diff --git a/lib/lightning_web/live/profile_live/components.ex b/lib/lightning_web/live/profile_live/components.ex
index f13a397ce6c..b4d7840c7cd 100644
--- a/lib/lightning_web/live/profile_live/components.ex
+++ b/lib/lightning_web/live/profile_live/components.ex
@@ -64,6 +64,11 @@ defmodule LightningWeb.ProfileLive.Components do
id={"#{@current_user.id}_github_section"}
user={@current_user}
/>
+ <.live_component
+ module={LightningWeb.ProfileLive.IdentitiesComponent}
+ id={"#{@current_user.id}_identities_section"}
+ user={@current_user}
+ />
<.live_component
module={LightningWeb.ProfileLive.ExperimentalFeaturesComponent}
id="experimental-features"
diff --git a/lib/lightning_web/live/profile_live/identities_component.ex b/lib/lightning_web/live/profile_live/identities_component.ex
new file mode 100644
index 00000000000..645527849f7
--- /dev/null
+++ b/lib/lightning_web/live/profile_live/identities_component.ex
@@ -0,0 +1,165 @@
+defmodule LightningWeb.ProfileLive.IdentitiesComponent do
+ @moduledoc """
+ Component to manage linked SSO identities on a User's profile.
+ """
+ use LightningWeb, :live_component
+
+ alias Lightning.Accounts
+ alias Lightning.AuthProviders
+
+ @impl true
+ def update(%{user: user} = assigns, socket) do
+ {:ok,
+ socket
+ |> assign(assigns)
+ |> assign_providers(user)}
+ end
+
+ @impl true
+ def handle_event("unlink-identity", %{"provider" => provider}, socket) do
+ case Accounts.unlink_user_identity(socket.assigns.user, provider) do
+ {:ok, _identity} ->
+ {:noreply,
+ socket
+ |> put_flash(
+ :info,
+ "Unlinked your #{display_name(provider)} account."
+ )
+ |> push_navigate(to: ~p"/profile")}
+
+ {:error, :would_lock_out} ->
+ {:noreply,
+ socket
+ |> put_flash(
+ :error,
+ "Set a password (via the password reset link) before unlinking your only sign-in method."
+ )
+ |> push_navigate(to: ~p"/profile")}
+
+ {:error, :not_linked} ->
+ {:noreply,
+ socket
+ |> put_flash(:error, "That identity is not linked to your account.")
+ |> push_navigate(to: ~p"/profile")}
+
+ {:error, _reason} ->
+ {:noreply,
+ socket
+ |> put_flash(
+ :error,
+ "Could not unlink your #{display_name(provider)} account."
+ )
+ |> push_navigate(to: ~p"/profile")}
+ end
+ end
+
+ defp assign_providers(socket, user) do
+ {:ok, handlers} = AuthProviders.get_handlers()
+ identities = Accounts.list_user_identities(user)
+
+ linked_by_provider =
+ Map.new(identities, fn identity -> {identity.provider, identity} end)
+
+ providers =
+ handlers
+ |> Enum.map(fn handler ->
+ %{
+ name: handler.name,
+ identity: Map.get(linked_by_provider, handler.name)
+ }
+ end)
+ |> Enum.sort_by(& &1.name)
+
+ assign(socket, providers: providers)
+ end
+
+ @impl true
+ def render(assigns) do
+ ~H"""
+
+
+
+
+ Single Sign-On
+
+
+ Link your account to an SSO provider so you can sign in without a password.
+
+
+
+ <%= if @providers == [] do %>
+
+ No SSO providers are configured for this instance.
