[PR] fix(oauth): auto-bind verified external login to existing active user by email [answer]

["renich (via GitHub)" <gi...@apache.org>]

renich opened a new pull request, #1613:
URL: https://github.com/apache/answer/pull/1613

   ## Proposed Changes
   
   - When an external OAuth connector authenticates a user and returns a verified email address matching an existing active local user account, automatically bind the external identity to that account instead of returning `UserAccessDenied` (`/50x?title=Access%20denied&msg=Access%20denied`).
   - Update `last_login_date` for the existing user.
   - Activate the user's email status if it was in `EmailStatusToBeVerified`.
   - Issue and return the login access token directly so the user is seamlessly logged into their existing account.
   
   ## Motivation & Context
   
   Previously, if a user had registered using email/password (or was created during initial site setup), and subsequently attempted to log in using an OAuth connector (e.g., "Continue with Google"), Apache Answer aborted in `ExternalLogin`:
   ```go
   	if _, exist, err := us.userRepo.GetByEmail(ctx, externalUserInfo.Email); err != nil {
   		return nil, err
   	} else if exist {
   		return &schema.UserExternalLoginResp{
   			ErrTitle: translator.Tr(handler.GetLangByCtx(ctx), reason.UserAccessDenied),
   			ErrMsg:   translator.Tr(handler.GetLangByCtx(ctx), reason.UserAccessDenied),
   		}, nil
   	}
   ```
   This redirected users to `/50x?title=Access%20denied&msg=Access%20denied`, requiring them to realize they had to log in with their password first, navigate to `Settings -> Account`, and manually link the third-party provider.
   
   For non-technical communities and modern SSO expectations, this creates friction and confusion. Connectors already verify email ownership (for example, `connector-google` checks `respGoogleAuthUserInfo.EmailVerified` before setting `userInfo.Email`). Automatically binding verified OAuth emails to existing active accounts provides a seamless single sign-on experience.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@answer.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@answer.apache.org
For additional commands, e-mail: issues-help@answer.apache.org