Wire identities into auth and tests

Author: Copilot

app/controllers/callbacks_controller.rb

@@ -45,7 +45,7 @@ def handle_callback(provider, config)
       end
     else
       scope = Devise::Mapping.find_scope!(@user)
-      sign_in(scope, resource, {})
+      sign_in(scope, @user, {})
       redirect_to_space(after_sign_in_path_for(@user), space)
     end
   end

app/controllers/identities_controller.rb

@@ -27,7 +27,9 @@ def set_user
   end
 
   def authorize_user
-    handle_error(:forbidden) && return unless current_user == @user
+    return if current_user == @user
+
+    handle_error(:forbidden)
   end
 
   def set_breadcrumbs

app/models/user.rb

@@ -207,6 +207,7 @@ def self.from_omniauth(auth)
 
     if user.nil? && auth.info.email.present? && auth.provider.present?
       user = User.joins(:identities).where(email: auth.info.email, identities: { provider: auth.provider }).first
+      user ||= User.where(provider: auth.provider, email: auth.info.email).first
     end
 
     if user
@@ -346,6 +347,14 @@ def merge(*others)
       new_collaborations = []
       other_profiles = others.map(&:profile)
       others.each do |other|
+        other.identities.each do |identity|
+          existing_identity = identities.find_by(provider: identity.provider, uid: identity.uid)
+          if existing_identity
+            identity.destroy
+          else
+            identity.update!(user: self)
+          end
+        end
         other.reassign_resources(self)
         other.activities_as_owner.update_all(owner_id: id, owner_type: self.class.name)
         other.activities.update_all(trackable_id: id, trackable_type: self.class.name)

app/views/users/show.html.erb

@@ -93,7 +93,7 @@
       <% if TeSS::Config.feature['registration'] %>
         <% if !current_user.nil? and current_user == @user %>
           <%= link_to "Manage account", edit_user_registration_path, :class => 'btn btn-default center-block' %>
-          <%= link_to "Manage identities", user_identities_path(@user), :class => 'btn btn-default center-block mt-2' %>
+          <%= link_to "Manage identities", user_identities_path(@user), :class => 'btn btn-default center-block' %>
         <% end %>
       <% end %>
     </div>

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.1].define(version: 2026_04_21_144919) do
+ActiveRecord::Schema[8.1].define(version: 2026_07_23_102000) do
   # These are extensions that must be enabled in order to support this database
   enable_extension "pg_catalog.plpgsql"
 
@@ -268,6 +268,16 @@
     t.index ["sluggable_type"], name: "index_friendly_id_slugs_on_sluggable_type"
   end
 
+  create_table "identities", force: :cascade do |t|
+    t.bigint "user_id", null: false
+    t.string "provider", null: false
+    t.string "uid"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["provider", "uid"], name: "index_identities_on_provider_and_uid", unique: true
+    t.index ["user_id"], name: "index_identities_on_user_id"
+  end
+
   create_table "learning_path_topic_items", force: :cascade do |t|
     t.text "comment"
     t.datetime "created_at", null: false
@@ -687,6 +697,7 @@
   add_foreign_key "event_materials", "materials"
   add_foreign_key "events", "spaces"
   add_foreign_key "events", "users"
+  add_foreign_key "identities", "users"
   add_foreign_key "learning_path_topic_links", "learning_paths"
   add_foreign_key "learning_path_topics", "spaces"
   add_foreign_key "learning_paths", "content_providers"

test/integration/omniauth_test.rb

@@ -225,9 +225,9 @@ class OmniauthTest < ActionDispatch::IntegrationTest
     # check user created
     new_user = User.find_by_username(expected_username)
     assert !new_user.nil?, "new username[#{expected_username}] not created successfully"
-    assert_equal 'oidc2', new_user.provider
-    assert !new_user.uid.nil?
-    assert_equal new_uid, new_user.uid
+    identity = new_user.identities.find_by(provider: 'oidc2')
+    refute_nil identity
+    assert_equal new_uid, identity.uid
     assert_equal new_email, new_user.email
   end
 
@@ -399,6 +399,28 @@ class OmniauthTest < ActionDispatch::IntegrationTest
     assert_response :not_found
   end
 
+  test 'logged-in users can link additional identities' do
+    user = users(:regular_user)
+    post '/users/sign_in', params: { 'user[login]' => user.username, 'user[password]' => 'hello' }
+
+    OmniAuth.config.mock_auth[:oidc2] = OmniAuth::AuthHash.new(
+      {
+        provider: 'oidc2',
+        uid: 'oidc2-linked-uid',
+        info: {
+          email: user.email,
+          nickname: user.username
+        }
+      })
+
+    post user_oidc2_omniauth_authorize_url(link_identity: '1')
+    follow_redirect! # OmniAuth redirect
+    follow_redirect! # CallbacksController identities redirect
+
+    assert_equal user_identities_path(user), path
+    assert user.reload.identities.where(provider: 'oidc2', uid: 'oidc2-linked-uid').any?
+  end
+
   test 'authentication redirects users back to origin space on subdomain' do
     space = spaces(:astro)
     space.update!(host: 'space.example.com')

test/models/user_test.rb

@@ -92,13 +92,29 @@ class UserTest < ActiveSupport::TestCase
   end
 
   test "should save with nil password if using omniauth" do
-    user = User.new(@user_params.merge(password: nil, provider: 'elixir_aai', uid: 'abcdefg'))
+    user = User.new(@user_params.merge(password: nil))
+    user.identities.build(provider: 'elixir_aai', uid: 'abcdefg')
     refute user.password_required?
     assert user.using_omniauth?
     assert user.save
     assert user.reload.encrypted_password.blank?
   end
 
+  test 'should create identity from omniauth details when creating new user' do
+    auth = OpenStruct.new(
+      provider: 'oidc',
+      uid: 'abc123',
+      info: OpenStruct.new(email: 'new-aaf-user@example.com', nickname: 'new_aaf_user')
+    )
+
+    user = User.from_omniauth(auth)
+    assert user.save
+
+    identity = user.identities.find_by(provider: 'oidc')
+    refute_nil identity
+    assert_equal 'abc123', identity.uid
+  end
+
   test "should not save with password under 8 characters" do
     user = User.new(@user_params.merge(password: '1234567'))
     assert_not user.save, 'Allowed a user to have a password under 8 characters'