+
+ <% else %>
+
+ <%= for provider <- @providers do %>
+ <.provider_row id={@id} provider={provider} myself={@myself} />
+ <% end %>
+
+ <% end %>
+
+
+ """
+ end
+
+ attr :id, :string, required: true
+ attr :provider, :map, required: true
+ attr :myself, :any, required: true
+
+ defp provider_row(assigns) do
+ ~H"""
+
+
+
+
+
+ {display_name(@provider.name)}
+
+ <%= if @provider.identity do %>
+
+ Linked ยท uid {@provider.identity.uid}
+
+ <% else %>
+
Not linked
+ <% end %>
+
+
+ <%= if @provider.identity do %>
+ <.button
+ id={"unlink-#{@provider.name}-button"}
+ type="button"
+ theme="danger"
+ phx-click="unlink-identity"
+ phx-value-provider={@provider.name}
+ phx-target={@myself}
+ data-confirm={"Unlink #{display_name(@provider.name)} from your account?"}
+ >
+ Unlink
+
+ <% else %>
+ <.button_link
+ id={"link-#{@provider.name}-button"}
+ theme="secondary"
+ href={~p"/authenticate/#{@provider.name}/link"}
+ >
+ Link
+
+ <% end %>
+
+
+ """
+ end
+
+ defp display_name(provider), do: String.capitalize(provider)
+end
diff --git a/lib/lightning_web/router.ex b/lib/lightning_web/router.ex
index e8f64c1fe53..6b854cf9d1f 100644
--- a/lib/lightning_web/router.ex
+++ b/lib/lightning_web/router.ex
@@ -64,7 +64,11 @@ defmodule LightningWeb.Router do
post "/users/confirm", UserConfirmationController, :create
get "/authenticate/callback", OidcController, :new
+ get "/authenticate/signup/confirm", OidcController, :confirm_signup
+ post "/authenticate/signup/confirm", OidcController, :complete_signup
+ get "/authenticate/signup/cancel", OidcController, :cancel_signup
get "/authenticate/:provider", OidcController, :show
+ get "/authenticate/:provider/link", OidcController, :link
get "/authenticate/:provider/callback", OidcController, :new
get "/oauth/:provider/callback", OauthController, :new
diff --git a/priv/repo/migrations/20260515133932_create_user_identities.exs b/priv/repo/migrations/20260515133932_create_user_identities.exs
new file mode 100644
index 00000000000..e2e849e7b75
--- /dev/null
+++ b/priv/repo/migrations/20260515133932_create_user_identities.exs
@@ -0,0 +1,16 @@
+defmodule Lightning.Repo.Migrations.CreateUserIdentities do
+ use Ecto.Migration
+
+ def change do
+ create table(:user_identities, primary_key: false) do
+ add :id, :binary_id, primary_key: true
+ add :user_id, references(:users, type: :uuid, on_delete: :delete_all), null: false
+ add :provider, :string, null: false
+ add :uid, :string, null: false
+ timestamps()
+ end
+
+ create unique_index(:user_identities, [:provider, :uid])
+ create index(:user_identities, [:user_id])
+ end
+end
diff --git a/priv/repo/migrations/20260515133933_allow_null_hashed_password.exs b/priv/repo/migrations/20260515133933_allow_null_hashed_password.exs
new file mode 100644
index 00000000000..e72167253d9
--- /dev/null
+++ b/priv/repo/migrations/20260515133933_allow_null_hashed_password.exs
@@ -0,0 +1,9 @@
+defmodule Lightning.Repo.Migrations.AllowNullHashedPassword do
+ use Ecto.Migration
+
+ def change do
+ alter table(:users) do
+ modify :hashed_password, :string, null: true
+ end
+ end
+end
diff --git a/test/lightning/accounts_test.exs b/test/lightning/accounts_test.exs
index 533e805151d..3237fe9503b 100644
--- a/test/lightning/accounts_test.exs
+++ b/test/lightning/accounts_test.exs
@@ -142,6 +142,147 @@ defmodule Lightning.AccountsTest do
valid_user_password()
)
end
+
+ test "returns :sso_account error when the user has no password" do
+ user = insert(:user, hashed_password: nil, password: nil)
+
+ assert {:error, :sso_account} =
+ Accounts.get_user_by_email_and_password(user.email, "anything")
+ end
+ end
+
+ describe "get_user_by_identity/2" do
+ test "returns the user when an identity exists" do
+ user = insert(:user)
+
+ insert(:user_identity,
+ user: user,
+ provider: "github",
+ uid: "12345"
+ )
+
+ assert %User{id: id} = Accounts.get_user_by_identity("github", "12345")
