Skip to main content

Profile switching

Status: ✅ Active-member lens shipped (on the Profile page) · 🔜 shared-device PIN-gated picker deferred

Scope​

Two distinct things share the "switch profile" idea; only the first has shipped.

Active-member lens (shipped)​

The active-member switcher lives on the Profile page — a Google-account-style list (it replaced the old top-header account-switcher chip). It is capability-gated: only a viewer who may already select a non-self identity sees other members (a child is locked to self). Selecting a member re-scopes what the UI displays — the top-bar identity avatar, the Profile nav icon, catalogs, and the active-member subsections (My Cosmos) all follow the selection and update together.

This is a display lens only, never a second principal. The authenticated member (CurrentMemberRepository.current) stays the sole actor for every gated call and for RLS — see Authorization ("Viewing as" is not authorization). The proxy read-only rule applies: while proxied (active member ≠ authenticated self), member-owned surfaces (companion sheet, My Cosmos) are read-only, enforced by the SDK's self-only mutation.

Shared-device PIN-gated picker (deferred)​

A separate "who is using this device" picker for shared tablets / TV lean-back displays — auto-appearing on launch for shared devices and PIN-protected for adult profiles — is not yet built. It builds on the shipped lens but adds device-session semantics and a PIN gate.

Open questions (shared-device picker only)​

  • Does switching profiles re-authenticate (full session swap) or just switch display context?
  • Should the picker auto-appear on app launch for devices flagged as "shared"?
  • How does this interact with kid-mode pin-lock — is the PIN per-profile or household-wide?
  • Can a child's profile be PIN-locked to prevent accidental switch-away?

Relationship​

Kid-mode pin lock — PIN gate applies when switching to/from kid profiles.