OAuth2 authentication and account linking #12

New issue

Closed

opened 2026-06-12 20:27:30 +00:00 by james · 0 comments

james commented

2026-06-12 20:27:30 +00:00

Owner

Scope

OAuth2 sign-in via Auth.js (NextAuth). At least one provider configured by default; the provider list is env-driven so self-hosters can pick their own.
Data model: a User row can have any of: a local-identity row, one or more OAuth-identity rows, or both.
Account linking is explicit. When signed in as a local user, the user can attach an OAuth2 identity. When signed in as an OAuth2 user, they can attach a local password. Do not auto-merge by email.
Unlinking is allowed as long as the user retains some way to sign in.

Acceptance criteria

A user can sign in with either identity type and reach the same account.
Linking and unlinking flows work from both directions.
Tests cover: OAuth sign-in for a new user, OAuth sign-in for a linked user, link/unlink success and failure cases.

Part of epic #1. Depends on #11.

## Scope - OAuth2 sign-in via Auth.js (NextAuth). At least one provider configured by default; the provider list is env-driven so self-hosters can pick their own. - Data model: a `User` row can have any of: a local-identity row, one or more OAuth-identity rows, or both. - **Account linking is explicit.** When signed in as a local user, the user can attach an OAuth2 identity. When signed in as an OAuth2 user, they can attach a local password. **Do not auto-merge by email.** - Unlinking is allowed as long as the user retains some way to sign in. ## Acceptance criteria - [ ] A user can sign in with either identity type and reach the same account. - [ ] Linking and unlinking flows work from both directions. - [ ] Tests cover: OAuth sign-in for a new user, OAuth sign-in for a linked user, link/unlink success and failure cases. Part of epic #1. Depends on #11.

james added the

area:auth

feature

labels

2026-06-12 20:31:51 +00:00

james referenced this issue

2026-06-13 13:58:01 +00:00

Authorization middleware with explicit public allowlist (#10) #36

james referenced this issue from a commit

2026-06-13 15:57:23 +00:00

Local user authentication: register, login, logout, sessions (#11)

james referenced this issue