+ assert id == user.id
+ end
+
+ test "returns nil when no identity matches" do
+ refute Accounts.get_user_by_identity("github", "nope")
+ end
+ end
+
+ describe "link_user_identity/3" do
+ test "creates a new identity for the user" do
+ user = insert(:user)
+
+ assert {:ok, identity} =
+ Accounts.link_user_identity(user, "github", "abc")
+
+ assert identity.user_id == user.id
+ assert identity.provider == "github"
+ assert identity.uid == "abc"
+ end
+
+ test "is idempotent on (provider, uid) conflicts" do
+ user = insert(:user)
+ insert(:user_identity, user: user, provider: "github", uid: "abc")
+
+ assert {:ok, _} = Accounts.link_user_identity(user, "github", "abc")
+ end
+ end
+
+ describe "register_user_from_sso/3" do
+ test "creates a confirmed user and linked identity in one transaction" do
+ Events.subscribe()
+ email = unique_user_email()
+
+ assert {:ok, user} =
+ Accounts.register_user_from_sso(
+ %{
+ email: email,
+ first_name: "Sso",
+ last_name: "User"
+ },
+ "github",
+ "id-1"
+ )
+
+ assert user.email == email
+ assert user.first_name == "Sso"
+ assert user.last_name == "User"
+ assert is_nil(user.hashed_password)
+ refute is_nil(user.confirmed_at)
+ assert_receive %Events.UserRegistered{user: ^user}
+
+ assert %User{id: same_id} = Accounts.get_user_by_identity("github", "id-1")
+ assert same_id == user.id
+ end
+
+ test "fails when the email is already taken" do
+ existing = insert(:user)
+
+ assert {:error, changeset} =
+ Accounts.register_user_from_sso(
+ %{
+ email: existing.email,
+ first_name: "Other",
+ last_name: "User"
+ },
+ "github",
+ "id-2"
+ )
+
+ assert "has already been taken" in errors_on(changeset).email
+ end
+ end
+
+ describe "list_user_identities/1" do
+ test "returns identities for the given user, ordered by provider" do
+ user = insert(:user)
+
+ insert(:user_identity, user: user, provider: "google", uid: "g1")
+ insert(:user_identity, user: user, provider: "github", uid: "h1")
+ insert(:user_identity, user: insert(:user), provider: "github", uid: "h2")
+
+ assert [a, b] = Accounts.list_user_identities(user)
+ assert a.provider == "github"
+ assert b.provider == "google"
+ end
+ end
+
+ describe "unlink_user_identity/2" do
+ test "removes the identity for a user with a password" do
+ user = insert(:user)
+ insert(:user_identity, user: user, provider: "github", uid: "h1")
+
+ assert {:ok, _} = Accounts.unlink_user_identity(user, "github")
+ assert [] = Accounts.list_user_identities(user)
+ end
+
+ test "returns :not_linked when the provider is not linked" do
+ user = insert(:user)
+
+ assert {:error, :not_linked} =
+ Accounts.unlink_user_identity(user, "github")
+ end
+
+ test "refuses to unlink the only identity of an SSO-only user" do
+ user = insert(:user, hashed_password: nil)
+ insert(:user_identity, user: user, provider: "github", uid: "h1")
+
+ assert {:error, :would_lock_out} =
+ Accounts.unlink_user_identity(user, "github")
+
+ assert [_] = Accounts.list_user_identities(user)
+ end
+
+ test "allows unlinking when an SSO-only user has another identity" do
+ user = insert(:user, hashed_password: nil)
+ insert(:user_identity, user: user, provider: "github", uid: "h1")
+ insert(:user_identity, user: user, provider: "google", uid: "g1")
+
+ assert {:ok, _} = Accounts.unlink_user_identity(user, "github")
+ assert [%{provider: "google"}] = Accounts.list_user_identities(user)
+ end
end
describe "get_user!/1" do
diff --git a/test/lightning/auth_providers/google_handler_test.exs b/test/lightning/auth_providers/google_handler_test.exs
new file mode 100644
index 00000000000..fc64abde1f5
--- /dev/null
+++ b/test/lightning/auth_providers/google_handler_test.exs
@@ -0,0 +1,42 @@
+defmodule Lightning.AuthProviders.GoogleHandlerTest do
+ use ExUnit.Case, async: false
+
+ import Mox
+
+ alias Lightning.AuthProviders.GoogleHandler
+ alias Lightning.AuthProviders.Handler
+
+ setup :verify_on_exit!
