The smallest change in this feature and the one to read most carefully. It is the point where somebody who has proved nothing to this shop is handed an account belonging to somebody who did.
The rule
One line at the top of google/linkIdentity.ts: link only when Google asserts the address is verified. Everything below it is bookkeeping.
That is defensible for Google specifically, and the reasoning is worth stating rather than assuming. Google asserting the address means whoever completed the sign-in demonstrably controls the mailbox — and that mailbox is already the root of trust for every other route into the account. It is where a password reset goes, and following a reset link takes the account over completely. So linking on it grants nothing that was not already reachable, and it spares the customer who came to Google precisely because they forgot their password.
Never on an unverified address. That is not a weaker version of the same thing. It is an account takeover with extra steps, because the assertion would be one nobody checked.
There is a test for the specific trap: the string "false" is truthy. If that check ever becomes a truthiness test, every unverified Google account links to whatever account holds its address.
The order is part of the policy
The identity lookup runs first and nothing else is consulted when it matches. That is why an identity that has signed in before keeps working after the address changes on either side.
There is a test where a second customer has since taken the address the Google account reports, and the sign-in correctly reaches the first.
Two decisions that are not obvious
Linking to a disabled account is refused. Linking and then refusing the session would leave the identity attached, so the next attempt would take the sign-in path instead — turning a disabled account into one that is merely inconvenient to reach.
Deciding this in newCustomer.ts was the shape to avoid. The unique constraint already fires there, and an account must never be handed over as a side effect of an INSERT failing. That module reports the address is taken and stops; the policy lives somewhere it can be read on its own.
The refusal says what to do
Its own destination rather than the generic failure, because it is the one refusal in this flow a customer can act on: they have an account and simply cannot reach it this way. The login form now says to use the password they already have.
It reveals nothing. They arrived holding a Google account for that address, so being told the address has an account here tells them only about themselves.
Automatic linking is shown, not silent
A customer who signed up with a password and later used Google has had two credentials joined without being asked. A silent link is indistinguishable from a bug when they later wonder why the password is no longer needed.
So the account page lists it, beside the passkeys, for the reason that list exists at all. The endpoint never returns the provider subject — the same reasoning that keeps credential ids out of the passkey list.
No unlinking. Removing the only way into an account is what #344 settles, and offering that button before the check runs would be the fastest possible way to lock somebody out of their own orders.
Testing
Thirteen new integration tests: the link, the refusals, the disabled account, case-insensitive matching, identity-before-address ordering, and the identities endpoint.
Verified locally: backend tsc clean for src and tests, 590 unit tests pass, lint at the seven warnings that predate this branch; frontend tsc, lint and build clean. The integration suite needs a database this machine has no Docker for.
Closes #343. Phase 4 of six under #332.
The smallest change in this feature and the one to read most carefully. It is the point where somebody who has proved nothing to this shop is handed an account belonging to somebody who did.
## The rule
One line at the top of `google/linkIdentity.ts`: **link only when Google asserts the address is verified.** Everything below it is bookkeeping.
That is defensible for Google specifically, and the reasoning is worth stating rather than assuming. Google asserting the address means whoever completed the sign-in demonstrably controls the mailbox — and that mailbox is already the root of trust for every other route into the account. It is where a password reset goes, and following a reset link takes the account over completely. So linking on it grants nothing that was not already reachable, and it spares the customer who came to Google precisely because they forgot their password.
**Never on an unverified address.** That is not a weaker version of the same thing. It is an account takeover with extra steps, because the assertion would be one nobody checked.
There is a test for the specific trap: **the string `"false"` is truthy.** If that check ever becomes a truthiness test, every unverified Google account links to whatever account holds its address.
## The order is part of the policy
The identity lookup runs first and nothing else is consulted when it matches. That is why an identity that has signed in before keeps working after the address changes on either side.
There is a test where a *second* customer has since taken the address the Google account reports, and the sign-in correctly reaches the first.
## Two decisions that are not obvious
**Linking to a disabled account is refused.** Linking and then refusing the session would leave the identity attached, so the next attempt would take the sign-in path instead — turning a disabled account into one that is merely inconvenient to reach.
**Deciding this in `newCustomer.ts` was the shape to avoid.** The unique constraint already fires there, and an account must never be handed over as a side effect of an INSERT failing. That module reports the address is taken and stops; the policy lives somewhere it can be read on its own.
## The refusal says what to do
Its own destination rather than the generic failure, because it is the one refusal in this flow a customer can act on: they have an account and simply cannot reach it this way. The login form now says to use the password they already have.
It reveals nothing. They arrived holding a Google account for that address, so being told the address has an account here tells them only about themselves.
## Automatic linking is shown, not silent
A customer who signed up with a password and later used Google has had two credentials joined without being asked. A silent link is indistinguishable from a bug when they later wonder why the password is no longer needed.
So the account page lists it, beside the passkeys, for the reason that list exists at all. The endpoint never returns the provider subject — the same reasoning that keeps credential ids out of the passkey list.
**No unlinking.** Removing the only way into an account is what #344 settles, and offering that button before the check runs would be the fastest possible way to lock somebody out of their own orders.
## Testing
Thirteen new integration tests: the link, the refusals, the disabled account, case-insensitive matching, identity-before-address ordering, and the identities endpoint.
