Add identity model and management flow

Author: Copilot

app/controllers/callbacks_controller.rb

@@ -11,11 +11,18 @@ class CallbacksController < Devise::OmniauthCallbacksController
   private
 
   def handle_callback(provider, config)
-    @user = User.from_omniauth(request.env["omniauth.auth"])
+    auth = request.env['omniauth.auth']
     if request.env['omniauth.params'] && request.env['omniauth.params']['space_id']
       space = Space.find_by_id(request.env['omniauth.params']['space_id'])
     end
 
+    if current_user && request.env.dig('omniauth.params', 'link_identity').to_s == '1'
+      link_identity(auth, space)
+      return
+    end
+
+    @user = User.from_omniauth(auth)
+
     if @user.new_record?
       # new user
       begin
@@ -42,4 +49,23 @@ def handle_callback(provider, config)
       redirect_to_space(after_sign_in_path_for(@user), space)
     end
   end
+
+  def link_identity(auth, space)
+    identity = Identity.from_omniauth(auth)
+
+    if identity.user == current_user
+      flash[:notice] = 'Identity is already linked to your account.'
+    elsif identity.user.present?
+      flash[:notice] = 'Identity is already linked to another account.'
+    else
+      identity.user = current_user
+      identity.save!
+      flash[:notice] = 'Identity linked successfully.'
+    end
+
+    redirect_to_space(user_identities_path(current_user), space)
+  rescue StandardError => e
+    flash[:notice] = "Could not link identity: #{e.message}"
+    redirect_to_space(user_identities_path(current_user), space)
+  end
 end

app/controllers/identities_controller.rb

@@ -0,0 +1,37 @@
+class IdentitiesController < ApplicationController
+  prepend_before_action :set_user
+  before_action :set_breadcrumbs
+  before_action :authorize_user
+
+  def index
+    @identities = @user.identities.order(:provider, :uid)
+  end
+
+  def destroy
+    identity = @user.identities.find(params[:id])
+
+    if @user.identities.one? && @user.encrypted_password.blank?
+      flash[:notice] = 'You cannot remove your last identity because your account has no password.'
+    else
+      identity.destroy
+      flash[:notice] = 'Identity removed.'
+    end
+
+    redirect_to user_identities_path(@user)
+  end
+
+  private
+
+  def set_user
+    @user = User.friendly.find(params[:user_id])
+  end
+
+  def authorize_user
+    handle_error(:forbidden) && return unless current_user == @user
+  end
+
+  def set_breadcrumbs
+    add_base_breadcrumbs('users')
+    @breadcrumbs += [{ name: @user.name, url: user_path(@user) }, { name: 'Manage identities' }]
+  end
+end

app/models/identity.rb

@@ -0,0 +1,10 @@
+class Identity < ApplicationRecord
+  belongs_to :user
+
+  validates :provider, presence: true
+  validates :uid, uniqueness: { scope: :provider }, allow_nil: true
+
+  def self.from_omniauth(auth)
+    Identity.where(provider: auth.provider, uid: auth.uid).first_or_initialize
+  end
+end

app/models/user.rb

@@ -43,6 +43,7 @@ class User < ApplicationRecord
   belongs_to :role, optional: true
   has_many :subscriptions, dependent: :destroy
   has_many :stars, dependent: :destroy
+  has_many :identities, dependent: :destroy
   has_one :ban, dependent: :destroy, inverse_of: :user
   has_many :bans_as_banner, class_name: 'Ban', foreign_key: :banner_id, inverse_of: :banner, dependent: :nullify
   has_many :activities_as_owner,
@@ -201,21 +202,21 @@ def self.from_omniauth(auth)
     # TODO: The code below will update their account to note the Elixir auth. but leave their password intact;
     # TODO: is this what we should be doing?
 