+
+ setup do
+ Mox.stub_with(Lightning.MockConfig, Lightning.Config.API)
+ prev = Application.get_env(:lightning, :google_oauth)
+ on_exit(fn -> Application.put_env(:lightning, :google_oauth, prev || []) end)
+ :ok
+ end
+
+ test "build/0 returns :not_configured when credentials are missing" do
+ Application.put_env(:lightning, :google_oauth, [])
+ assert {:error, :not_configured} = GoogleHandler.build()
+ end
+
+ test "build/0 returns a configured handler when all keys are set" do
+ Application.put_env(:lightning, :google_oauth,
+ client_id: "id",
+ client_secret: "secret",
+ redirect_uri: "http://localhost/authenticate/google/callback"
+ )
+
+ assert {:ok, %Handler{name: "google", scope: "openid email profile"}} =
+ GoogleHandler.build()
+ end
+
+ test "build/0 returns :not_configured when redirect_uri is missing" do
+ Application.put_env(:lightning, :google_oauth,
+ client_id: "id",
+ client_secret: "secret"
+ )
+
+ assert {:error, :not_configured} = GoogleHandler.build()
+ end
+end
diff --git a/test/lightning_web/controllers/oidc_controller_test.exs b/test/lightning_web/controllers/oidc_controller_test.exs
index 4d7ca5828e3..8f638e70649 100644
--- a/test/lightning_web/controllers/oidc_controller_test.exs
+++ b/test/lightning_web/controllers/oidc_controller_test.exs
@@ -65,7 +65,7 @@ defmodule LightningWeb.OidcControllerTest do
describe "GET /authenticate/:provider/callback" do
setup :setup_handler
- test "logs the given person in", %{
+ test "logs in users whose identity is already linked", %{
conn: conn,
bypass: bypass,
handler: handler
@@ -73,7 +73,17 @@ defmodule LightningWeb.OidcControllerTest do
expect_token(bypass, handler.wellknown)
user = Lightning.AccountsFixtures.user_fixture()
- expect_userinfo(bypass, handler.wellknown, %{"email" => user.email})
+
+ insert(:user_identity,
+ user: user,
+ provider: handler.name,
+ uid: "sub-#{user.id}"
+ )
+
+ expect_userinfo(bypass, handler.wellknown, %{
+ "email" => user.email,
+ "sub" => "sub-#{user.id}"
+ })
conn =
conn
@@ -84,6 +94,90 @@ defmodule LightningWeb.OidcControllerTest do
assert redirected_to(conn) == "/projects"
end
+ test "redirects to login with a notice when email matches an existing account",
+ %{conn: conn, bypass: bypass, handler: handler} do
+ expect_token(bypass, handler.wellknown)
+ user = Lightning.AccountsFixtures.user_fixture()
+
+ expect_userinfo(bypass, handler.wellknown, %{
+ "email" => user.email,
+ "sub" => "unlinked-uid"
+ })
+
+ conn =
+ conn
+ |> get(
+ Routes.oidc_path(conn, :new, handler.name, %{"code" => "callback_code"})
+ )
+
+ assert redirected_to(conn) == Routes.user_session_path(conn, :new)
+
+ assert Phoenix.Flash.get(conn.assigns.flash, :info) =~
+ "An account already exists"
+
+ assert Phoenix.Flash.get(conn.assigns.flash, :info) =~
+ "link your #{String.capitalize(handler.name)} account"
+
+ # No identity was silently created
+ refute Lightning.Accounts.get_user_by_identity(
+ handler.name,
+ "unlinked-uid"
+ )
+ end
+
+ test "prompts the user to confirm before creating a brand-new account",
+ %{conn: conn, bypass: bypass, handler: handler} do
+ expect_token(bypass, handler.wellknown)
+ email = "new-sso-user-#{System.unique_integer([:positive])}@example.com"
+
+ expect_userinfo(bypass, handler.wellknown, %{
+ "email" => email,
+ "sub" => "fresh-uid-1",
+ "name" => "First Last"
+ })
+
+ conn =
