Add tenant profile customization endpoints

- PATCH /api/auth/profile — update name, business name, email
- POST /api/auth/change-password — in-app password change
- POST /api/auth/phone/request — send OTP to new phone
- POST /api/auth/phone/confirm — verify OTP, update phone, notify old number
- messages.js: phoneChangeOtp, phoneChangeNotice templates
- rateLimiter.js: phoneOtpLimiter (3/30min)
- Docs updated in API_DOCUMENTATION.md and FRONTEND_DESIGN_SYSTEM.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

API_DOCUMENTATION.md

@@ -164,6 +164,89 @@ Get the authenticated tenant's profile.
 
 ---
 
+### PATCH `/api/auth/profile`
+Update contact name, business name, or email. Send only the fields you want to change.
+
+**Auth:** Required
+
+**Request body:**
+```json
+{
+  "contact_name":  "Jane Doe",
+  "business_name": "Sunset Hotel",
+  "email":         "jane@sunset.co.tz"
+}
+```
+
+**Response `200`:** Updated client object (same shape as `GET /api/auth/me`).  
+**Error `409`:** Email already in use by another account.
+
+---
+
+### POST `/api/auth/change-password`
+Change password while logged in. Requires the current password as proof.
+
+**Auth:** Required
+
+**Request body:**
+```json
+{
+  "current_password": "OldPass123",
+  "new_password":     "NewPass456"
+}
+```
+
+**Response `200`:**
+```json
+{ "message": "Password changed successfully" }
+```
+
+**Error `401`:** Current password is incorrect.
+
+---
+
+### POST `/api/auth/phone/request`
+Send a 6-digit OTP to a new phone number to verify the tenant owns it.  
+Rate limited: 3 requests per 30 minutes.
+
+**Auth:** Required
+
+**Request body:**
+```json
+{ "new_phone": "0754000111" }
+```
+
+**Response `200`:**
+```json
+{ "message": "Verification code sent to new phone number" }
+```
+
+**Error `409`:** Phone already in use by another account.
+
+---
+
+### POST `/api/auth/phone/confirm`
+Verify the OTP and update the phone number. Sends a security notice SMS to the old number.
+
+**Auth:** Required
+
+**Request body:**
+```json
+{
+  "new_phone": "0754000111",
+  "otp":       "847291"
+}
+```
+
+**Response `200`:**
+```json
+{ "message": "Phone number updated successfully" }
+```
+
+**Error `400`:** Invalid or expired OTP.
+
+---
+
 ## 2. Tenant — Devices
 
 A **device** represents one WiFi access point (AP) registered to a tenant. Each device maps to one Omada site and has its own captive portal, WiFi plans, billing, and guest sessions.

FRONTEND_DESIGN_SYSTEM.md

@@ -513,9 +513,23 @@ Mark all resolved button.
 
 ### Profile / Settings
 
-Fields: Contact name, Email, Phone (read-only — used for SMS/M-Pesa).
-
-Change password form: current password, new password, confirm.
+Three cards stacked vertically:
+
+**Profile card** — `PATCH /api/auth/profile`
+- Fields: Contact name, Business name, Email
+- Save button — updates on submit, shows success toast
+
+**Change password card** — `POST /api/auth/change-password`
+- Fields: Current password, New password, Confirm new password
+- Client-side validation: new passwords match, min 8 chars
+- On `401`: show inline error "Current password is incorrect"
+
+**Phone number card** — two-step flow
+- Shows current phone (read-only display)
+- "Change phone number" button → expands a form:
+  - Step 1: Enter new phone → `POST /api/auth/phone/request` → shows OTP input
+  - Step 2: Enter OTP → `POST /api/auth/phone/confirm` → updates display, collapses form
+- Note beneath: "Your phone is used for M-Pesa payments and SMS alerts"
 
 ---
 

src/middleware/rateLimiter.js

@@ -46,4 +46,13 @@ const portalAuthLimiter = rateLimit({
   message: { error: 'Too many authorization attempts. Try again in 15 minutes.' },
 });
 
