreground pt-2">
+          Settings
+        </h1>
+      </header>
+
+      <Section
+        title="Reading preferences"
+        description="Theme, palette, font, and size — synced across your devices."
+      >
+        <ReadingSettings variant="bare" />
+      </Section>
+
+      <Section title="Authentication">
+        <AuthenticationSection />
+      </Section>
+
+      <Section title="Legal">
+        <LegalSection />
+      </Section>
+    </main>
+  );
+}
+
+function Section({
+  title,
+  description,
+  children,
+}: {
+  title: string;
+  description?: string;
+  children: React.ReactNode;
+}) {
+  return (
+    <section className="space-y-4">
+      <div className="border-b border-border pb-3">
+        <h2 className="font-[family-name:var(--font-title)] text-xl font-semibold text-foreground">
+          {title}
+        </h2>
+        {description ? (
+          <p className="text-sm text-muted-foreground mt-1">{description}</p>
+        ) : null}
+      </div>
+      <div>{children}</div>
+    </section>
+  );
+}
+
+// ─── Authentication ────────────────────────────────────────────────────
+
+function AuthenticationSection() {
+  const [pwModalOpen, setPwModalOpen] = useState(false);
+  const next = "/settings";
+
+  function startOAuth(provider: "facebook" | "google") {
+    const u = new URL(`${BFF_BASE}/api/v1/auth/oauth/${provider}/start`);
+    u.searchParams.set("next", next);
+    return u.toString();
+  }
+
+  return (
+    <>
+      <ul className="divide-y divide-border">
+        {/* Google sign-in — uncomment once the Google OAuth app clears review.
+        <Row
+          label="Connect your Google account"
+          action={
+            <a
+              href={startOAuth("google")}
+              className="text-sm font-medium text-primary hover:underline"
+            >
+              Connect
+            </a>
+          }
+        />
+        */}
+        <Row
+          icon={<FacebookGlyph />}
+          label="Connect your Facebook account"
+          action={
+            <a
+              href={startOAuth("facebook")}
+              className="text-sm font-medium text-primary hover:underline"
+            >
+              Connect
+            </a>
+          }
+        />
+        <Row
+          label="Change your password"
+          description="Update the password you use to sign in."
+          action={
+            <button
+              type="button"
+              onClick={() => setPwModalOpen(true)}
+              className="text-sm font-medium text-primary hover:underline"
+            >
+              Change
+            </button>
+          }
+        />
+      </ul>
+      <ChangePasswordModal
+        open={pwModalOpen}
+        onClose={() => setPwModalOpen(false)}
+      />
+    </>
+  );
+}
+
+// ─── Legal ─────────────────────────────────────────────────────────────
+
+function LegalSection() {
+  return (
+    <ul className="divide-y divide-border">
+      <LegalLink href="/terms" label="Terms of Service" />
+      <LegalLink href="/privacy" label="Privacy Policy" />
+      <LegalLink href="/data-deletion" label="Steps for data deletion" />
+    </ul>
+  );
+}
+
+function LegalLink({ href, label }: { href: string; label: string }) {
+  return (
+    <li>
+      <Link
+        href={href}
+        className="flex items-center justify-between py-3 group"
+      >
+        <span className="text-sm text-foreground group-hover:text-primary transition-colors">
+          {label}
+        </span>
+        <ChevronRight className="size-4 text-muted-foreground group-hover:text-foreground transition-colors" />
+      </Link>
+    </li>
+  );
+}
+
+// ─── Row helper ────────────────────────────────────────────────────────
+
+function FacebookGlyph() {
+  return (
+    <svg
+      className="size-4"
+      viewBox="0 0 24 24"
+      xmlns="http://www.w3.org/2000/svg"
+      aria-hidden
+    >
+      <path
+        fill="#1877F2"
+        d="M24 12a12 12 0 1 0-13.88 11.85V15.47H7.08V12h3.04V9.36c0-3 1.79-4.67 4.53-4.67 1.31 0 2.69.24 2.69.24v2.96H15.83c-1.49 0-1.95.92-1.95 1.87V12h3.32l-.53 3.47h-2.79v8.38A12 12 0 0 0 24 12Z"
+      />
+    </svg>
+  );
+}
+
+function Row({
+  icon,
+  label,
+  description,
+  action,
+}: {
+  icon?: React.ReactNode;
+  label: string;
+  description?: string;
+  action: React.ReactNode;
+}) {
+  return (
+    <li className="flex items-center justify-between gap-4 py-3">
+      <div className="min-w-0">
+        <div className="flex items-center gap-2">
+          {icon ? <span className="shrink-0">{icon}</span> : null}
+          <span className="text-sm text-foreground truncate">{label}</span>
+        </div>
+        {description ? (
+          <p className="text-xs text-muted-foreground mt-0.5">{description}</p>
+        ) : null}
+      </div>
+      <div className="shrink-0">{action}</div>
+    </li>
+  );
+}
+