+ conn
+ |> get(
+ Routes.oidc_path(conn, :new, handler.name, %{"code" => "callback_code"})
+ )
+
+ assert redirected_to(conn) == ~p"/authenticate/signup/confirm"
+
+ assert get_session(conn, :sso_pending_signup) == %{
+ "provider" => handler.name,
+ "uid" => "fresh-uid-1",
+ "email" => email,
+ "first_name" => "First",
+ "last_name" => "Last"
+ }
+
+ # No account or identity is created until the user confirms
+ refute Lightning.Accounts.get_user_by_email(email)
+ refute Lightning.Accounts.get_user_by_identity(handler.name, "fresh-uid-1")
+ end
+
+ test "redirects to login when userinfo has no email", %{
+ conn: conn,
+ bypass: bypass,
+ handler: handler
+ } do
+ expect_token(bypass, handler.wellknown)
+
+ expect_userinfo(bypass, handler.wellknown, %{"sub" => "abc"})
+
+ conn =
+ conn
+ |> get(
+ Routes.oidc_path(conn, :new, handler.name, %{"code" => "callback_code"})
+ )
+
+ assert redirected_to(conn) == Routes.user_session_path(conn, :new)
+
+ assert Phoenix.Flash.get(conn.assigns.flash, :error) =~
+ "Could not retrieve your email"
+ end
+
test "logs the person in but marks totp as pending for users wth MFA enabled",
%{
conn: conn,
@@ -94,7 +188,16 @@ defmodule LightningWeb.OidcControllerTest do
user = insert(:user, mfa_enabled: true, user_totp: build(:user_totp))
- expect_userinfo(bypass, handler.wellknown, %{"email" => user.email})
+ insert(:user_identity,
+ user: user,
+ provider: handler.name,
+ uid: "mfa-uid-#{user.id}"
+ )
+
+ expect_userinfo(bypass, handler.wellknown, %{
+ "email" => user.email,
+ "sub" => "mfa-uid-#{user.id}"
+ })
conn =
conn
@@ -112,14 +215,14 @@ defmodule LightningWeb.OidcControllerTest do
assert redirected_to(conn) == Routes.user_totp_path(conn, :new)
end
- test "shows an error when the person doesn't exist", %{
+ test "redirects to login when userinfo has no uid", %{
conn: conn,
bypass: bypass,
handler: handler
} do
expect_token(bypass, handler.wellknown)
- expect_userinfo(bypass, handler.wellknown, %{"email" => "invalid@user.com"})
+ expect_userinfo(bypass, handler.wellknown, %{"email" => "x@example.com"})
conn =
conn
@@ -130,16 +233,18 @@ defmodule LightningWeb.OidcControllerTest do
assert redirected_to(conn) == Routes.user_session_path(conn, :new)
end
- test "renders a 404 when a provider is missing", %{conn: conn} do
- response =
+ test "redirects to login when a provider is missing", %{conn: conn} do
+ conn =
conn
|> get(Routes.oidc_path(conn, :new, "bar", %{"code" => "callback_code"}))
- assert response.resp_body =~ "Not Found"
- assert response.status == 404
+ assert redirected_to(conn) == Routes.user_session_path(conn, :new)
+
+ assert Phoenix.Flash.get(conn.assigns.flash, :error) ==
+ "Authentication failed"
end
- test "renders an error when a handler returns an error", %{
+ test "redirects to login when a handler returns an error", %{
conn: conn,
handler: handler,
bypass: bypass
@@ -155,15 +260,249 @@ defmodule LightningWeb.OidcControllerTest do
|> Jason.encode!()}
)
- response =
+ conn =
+ conn
+ |> get(
+ Routes.oidc_path(conn, :new, handler.name, %{"code" => "callback_code"})
+ )
+
+ assert redirected_to(conn) == Routes.user_session_path(conn, :new)
+
+ assert Phoenix.Flash.get(conn.assigns.flash, :error) ==
+ "Authentication failed"
+ end
+ end
+
+ describe "GET /authenticate/:provider/link" do
+ setup :setup_handler
+
