feat(auth): detect existing social accounts during email login to prevent duplicate accounts (#353) - #490
Conversation
…ord reset emails (Heliobond#354) • Introduce password reset email template generator with relative TTL and absolute UTC deadline formatting • Add explicit expiration and stale link instructions to HTML and plaintext email templates • Implement HTML entity escaping and URL protocol sanitization against XSS • Update English and French localization message catalogs to maintain 100% parity • Add comprehensive unit tests covering formatting, edge cases, and injection prevention
…ta loss (Heliobond#352) • Introduce useSessionTimeout hook with throttled user inactivity monitoring and live countdown • Create accessible SessionTimeoutModal with focus trapping and extend/logout actions • Integrate SessionWatcher into root Providers to automatically protect connected wallet sessions • Add SessionTimeout translation keys to English and French message catalogs • Add unit tests covering inactivity tracking, countdown, extension, and automatic logout
…revent duplicates (Heliobond#353) • Introduce detectEmailAuthProvider utility for real-time social OAuth provider collision detection • Create accessible SocialAccountConflictWarning banner with 1-click social sign-in and account linking • Add EmailAuthModal integrating email validation and social collision detection • Add AccountConflict translation keys to English and French message catalogs (100% parity) • Add unit tests covering email normalization, collision detection, and UI warning interaction
|
@TochukwuJustice is attempting to deploy a commit to the David Dada's projects Team on Vercel. A member of the Team first needs to authorize it. |
sshdopey
left a comment
sshdopey
left a comment
There was a problem hiding this comment.
This is a solid, thoughtful implementation for #353! The account provider detection utility, conflict warning component, and email auth modal directly address the duplicate account issue. I love the accessible alert banner and the clear CTA to sign in with the existing provider. The localization and tests are a great touch. Nice work! 💛
|
Approved! 🎉 I couldn't auto-merge this just yet (it may need a rebase or have a check still running). A maintainer can merge it whenever it's ready. |
|
@TochukwuJustice Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
sshdopey
left a comment
sshdopey
left a comment
There was a problem hiding this comment.
This is a thoughtful implementation that directly addresses the duplicate account issue described in #353. The new detection utility, conflict warning component, and email modal work together to guide users toward their existing social provider. I appreciate the included tests and the bilingual message support. Great job! 💖
2 participants
closes #353
Summary of Changes
src/lib/auth/accountProviderDetection.ts):normalizeEmail()anddetectEmailAuthProvider()to check whether an email address is already linked with a social OAuth provider (e.g. Google, Apple, GitHub).src/components/SocialAccountConflictWarning.tsx):role="status") informing the user of their existing social account.src/components/EmailAuthModal.tsx,src/components/index.ts):messages/en.json,messages/fr.json):AccountConflictmessage strings in English and French, maintaining 100% catalog parity.src/lib/auth/accountProviderDetection.test.ts,src/components/SocialAccountConflictWarning.test.tsx):Reason for Changes
Resolves #353. Previously, users who originally signed up with a social provider (e.g., Google) and subsequently attempted email-based sign-in with the same address could inadvertently create duplicate accounts or split their portfolio assets. This warning makes the existing authentication method transparent and guides the user to sign in with their existing provider.