app/(app)/u/me/layout.tsx

@@ -14,7 +14,7 @@
  */
 
 import { Suspense, useEffect } from "react";
-import { usePathname, useRouter, useSearchParams } from "next/navigation";
+import { useRouter, useSearchParams } from "next/navigation";
 import {
   AtSign,
   Bookmark,
@@ -102,13 +102,8 @@ export default function MeLayout({ children }: { children: React.ReactNode }) {
 
 function ConditionalTabs({ tabs }: { tabs: ProfileTab[] }) {
   const searchParams = useSearchParams();
-  const pathname = usePathname();
+  // Hide tabs when the user is editing their profile inline — the strip
-  // Hide tabs when the user is in a focused subview:
+  // is visual noise that distracts from the task they navigated in to do.
-  //   • /u/me?edit=1     — the inline profile-edit form
-  //   • /u/me/settings   — the reading-prefs page
-  // In either case the strip is visual noise that distracts from the
-  // task they navigated in to do.
   const editMode = searchParams.get("edit") === "1";
-  const settingsMode = pathname.startsWith("/u/me/settings");
+  return editMode ? null : <ProfileTabs tabs={tabs} />;
-  return editMode || settingsMode ? null : <ProfileTabs tabs={tabs} />;
 }

app/(app)/u/me/settings/page.tsx

@@ -1,43 +0,0 @@
-"use client";
-
-/**
- * /u/me/settings — dedicated reading-preferences screen for auth users.
- *
- * Mirrors the Edit Profile pattern: a focused subview of /u/me that
- * trades the tab strip for a back link + the settings form. We send
- * users here instead of opening the popover because the popover, when
- * triggered from ProfileHeader's centred action row, can spill off the
- * left edge of narrow viewports. Anonymous users still get the popover
- * in SiteHeader — that trigger sits at right-2 so it doesn't overflow.
- *
- * The /u/me layout's ConditionalTabs detects this path and hides the
- * Posts/Collections/Bookmarks/Mentions strip while the user is editing
- * settings.
- */
-
-import Link from "next/link";
-import { ChevronLeft } from "lucide-react";
-import { ReadingSettings } from "@/components/reading-settings";
-
-export default function ReadingSettingsPage() {
-  return (
-    <div className="space-y-6">
-      <Link
-        href="/u/me"
-        className="inline-flex items-center gap-1 text-sm text-muted-foreground hover:text-foreground transition-colors"
-      >
-        <ChevronLeft className="size-4" />
-        Back to profile
-      </Link>
-      <div>
-        <h1 className="font-[family-name:var(--font-title)] text-2xl font-semibold text-foreground">
-          Reading settings
-        </h1>
-        <p className="text-sm text-muted-foreground mt-1">
-          Theme, palette, font, and size — synced across your devices.
-        </p>
-      </div>
-      <ReadingSettings variant="inline" />
-    </div>
-  );
-}