+ test "redirects to the provider authorize url for a logged-in user", %{
+ conn: conn,
+ handler: handler
+ } do
+ user = user_fixture()
+
+ conn =
+ conn
+ |> log_in_user(user)
+ |> get(Routes.oidc_path(conn, :link, handler.name))
+
+ assert redirected_to(conn) ==
+ AuthProviders.Handler.authorize_url(handler)
+
+ assert get_session(conn, :sso_link_intent_provider) == handler.name
+ end
+
+ test "redirects unauthenticated users to log in", %{
+ conn: conn,
+ handler: handler
+ } do
+ conn = get(conn, Routes.oidc_path(conn, :link, handler.name))
+ assert redirected_to(conn) == Routes.user_session_path(conn, :new)
+ end
+ end
+
+ describe "GET /authenticate/:provider/callback (link flow)" do
+ setup :setup_handler
+
+ test "links the identity to the current user", %{
+ conn: conn,
+ bypass: bypass,
+ handler: handler
+ } do
+ user = user_fixture()
+ expect_token(bypass, handler.wellknown)
+
+ expect_userinfo(bypass, handler.wellknown, %{
+ "email" => "anything@example.com",
+ "sub" => "new-link-uid"
+ })
+
+ conn =
+ conn
+ |> log_in_user(user)
+ |> put_session(:sso_link_intent_provider, handler.name)
+ |> get(
+ Routes.oidc_path(conn, :new, handler.name, %{"code" => "callback_code"})
+ )
+
+ assert redirected_to(conn) == ~p"/profile"
+
+ assert Phoenix.Flash.get(conn.assigns.flash, :info) =~ "Linked your"
+
+ assert %Lightning.Accounts.User{id: same_id} =
+ Lightning.Accounts.get_user_by_identity(
+ handler.name,
+ "new-link-uid"
+ )
+
+ assert same_id == user.id
+ end
+
+ test "flashes info when identity is already linked to the same account", %{
+ conn: conn,
+ bypass: bypass,
+ handler: handler
+ } do
+ user = user_fixture()
+
+ insert(:user_identity,
+ user: user,
+ provider: handler.name,
+ uid: "existing-uid"
+ )
+
+ expect_token(bypass, handler.wellknown)
+
+ expect_userinfo(bypass, handler.wellknown, %{
+ "email" => user.email,
+ "sub" => "existing-uid"
+ })
+
+ conn =
conn
+ |> log_in_user(user)
+ |> put_session(:sso_link_intent_provider, handler.name)
|> get(
Routes.oidc_path(conn, :new, handler.name, %{"code" => "callback_code"})
)
- assert response.resp_body =~ "invalid_client"
- assert response.resp_body =~ "No client credentials found"
- assert response.status == 401
+ assert redirected_to(conn) == ~p"/profile"
+ assert Phoenix.Flash.get(conn.assigns.flash, :info) =~ "already linked"
+ end
+
+ test "rejects linking an identity already claimed by another user", %{
+ conn: conn,
+ bypass: bypass,
+ handler: handler
+ } do
+ user = user_fixture()
+ other_user = user_fixture()
+
+ insert(:user_identity,
+ user: other_user,
+ provider: handler.name,
+ uid: "claimed-uid"
+ )
+
+ expect_token(bypass, handler.wellknown)
+
+ expect_userinfo(bypass, handler.wellknown, %{
+ "email" => "anything@example.com",
+ "sub" => "claimed-uid"
+ })
+
+ conn =
+ conn
+ |> log_in_user(user)
+ |> put_session(:sso_link_intent_provider, handler.name)
+ |> get(
+ Routes.oidc_path(conn, :new, handler.name, %{"code" => "callback_code"})
+ )
+
+ assert redirected_to(conn) == ~p"/profile"
+ assert Phoenix.Flash.get(conn.assigns.flash, :error) =~ "already linked"
+
+ # Still belongs to the other user
+ assert %Lightning.Accounts.User{id: same_id} =
+ Lightning.Accounts.get_user_by_identity(
+ handler.name,
+ "claimed-uid"
+ )
+
+ assert same_id == other_user.id
+ end
+ end
+
+ describe "SSO signup confirmation flow" do
