Repository navigation
fix(auth): Google sign-in for accounts that already exist - #40
Merged
Merged
Conversation
A first Google sign-in for an email with an existing Wonky account failed with a unique violation on serverpod_auth_core_profile: afterGoogleAccountCreated links the Google account to the existing auth user, but GoogleIdp.login still treats the account as new and creates its auth profile, which the existing user already has. The Google IDP now gets LinkedAccountUserProfiles, which returns the existing auth profile instead of inserting a second one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Some users can't sign in with Google: the server answers with an internal error. Production log (
googleIdp.loginWithCode):The domain doesn't matter. It hits anyone who signs in with Google for the first time after creating an email/password account:
GoogleAccount, so it creates a new auth user.afterGoogleAccountCreatedsees the email belongs to an existing account. It moves the Google account to that account and deletes the new auth user.GoogleIdp.loginstill seesnewAccount: trueand callscreateUserProfilefor the existing auth user, which already has an auth profile from its email sign-up. The unique violation rolls back the whole sign-in.The package code is the same in 4.1.0-beta.3 and rc.1, so this has been broken since Google sign-in shipped.
Fix
wonkyGoogleIdpConfig()now returns aGoogleIdpConfigsubclass whosebuildgives the IDP aLinkedAccountUserProfiles. ItscreateUserProfilereturns the existing auth profile when there is one. Otherwise it creates the profile as before. Spec 04 §1.6 is updated.Tests
test/integration/platform/google_idp_test.dart:afterGoogleAccountCreatedand then the IDP'screateUserProfile. It fails with the production error when run with the stockUserProfiles.All 4 tests in the file pass.
Not changed
After linking, the issued token takes its scopes from the deleted new auth user (empty) instead of the linked user. Wonky doesn't use Serverpod auth scopes today, so this has no effect yet.
🤖 Generated with Claude Code