Verified locally: backend `tsc` clean for src and tests, 590 unit tests pass, lint at the seven warnings that predate this branch; frontend `tsc`, lint and build clean. The integration suite needs a database this machine has no Docker for.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
The smallest change in this feature and the one to read most carefully. It is the point where somebody who has proved nothing to this shop is handed an account belonging to somebody who did.
The rule is one line at the top of linkIdentity.ts: link only when Google asserts the address is verified, and refuse otherwise. Everything below it is bookkeeping.
That is defensible for Google specifically, and the reasoning is worth stating rather than assuming. Google asserting the address means whoever completed the sign-in demonstrably controls the mailbox, and that mailbox is already the root of trust for every other route into the account — it is where a password reset goes, and following a reset link takes the account over completely. So linking on it grants nothing that was not already reachable, and it spares the customer who came to Google precisely because they forgot their password.
Never on an unverified address. That is not a weaker version of the same thing; it is an account takeover with extra steps, because the assertion would be one nobody checked. There is a test for the specific trap: the string "false" is truthy, and if that check ever becomes a truthiness test then every unverified Google account links to whatever account holds its address.
The order matters and is an order rather than a set of independent checks. The identity lookup runs first and nothing else is consulted when it matches, which is why an identity that has signed in before keeps working after the address changes on either side. There is a test where a second customer has since taken the address the Google account reports, and the sign-in correctly reaches the first.
Linking to a disabled account is refused, and the reason is not obvious. Linking and then refusing the session would leave the identity attached, so the next attempt would take the sign-in path instead — turning a disabled account into one that is merely inconvenient to reach.
The refusal gets its own destination rather than the generic failure. It is the one refusal in this flow a customer can act on: they have an account and simply cannot reach it this way, so the login form now says to use the password they already have. That reveals nothing, because they arrived holding a Google account for that address — being told the address has an account here tells them only about themselves.
Deciding this in newCustomer.ts, where the unique constraint already fires, was the shape to avoid. An account must never be handed over as a side effect of an INSERT failing, so that module reports the address is taken and stops, and the policy lives somewhere it can be read on its own.
Automatic linking is defensible but it is not obvious, so the account page now shows it. A customer who signed up with a password and later used Google has had two credentials joined without being asked, and a silent link is indistinguishable from a bug when they later wonder why the password is no longer needed. It sits beside the passkeys for the reason that list exists at all: a customer cannot manage credentials they cannot see. The endpoint never returns the provider subject, which is the same reasoning that keeps credential ids out of the passkey list.
No unlinking. Removing the only way into an account is the question #344 settles, and offering that button before the check runs would be the fastest possible way to lock somebody out of their own orders.
Verified: backend tsc clean for src and tests, 590 unit tests pass, lint at the seven warnings that predate this branch, frontend tsc, lint and build clean. The integration suite needs a database this machine has no Docker for.
Closes#343
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #343. Phase 4 of six under #332.
The smallest change in this feature and the one to read most carefully. It is the point where somebody who has proved nothing to this shop is handed an account belonging to somebody who did.
The rule
One line at the top of
google/linkIdentity.ts: link only when Google asserts the address is verified. Everything below it is bookkeeping.That is defensible for Google specifically, and the reasoning is worth stating rather than assuming. Google asserting the address means whoever completed the sign-in demonstrably controls the mailbox — and that mailbox is already the root of trust for every other route into the account. It is where a password reset goes, and following a reset link takes the account over completely. So linking on it grants nothing that was not already reachable, and it spares the customer who came to Google precisely because they forgot their password.
Never on an unverified address. That is not a weaker version of the same thing. It is an account takeover with extra steps, because the assertion would be one nobody checked.
There is a test for the specific trap: the string
"false"is truthy. If that check ever becomes a truthiness test, every unverified Google account links to whatever account holds its address.The order is part of the policy
The identity lookup runs first and nothing else is consulted when it matches. That is why an identity that has signed in before keeps working after the address changes on either side.
There is a test where a second customer has since taken the address the Google account reports, and the sign-in correctly reaches the first.
Two decisions that are not obvious
Linking to a disabled account is refused. Linking and then refusing the session would leave the identity attached, so the next attempt would take the sign-in path instead — turning a disabled account into one that is merely inconvenient to reach.
Deciding this in
newCustomer.tswas the shape to avoid. The unique constraint already fires there, and an account must never be handed over as a side effect of an INSERT failing. That module reports the address is taken and stops; the policy lives somewhere it can be read on its own.The refusal says what to do
Its own destination rather than the generic failure, because it is the one refusal in this flow a customer can act on: they have an account and simply cannot reach it this way. The login form now says to use the password they already have.
It reveals nothing. They arrived holding a Google account for that address, so being told the address has an account here tells them only about themselves.
Automatic linking is shown, not silent
A customer who signed up with a password and later used Google has had two credentials joined without being asked. A silent link is indistinguishable from a bug when they later wonder why the password is no longer needed.
So the account page lists it, beside the passkeys, for the reason that list exists at all. The endpoint never returns the provider subject — the same reasoning that keeps credential ids out of the passkey list.
No unlinking. Removing the only way into an account is what #344 settles, and offering that button before the check runs would be the fastest possible way to lock somebody out of their own orders.
Testing
Thirteen new integration tests: the link, the refusals, the disabled account, case-insensitive matching, identity-before-address ordering, and the identities endpoint.
Verified locally: backend
tscclean for src and tests, 590 unit tests pass, lint at the seven warnings that predate this branch; frontendtsc, lint and build clean. The integration suite needs a database this machine has no Docker for.🤖 Generated with Claude Code