Ahh interesting. GitHub users shouldn't be able to change anything about themselves I suppose.

Yeah that's my thought, @deansheather and I have discussed also not allowing password auth users from changing email as well, since that's also kind of a security issue - An admin invites garrett@coder.com, I log in and change it to secretperson@spooky.com and the admin now has no clue who this person is on their coder deployment.

Seems like we should associate OAuth connections separately to the account. I feel like @spikecurtis might have some good thoughts here.

What are we using "username" and "email" for on the platform?

@f0ssel will you ping the frontend crew in the #dev-ux channel when you start this so so we can understand what changes may be needed here? We will need to spin up a ticket for that frontend work.

@f0ssel I have time to do this, want me to pick this up?

After talking with @deansheather and @Emyrk we've come up with the following proposal:

Since users can have both built-in and github auth for a single user, it's not possible to deterministically tell which users are github users and which ones are built-in. Because of the current ambiguity in the system, we are suggesting that no user should be allowed to change email.

I can just remove the email field from the API and get the frontend to make it a read-only field.