components/auth/change-password-modal.tsx

@@ -0,0 +1,201 @@
+"use client";
+
+/**
+ * ChangePasswordModal — three-field "change my password" form rendered in
+ * a centred portal dialog. Mirrors the AuthModal pattern (backdrop +
+ * fixed-position card + Esc-to-close + body scroll-lock) so the look and
+ * feel matches.
+ *
+ * Opens from /settings → Authentication → Change password.
+ *
+ * On success: closes itself, refreshes the user state via auth-provider's
+ * setUser so the rest of the app sees the fresh JWT-backed user. The BFF
+ * has already re-issued the session cookie, so the caller stays signed in
+ * on this device.
+ */
+
+import { useEffect, useState } from "react";
+import { createPortal } from "react-dom";
+import { X } from "lucide-react";
+import { useAuth } from "@/components/auth/auth-provider";
+import { auth, AuthError } from "@/lib/auth";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+
+export function ChangePasswordModal({
+  open,
+  onClose,
+}: {
+  open: boolean;
+  onClose: () => void;
+}) {
+  const { user, setUser } = useAuth();
+  // OAuth-only accounts have no existing password to verify against — the
+  // modal renders two fields (new + confirm) instead of three. Backend
+  // accepts current_password as optional in this case.
+  const requireCurrent = user?.has_password ?? true;
+  const [current, setCurrent] = useState("");
+  const [next, setNext] = useState("");
+  const [confirm, setConfirm] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [submitting, setSubmitting] = useState(false);
+
+  // Reset form whenever the modal closes — re-opening should start blank,
+  // not show the previous attempt.
+  useEffect(() => {
+    if (open) return;
+    setCurrent("");
+    setNext("");
+    setConfirm("");
+    setError(null);
+    setSubmitting(false);
+  }, [open]);
+
+  // Esc-to-close.
+  useEffect(() => {
+    if (!open) return;
+    function onKey(e: KeyboardEvent) {
+      if (e.key === "Escape") onClose();
+    }
+    document.addEventListener("keydown", onKey);
+    return () => document.removeEventListener("keydown", onKey);
+  }, [open, onClose]);
+
+  // Body scroll-lock while the modal is open.
+  useEffect(() => {
+    if (!open) return;
+    const prev = document.body.style.overflow;
+    document.body.style.overflow = "hidden";
+    return () => {
+      document.body.style.overflow = prev;
+    };
+  }, [open]);
+
+  if (!open || typeof document === "undefined") return null;
+
+  async function onSubmit(e: React.SyntheticEvent) {
+    e.preventDefault();
+    setError(null);
+    if (next.length < 8) {
+      setError("New password must be at least 8 characters.");
+      return;
+    }
+    if (next !== confirm) {
+      setError("New passwords don't match.");
+      return;
+    }
+    setSubmitting(true);
+    try {
+      const updated = await auth.changePassword(current, next);
+      setUser(updated);
+      onClose();
+    } catch (err) {
+      setError(
+        err instanceof AuthError ? err.message : "Could not change password.",
+      );
+    } finally {
+      setSubmitting(false);
+    }
+  }
+
+  return createPortal(
+    <>
+      <div
+        className="fixed inset-0 z-100 bg-foreground/40 backdrop-blur-sm animate-in fade-in-0"
+        onClick={onClose}
+        aria-hidden
+      />
+      <div
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby="change-password-title"
+        className="fixed left-1/2 top-1/2 z-101 w-full max-w-md -translate-x-1/2 -translate-y-1/2 px-4"
+      >
+        <div className="rounded-2xl border border-border bg-card shadow-xl overflow-hidden">
+          <header className="flex items-center justify-between px-5 py-4 border-b border-border">
+            <h2
+              id="change-password-title"
+              className="font-[family-name:var(--font-title)] font-semibold text-xl text-foreground"
+            >
+              Change password
+            </h2>
+            <button
+              type="button"
+              onClick={onClose}
+              className="size-8 rounded-lg text-muted-foreground hover:text-foreground hover:bg-muted inline-flex items-center justify-center"
+              aria-label="Close"
+            >
+              <X className="size-4" />
+            </button>
+          </header>
+
+          <form onSubmit={onSubmit} className="px-5 py-5 space-y-4">
+            {requireCurrent ? (
+              <div className="space-y-1.5">
+                <Label htmlFor="cp-current">Current password</Label>
+                <Input
+                  id="cp-current"
+                  type="password"
+                  autoComplete="current-password"
+                  required
+                  value={current}
+                  onChange={(e) => setCurrent(e.target.value)}
+                />
+              </div>
+            ) : null}
+            <div className="space-y-1.5">
+              <Label htmlFor="cp-new">New password</Label>
+              <Input
+                id="cp-new"
+                type="password"
+                autoComplete="new-password"
+                minLength={8}
+                required
+                value={next}
+                onChange={(e) => setNext(e.target.value)}
+              />
+              <p className="text-xs text-muted-foreground">
+                At least 8 characters.
+              </p>
+            </div>
+            <div className="space-y-1.5">
+              <Label htmlFor="cp-confirm">Confirm new password</Label>
+              <Input
+                id="cp-confirm"
+                type="password"
+                autoComplete="new-password"
+                required
+                value={confirm}
+                onChange={(e) => setConfirm(e.target.value)}
+              />
+            </div>
+
+            {error ? (
+              <p className="text-sm text-destructive">{error}</p>
+            ) : null}
+
+            <div className="flex items-center justify-end gap-2 pt-1">
+              <Button
+                type="button"
+                variant="ghost"
+                onClick={onClose}
+                className="h-10 px-4 text-sm"
+              >
+                Cancel
+              </Button>
+              <Button
+                type="submit"
+                disabled={submitting}
+                className="h-10 px-4 text-sm"
+              >
+                {submitting ? "Saving…" : "Save changes"}
+              </Button>
+            </div>
+          </form>
+        </div>
+      </div>
+    </>,
+    document.body,
+  );
+}