-module.exports = { loginLimiter, registerLimiter, forgotPasswordLimiter, purchaseLimiter, portalAuthLimiter };
+// Phone change OTP — 3 requests per 30 min per IP (prevents SMS bombing new numbers)
+const phoneOtpLimiter = rateLimit({
+  windowMs: 30 * 60 * 1000,
+  max:      3,
+  standardHeaders: true,
+  legacyHeaders:   false,
+  message: { error: 'Too many verification requests. Try again in 30 minutes.' },
+});
+
+module.exports = { loginLimiter, registerLimiter, forgotPasswordLimiter, purchaseLimiter, portalAuthLimiter, phoneOtpLimiter };

src/routes/auth.routes.js

@@ -4,7 +4,7 @@ const db       = require('../config/db');
 const sms      = require('../services/sms');
 const messages = require('../utils/messages');
 const { requireAuth, signToken } = require('../middleware/auth');
-const { loginLimiter, registerLimiter, forgotPasswordLimiter } = require('../middleware/rateLimiter');
+const { loginLimiter, registerLimiter, forgotPasswordLimiter, phoneOtpLimiter } = require('../middleware/rateLimiter');
 
 // POST /api/auth/register
 router.post('/register', registerLimiter, async (req, res) => {
@@ -143,6 +143,143 @@ router.post('/reset-password', async (req, res) => {
   }
 });
 