+ test "GET /authenticate/signup/confirm renders the confirmation page",
+ %{conn: conn} do
+ pending = %{
+ "provider" => "github",
+ "uid" => "uid-123",
+ "email" => "new@example.com",
+ "first_name" => "Pat",
+ "last_name" => "Doe"
+ }
+
+ conn =
+ conn
+ |> Plug.Test.init_test_session(%{sso_pending_signup: pending})
+ |> get(~p"/authenticate/signup/confirm")
+
+ html = html_response(conn, 200)
+ assert html =~ "Create your account"
+ assert html =~ "new@example.com"
+ assert html =~ "Github"
+ assert html =~ "Pat Doe"
+ end
+
+ test "GET /authenticate/signup/confirm redirects to login when no pending signup",
+ %{conn: conn} do
+ conn = get(conn, ~p"/authenticate/signup/confirm")
+ assert redirected_to(conn) == Routes.user_session_path(conn, :new)
+ end
+
+ test "POST /authenticate/signup/confirm creates the account and logs in",
+ %{conn: conn} do
+ email = "confirm-signup-#{System.unique_integer([:positive])}@example.com"
+
+ pending = %{
+ "provider" => "github",
+ "uid" => "confirm-uid",
+ "email" => email,
+ "first_name" => "Alice",
+ "last_name" => "Smith"
+ }
+
+ conn =
+ conn
+ |> Plug.Test.init_test_session(%{sso_pending_signup: pending})
+ |> post(~p"/authenticate/signup/confirm", %{})
+
+ assert redirected_to(conn) == "/projects"
+
+ user = Lightning.Accounts.get_user_by_email(email)
+ assert user
+ assert user.first_name == "Alice"
+ assert user.last_name == "Smith"
+ assert is_nil(user.hashed_password)
+ refute is_nil(user.confirmed_at)
+
+ assert %Lightning.Accounts.User{id: same_id} =
+ Lightning.Accounts.get_user_by_identity("github", "confirm-uid")
+
+ assert same_id == user.id
+ refute get_session(conn, :sso_pending_signup)
+ end
+
+ test "POST /authenticate/signup/confirm redirects when there is no pending signup",
+ %{conn: conn} do
+ conn = post(conn, ~p"/authenticate/signup/confirm", %{})
+ assert redirected_to(conn) == Routes.user_session_path(conn, :new)
+
+ assert Phoenix.Flash.get(conn.assigns.flash, :error) =~
+ "No pending sign-up"
+ end
+
+ test "GET /authenticate/signup/cancel clears the pending signup",
+ %{conn: conn} do
+ pending = %{
+ "provider" => "github",
+ "uid" => "cancel-uid",
+ "email" => "cancel@example.com",
+ "first_name" => "C",
+ "last_name" => "X"
+ }
+
+ conn =
+ conn
+ |> Plug.Test.init_test_session(%{sso_pending_signup: pending})
+ |> get(~p"/authenticate/signup/cancel")
+
+ assert redirected_to(conn) == Routes.user_session_path(conn, :new)
+ refute get_session(conn, :sso_pending_signup)
+ refute Lightning.Accounts.get_user_by_email("cancel@example.com")
end
end
diff --git a/test/lightning_web/controllers/user_session_controller_test.exs b/test/lightning_web/controllers/user_session_controller_test.exs
index 0b15ba792f2..2148bdde203 100644
--- a/test/lightning_web/controllers/user_session_controller_test.exs
+++ b/test/lightning_web/controllers/user_session_controller_test.exs
@@ -74,12 +74,12 @@ defmodule LightningWeb.UserSessionControllerTest do
assert redirected_to(conn) == "/projects"
end
- test "shows a 'via external provider' button", %{conn: conn} do
+ test "shows a 'Sign in with' button for external providers", %{conn: conn} do
create_handler("foo")
conn = get(conn, Routes.user_session_path(conn, :new))
response = html_response(conn, 200)
- assert response =~ "via external provider"
+ assert response =~ "Sign in with"
end
end