components/auth/user-menu.tsx

@@ -138,7 +138,7 @@ export function UserMenu() {
               {user.name}
             </p>
             <p className="text-xs text-muted-foreground truncate">
-              {user.email}
+              {user.email ?? `@${user.handle}`}
             </p>
           </div>
           <div className="h-px bg-border my-1" />

components/auth/verify-email-banner.tsx

@@ -5,27 +5,34 @@ import { auth, AuthError } from "@/lib/auth";
 import { useAuth } from "./auth-provider";
 
 /**
- * Persistent top ribbon shown when a logged-in user has not yet verified
+ * Top ribbon for accounts whose email is either missing (OAuth sign-up
- * their email. Lets them re-trigger the verification mail without leaving
+ * without an address) or present-but-unverified.
- * the page.
+ *
+ * Two modes:
+ *   • Missing email — an inline "Add your email" input that POSTs to
+ *     /auth/email. On success the user state refreshes and the banner
+ *     automatically flips into the "verify your email" mode.
+ *   • Unverified email — existing "Resend verification" call to action.
  *
  * Renders nothing when:
  *   - auth state is still loading
  *   - user is logged out
- *   - user.email_verified_at is set
+ *   - user.email_verified_at is set (the address has been confirmed)
- *   - user dismissed it for this session (banner is meant to be persistent
+ *   - user dismissed it for this session (persistent across navigations
- *     across navigations but skippable per-tab; we keep the dismissed flag
+ *     but reset on full page refresh)
- *     in component state so a refresh brings it back)
  */
 export function VerifyEmailBanner() {
-  const { user, loading } = useAuth();
+  const { user, loading, setUser } = useAuth();
   const [sent, setSent] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [busy, setBusy] = useState(false);
   const [dismissed, setDismissed] = useState(false);
+  const [newEmail, setNewEmail] = useState("");
 
   if (loading || !user || user.email_verified_at || dismissed) return null;
 
+  const needsEmail = !user.email;
+
   async function onResend() {
     setError(null);
     setBusy(true);
@@ -41,18 +48,68 @@ export function VerifyEmailBanner() {
     }
   }
 
+  async function onSetEmail(e: React.FormEvent) {
+    e.preventDefault();
+    setError(null);
+    setBusy(true);
+    try {
+      const updated = await auth.setEmail(newEmail);
+      setUser(updated);
+      setSent(true);
+    } catch (err) {
+      setError(err instanceof AuthError ? err.message : "Could not save email.");
+    } finally {
+      setBusy(false);
+    }
+  }
+
   return (
     <div className="w-full bg-amber-50 dark:bg-amber-950/40 text-amber-900 dark:text-amber-100 border-b border-amber-200/60 dark:border-amber-800/60">
       <div className="max-w-5xl mx-auto px-4 py-2 flex flex-wrap items-center justify-between gap-3 text-sm">
-        <p>
+        {sent ? (
-          {sent
+          <p>
-            ? "✓ Verification email sent — check your inbox."
+            {needsEmail
-            : error
+              ? "✓ Email saved — check your inbox for a verification link."
-              ? error
+              : "✓ Verification email sent — check your inbox."}
-              : `Verify your email (${user.email}) to secure your account.`}
+          </p>
-        </p>
+        ) : needsEmail ? (
+          <form
+            onSubmit={onSetEmail}
+            className="flex flex-1 flex-wrap items-center gap-2"
+          >
+            <label htmlFor="banner-email" className="shrink-0">
+              Add an email to your account:
+            </label>
+            <input
+              id="banner-email"
+              type="email"
+              required
+              value={newEmail}
+              onChange={(e) => setNewEmail(e.target.value)}
+              placeholder="you@example.com"
+              className="flex-1 min-w-[12rem] rounded-md border border-amber-300/70 dark:border-amber-800/70 bg-white/70 dark:bg-amber-950/30 px-2 py-1 text-amber-900 dark:text-amber-50 placeholder:text-amber-700/50 dark:placeholder:text-amber-200/40"
+            />
+            <button
+              type="submit"
+              disabled={busy || newEmail.trim() === ""}
+              className="font-medium underline-offset-2 hover:underline disabled:opacity-60"
+            >
+              {busy ? "Saving…" : "Save"}
+            </button>
+            {error ? (
+              <span className="text-amber-900/80 dark:text-amber-100/80">
+                {error}
+              </span>
+            ) : null}
+          </form>
+        ) : (
+          <p>
+            {error ?? `Verify your email (${user.email}) to secure your account.`}
+          </p>
+        )}
+
         <div className="flex items-center gap-2">
-          {!sent ? (
+          {!sent && !needsEmail ? (
             <button
               type="button"
               onClick={onResend}