+// PATCH /api/auth/profile  — update name, business name, email
+router.patch('/profile', requireAuth, async (req, res) => {
+  const { contact_name, business_name, email } = req.body;
+
+  if (!contact_name && !business_name && !email) {
+    return res.status(400).json({ error: 'Nothing to update' });
+  }
+
+  try {
+    if (email) {
+      const taken = await db.queryOne(
+        'SELECT id FROM clients WHERE email = ? AND id != ? LIMIT 1',
+        [email.toLowerCase(), req.client.id]
+      );
+      if (taken) return res.status(409).json({ error: 'Email already in use' });
+    }
+
+    await db.query(
+      `UPDATE clients SET
+         contact_name  = COALESCE(?, contact_name),
+         business_name = COALESCE(?, business_name),
+         email         = COALESCE(?, email)
+       WHERE id = ?`,
+      [contact_name ?? null, business_name ?? null, email ? email.toLowerCase() : null, req.client.id]
+    );
+
+    const updated = await db.queryOne(
+      'SELECT id, business_name, contact_name, email, phone, balance, total_earned, total_withdrawn, created_at FROM clients WHERE id = ?',
+      [req.client.id]
+    );
+    res.json(updated);
+  } catch (err) {
+    console.error('[auth/profile]', err.message);
+    res.status(500).json({ error: 'Failed to update profile' });
+  }
+});
+
+// POST /api/auth/change-password  — in-app password change (requires current password)
+router.post('/change-password', requireAuth, async (req, res) => {
+  const { current_password, new_password } = req.body;
+
+  if (!current_password || !new_password) {
+    return res.status(400).json({ error: 'current_password and new_password required' });
+  }
+  if (new_password.length < 8) {
+    return res.status(400).json({ error: 'Password must be at least 8 characters' });
+  }
+
+  try {
+    const client = await db.queryOne(
+      'SELECT password_hash FROM clients WHERE id = ?',
+      [req.client.id]
+    );
+
+    if (!(await bcrypt.compare(current_password, client.password_hash))) {
+      return res.status(401).json({ error: 'Current password is incorrect' });
+    }
+
+    const hash = await bcrypt.hash(new_password, 10);
+    await db.query('UPDATE clients SET password_hash = ? WHERE id = ?', [hash, req.client.id]);
+
+    res.json({ message: 'Password changed successfully' });
+  } catch (err) {
+    console.error('[auth/change-password]', err.message);
+    res.status(500).json({ error: 'Failed to change password' });
+  }
+});
+
+// POST /api/auth/phone/request  — send OTP to new phone number to verify ownership
+router.post('/phone/request', requireAuth, phoneOtpLimiter, async (req, res) => {
+  const { new_phone } = req.body;
+  if (!new_phone) return res.status(400).json({ error: 'new_phone required' });
+
+  try {
+    const taken = await db.queryOne(
+      'SELECT id FROM clients WHERE phone = ? AND id != ? LIMIT 1',
+      [new_phone, req.client.id]
+    );
+    if (taken) return res.status(409).json({ error: 'Phone number already in use' });
+
+    const otp       = String(Math.floor(100000 + Math.random() * 900000));
+    const expiresAt = new Date(Date.now() + 10 * 60 * 1000);
+
+    // Invalidate previous pending phone-change OTPs for this client
+    await db.query(
+      `UPDATE password_resets SET used = 1 WHERE phone = ? AND used = 0`,
+      [`PHONECHANGE:${req.client.id}`]
+    );
+
+    await db.query(
+      `INSERT INTO password_resets (phone, otp, expires_at) VALUES (?, ?, ?)`,
+      [`PHONECHANGE:${req.client.id}`, otp, expiresAt]
+    );
+
+    sms.sendSMS(new_phone, messages.phoneChangeOtp(otp)).catch(() => {});
+
+    res.json({ message: 'Verification code sent to new phone number' });
+  } catch (err) {
+    console.error('[auth/phone/request]', err.message);
+    res.status(500).json({ error: 'Failed to send verification code' });
+  }
+});
+
+// POST /api/auth/phone/confirm  — verify OTP and update phone number
+router.post('/phone/confirm', requireAuth, async (req, res) => {
+  const { new_phone, otp } = req.body;
+  if (!new_phone || !otp) return res.status(400).json({ error: 'new_phone and otp required' });
+
+  try {
+    const reset = await db.queryOne(
+      `SELECT id FROM password_resets
+       WHERE phone = ? AND otp = ? AND used = 0 AND expires_at > NOW()
+       ORDER BY created_at DESC LIMIT 1`,
+      [`PHONECHANGE:${req.client.id}`, otp]
+    );
+
+    if (!reset) return res.status(400).json({ error: 'Invalid or expired code' });
+
+    // Get old phone for security notice
+    const { phone: oldPhone } = await db.queryOne(
+      'SELECT phone FROM clients WHERE id = ?',
+      [req.client.id]
+    );
+
+    await db.query('UPDATE clients SET phone = ? WHERE id = ?', [new_phone, req.client.id]);
+    await db.query('UPDATE password_resets SET used = 1 WHERE id = ?', [reset.id]);
+
+    // Notify old number
+    sms.sendSMS(oldPhone, messages.phoneChangeNotice(new_phone)).catch(() => {});
+
+    res.json({ message: 'Phone number updated successfully' });
+  } catch (err) {
+    console.error('[auth/phone/confirm]', err.message);
+    res.status(500).json({ error: 'Failed to update phone number' });
+  }
+});
+
 // GET /api/auth/me
 router.get('/me', requireAuth, async (req, res) => {
   try {

src/utils/messages.js

@@ -39,6 +39,14 @@ module.exports = {
   // Tenant receives this when requesting a password reset
   passwordResetOtp: (otp) => `Token  is: ${otp}\n.`,
 
+  // Sent to the NEW phone number to verify ownership during a phone change
+  phoneChangeOtp: (otp) =>
+    `Your WifiBiz verification code is: ${otp}\nEnter this to confirm your new phone number. Valid for 10 minutes.`,
+
+  // Sent to the OLD phone number as a security notice after phone change completes
+  phoneChangeNotice: (newPhone) =>
+    `Your WifiBiz account phone number has been changed to ${newPhone}. If this wasn't you, contact support immediately.`,
+
   // Tenant receives this when a payout completes
   payoutCompleted: (amount) =>
     `Payout of ${parseInt(amount).toLocaleString()} TZS sent to your M-Pesa.`,