diff --git a/test/lightning_web/live/profile_live_test.exs b/test/lightning_web/live/profile_live_test.exs
index 6706f48997b..cd068aaf021 100644
--- a/test/lightning_web/live/profile_live_test.exs
+++ b/test/lightning_web/live/profile_live_test.exs
@@ -820,4 +820,105 @@ defmodule LightningWeb.ProfileLiveTest do
refute has_element?(view, "#gdpr-banner")
end
end
+
+ describe "Identities Component" do
+ setup do
+ handler_name = :crypto.strong_rand_bytes(6) |> Base.url_encode64()
+
+ wellknown = %Lightning.AuthProviders.WellKnown{
+ authorization_endpoint: "https://example.com/authorize",
+ token_endpoint: "https://example.com/token",
+ userinfo_endpoint: "https://example.com/userinfo"
+ }
+
+ {:ok, handler} =
+ Lightning.AuthProviders.Handler.new(handler_name,
+ wellknown: wellknown,
+ client_id: "id",
+ client_secret: "secret",
+ redirect_uri: "http://localhost/callback_url"
+ )
+
+ Lightning.AuthProviders.create_handler(handler)
+ on_exit(fn -> Lightning.AuthProviders.remove_handler(handler) end)
+
+ {:ok, handler: handler}
+ end
+
+ test "renders Link button when provider is not linked", %{
+ conn: conn,
+ handler: handler
+ } do
+ user = user_fixture()
+ conn = log_in_user(conn, user)
+
+ {:ok, view, _html} = live(conn, ~p"/profile", on_error: :raise)
+
+ assert has_element?(view, "#link-#{handler.name}-button")
+ refute has_element?(view, "#unlink-#{handler.name}-button")
+ end
+
+ test "renders Unlink button when provider is linked", %{
+ conn: conn,
+ handler: handler
+ } do
+ user = user_fixture()
+
+ insert(:user_identity,
+ user: user,
+ provider: handler.name,
+ uid: "abc"
+ )
+
+ conn = log_in_user(conn, user)
+ {:ok, view, _html} = live(conn, ~p"/profile", on_error: :raise)
+
+ assert has_element?(view, "#unlink-#{handler.name}-button")
+ refute has_element?(view, "#link-#{handler.name}-button")
+ end
+
+ test "unlink event removes the identity", %{conn: conn, handler: handler} do
+ user = user_fixture()
+
+ insert(:user_identity,
+ user: user,
+ provider: handler.name,
+ uid: "abc"
+ )
+
+ conn = log_in_user(conn, user)
+ {:ok, view, _html} = live(conn, ~p"/profile", on_error: :raise)
+
+ view
+ |> element("#unlink-#{handler.name}-button")
+ |> render_click()
+
+ assert Lightning.Accounts.list_user_identities(user) == []
+ end
+
+ test "unlink is refused for SSO-only user with only one identity", %{
+ conn: conn,
+ handler: handler
+ } do
+ user = insert(:user, hashed_password: nil)
+
+ insert(:user_identity,
+ user: user,
+ provider: handler.name,
+ uid: "abc"
+ )
+
+ conn = log_in_user(conn, user)
+ {:ok, view, _html} = live(conn, ~p"/profile", on_error: :raise)
+
+ {:ok, _view, html} =
+ view
+ |> element("#unlink-#{handler.name}-button")
+ |> render_click()
+ |> follow_redirect(conn, ~p"/profile")
+
+ assert html =~ "Set a password"
+ assert [_] = Lightning.Accounts.list_user_identities(user)
+ end
+ end
end
diff --git a/test/support/factories.ex b/test/support/factories.ex
index 7be93f7d739..3e1adcb6252 100644
--- a/test/support/factories.ex
+++ b/test/support/factories.ex
@@ -308,6 +308,13 @@ defmodule Lightning.Factories do
}
end
+ def user_identity_factory do
+ %Lightning.Accounts.UserIdentity{
+ provider: "github",
+ uid: sequence(:user_identity_uid, &"uid-#{&1}")
+ }
+ end
+
def user_token_factory do
%Lightning.Accounts.UserToken{
token: fn -> Ecto.UUID.generate() end