components/profile/profile-edit-form.tsx

@@ -171,10 +171,16 @@ export function ProfileEditForm({
 
         <div className="space-y-1.5">
           <Label htmlFor="profile-email">Email</Label>
-          <Input id="profile-email" value={user.email} disabled />
+          {user.email ? (
-          <p className="text-xs text-muted-foreground">
+            <>
-            Email changes aren&apos;t supported yet.
+              <Input id="profile-email" value={user.email} disabled />
-          </p>
+              <p className="text-xs text-muted-foreground">
+                Email changes aren&apos;t supported yet.
+              </p>
+            </>
+          ) : (
+            <AddEmailInline />
+          )}
         </div>
       </div>
 
@@ -202,6 +208,66 @@ export function ProfileEditForm({
   );
 }
 
+function AddEmailInline() {
+  const { setUser } = useAuth();
+  const [email, setEmail] = useState("");
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [sent, setSent] = useState(false);
+
+  async function onSave(e: React.FormEvent) {
+    e.preventDefault();
+    setError(null);
+    setSaving(true);
+    try {
+      const updated = await auth.setEmail(email);
+      setUser(updated);
+      setSent(true);
+    } catch (err) {
+      setError(err instanceof AuthError ? err.message : "Could not save email.");
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  if (sent) {
+    return (
+      <p className="text-xs text-muted-foreground">
+        ✓ Email saved — check your inbox for a verification link.
+      </p>
+    );
+  }
+
+  return (
+    <form onSubmit={onSave} className="space-y-1.5">
+      <div className="flex gap-2">
+        <Input
+          id="profile-email"
+          type="email"
+          required
+          value={email}
+          onChange={(e) => setEmail(e.target.value)}
+          placeholder="you@example.com"
+        />
+        <Button
+          type="submit"
+          disabled={saving || email.trim() === ""}
+          className="h-10 px-3 text-sm"
+        >
+          {saving ? "Saving…" : "Save"}
+        </Button>
+      </div>
+      {error ? (
+        <p className="text-xs text-destructive">{error}</p>
+      ) : (
+        <p className="text-xs text-muted-foreground">
+          Add an email to enable password recovery and notifications.
+        </p>
+      )}
+    </form>
+  );
+}
+
 function AvatarPreview({ src, name }: { src: string | null; name: string }) {
   if (src) {
     return (

components/profile/profile-header.tsx

@@ -12,8 +12,8 @@
  *     "is this my profile?" signal (the /u/me layout passes it; the
  *     /u/[handle] layout does not), so the two buttons stay in lockstep
  *     and visitors on someone else's profile see a clean row with no
- *     personal-settings affordances. The gear links to /u/me/settings
+ *     personal-settings affordances. The gear links to /settings (the
- *     (the inline reading-prefs page) rather than opening a popover —
+ *     dedicated settings page) rather than opening a popover —
  *     centred-row popovers tend to spill off the left edge on narrow
  *     viewports.
  *
@@ -84,9 +84,9 @@ export function ProfileHeader({
           ) : null}
           {showReadingSettings ? (
             <Link
-              href="/u/me/settings"
+              href="/settings"
-              aria-label="Reading settings"
+              aria-label="Settings"
-              title="Reading settings"
+              title="Settings"
               className={cn(
                 "size-9 inline-flex items-center justify-center rounded-lg",
                 "border border-border text-foreground hover:bg-muted",

components/reading-settings.tsx

@@ -242,8 +242,12 @@ type Placement = "below-right" | "above-left";
  *     can push the panel off-screen, which is why auth users get the
  *     dedicated settings page instead.
  *   - "inline" — render the controls flat as part of normal page flow,
- *     full-width up to a sensible cap. Used by /u/me/settings. */
+ *     full-width up to a sensible cap, wrapped in a subtle card.
-type Variant = "popover" | "inline";
+ *   - "bare" — like "inline" but with no card chrome at all. The controls
+ *     blend into the surrounding page as a normal section. Used by the
+ *     top-level /settings screen where reading prefs are just one of
+ *     several stacked sections. */
+type Variant = "popover" | "inline" | "bare";
 
 export function ReadingSettings({
   variant = "popover",
@@ -468,9 +472,9 @@ export function ReadingSettings({
     visiblePalettes.find((p) => p.id === activePaletteId)?.name ?? "";
 
   if (!mounted) {
-    // Inline variant: render nothing until mounted so we don't flash a
+    // Inline / bare variants: render nothing until mounted so we don't
-    // misaligned skeleton on the dedicated settings page.
+    // flash a misaligned skeleton on the dedicated settings page.
-    if (variant === "inline") return null;
+    if (variant === "inline" || variant === "bare") return null;
     return (
       <Button variant="ghost" size="icon-sm" aria-label="Reading settings">
         <Settings className="size-4" />
@@ -611,8 +615,7 @@ export function ReadingSettings({
 
   // ── Inline variant ──────────────────────────────────────────────────
   // Renders the same controls as a flush, full-width card. No popover
-  // positioning, so it can't drift off-viewport on a narrow screen. Used
+  // positioning, so it can't drift off-viewport on a narrow screen.
-  // by /u/me/settings.
   if (variant === "inline") {
     return (
       <div className="w-full max-w-xl rounded-lg border border-border bg-card p-4 sm:p-5">
@@ -621,6 +624,15 @@ export function ReadingSettings({
     );
   }
 
+  // ── Bare variant ────────────────────────────────────────────────────
+  // No card, no border — controls render flush with the surrounding page
+  // so the section reads as part of the main flow rather than a callout.
+  // Used by /settings, where reading prefs sit alongside several other
+  // unstyled sections.
+  if (variant === "bare") {
+    return <div className="w-full">{panelInner}</div>;
+  }
+
   // ── Popover variant (default) ───────────────────────────────────────
   const toggle = () => setOpen((v) => !v);
 

lib/auth.ts

@@ -16,13 +16,23 @@ const BFF_BASE =
 
 export type User = {
   id: string;
-  email: string;
+  /**
+   * Nullable: OAuth users (notably some Facebook accounts) may sign up
+   * without sharing an email. They can fill it in later via `auth.setEmail`.
+   */
+  email: string | null;
   handle: string;
   name: string;
   avatar_url: string | null;
   role: string;
   plan: "free" | "premium";
   email_verified_at: string | null;
+  /**
+   * True when the account has a password hash on file. False for OAuth-only
+   * users who haven't set one yet — the frontend uses this to pick between
+   * the "Change password" modal and the "Set a password" flow.
+   */
+  has_password: boolean;
   created_at: string;
   updated_at: string;
 };
@@ -112,6 +122,32 @@ export const auth = {
   resendVerification: () =>
     authFetch<{ ok: boolean }>("/auth/resend-verification", { method: "POST" }),
 
+  /**
+   * Sets (or replaces) the signed-in user's email. The new address is stored
+   * as unverified and a verification link is mailed out immediately. Used by
+   * the "add your email" prompt for OAuth users who signed up without one.
+   */
+  setEmail: (email: string) =>
+    authFetch<User>("/auth/email", {
+      method: "POST",
+      body: JSON.stringify({ email }),
+    }),
+
+  /**
+   * Replaces the signed-in user's password. The BFF verifies the current
+   * password, hashes the new one, and re-issues the session cookie so this
+   * device stays logged in (every other device is signed out the next time
+   * its JWT is checked).
+   */
+  changePassword: (currentPassword: string, newPassword: string) =>
+    authFetch<User>("/auth/change-password", {
+      method: "POST",
+      body: JSON.stringify({
+        current_password: currentPassword,
+        new_password: newPassword,
+      }),
+    }),
+
   updateProfile: (
     name?: string,
     avatarURL?: string | null,