-    # find by provider and { uid or email}
-    users = User.where(provider: auth.provider, uid: auth.uid)
-    if users.none? && auth.info.email.present? && auth.provider.present?
-      users = User.where(provider: auth.provider, email: auth.info.email)
-    end
+    identity = Identity.where(provider: auth.provider, uid: auth.uid).first
+    user = identity&.user
 
-    # get first user
-    user = users.first
+    if user.nil? && auth.info.email.present? && auth.provider.present?
+      user = User.joins(:identities).where(email: auth.info.email, identities: { provider: auth.provider }).first
+    end
 
     if user
-      # update provider and uid if present
-      if user.provider.nil? and user.uid.nil?
-        user.uid = auth.uid
-        user.provider = auth.provider
-        user.save
+      existing_identity = user.identities.find_by(provider: auth.provider)
+      unless existing_identity&.uid == auth.uid
+        if existing_identity&.uid.blank?
+          existing_identity.update(uid: auth.uid)
+        else
+          user.identities.create(provider: auth.provider, uid: auth.uid)
+        end
       end
     else
       # set name components
@@ -226,12 +227,11 @@ def self.from_omniauth(auth)
 
       # create user
       username = User.username_from_auth_info(auth.info)
-      user = User.new(provider: auth.provider,
-                      uid: auth.uid,
-                      email: auth.info.email,
+      user = User.new(email: auth.info.email,
                       username: username,
                       profile_attributes: { firstname: first_name, surname: last_name },
       )
+      user.identities.build(provider: auth.provider, uid: auth.uid)
       user.skip_confirmation!
     end
 
@@ -260,7 +260,7 @@ def self.not_banned
   end
 
   def using_omniauth?
-    provider.present? && uid.present?
+    identities.any? || (provider.present? && uid.present?)
   end
 
   def password_required?

app/views/identities/index.html.erb

@@ -0,0 +1,45 @@
+<div class="page-header">
+  <%= page_title('Manage identities') %>
+</div>
+
+<p>Linked identities can be used to sign in to your account.</p>
+
+<div class="table-responsive">
+  <table class="table table-striped">
+    <thead>
+      <tr>
+        <th>Provider</th>
+        <th>UID</th>
+        <th></th>
+      </tr>
+    </thead>
+    <tbody>
+      <% @identities.each do |identity| %>
+        <tr>
+          <td><%= t("authentication.omniauth.providers.#{identity.provider}", default: identity.provider.to_s.titleize) %></td>
+          <td><%= identity.uid.presence || content_tag(:span, 'Not set', class: 'empty') %></td>
+          <td>
+            <%= link_to 'Remove', user_identity_path(@user, identity),
+                        method: :delete,
+                        data: { confirm: 'Are you sure you want to remove this identity?' },
+                        class: 'btn btn-danger btn-sm' %>
+          </td>
+        </tr>
+      <% end %>
+    </tbody>
+  </table>
+</div>
+
+<h4>Add a new identity</h4>
+<ul>
+  <% Devise.omniauth_configs.each do |provider, config| %>
+    <% params = { link_identity: '1' } %>
+    <% params[:space_id] = current_space.id unless current_space&.default? %>
+    <li>
+      <%= link_to t('authentication.omniauth.log_in_with',
+                    provider: config.options[:label] || t("authentication.omniauth.providers.#{provider}", default: provider.to_s.titleize)),
+                  omniauth_authorize_path('user', provider, **params),
+                  method: :post %>
+    </li>
+  <% end %>
+</ul>

app/views/users/show.html.erb

@@ -93,6 +93,7 @@
       <% if TeSS::Config.feature['registration'] %>
         <% if !current_user.nil? and current_user == @user %>
           <%= link_to "Manage account", edit_user_registration_path, :class => 'btn btn-default center-block' %>
+          <%= link_to "Manage identities", user_identities_path(@user), :class => 'btn btn-default center-block mt-2' %>
         <% end %>
       <% end %>
     </div>
@@ -109,6 +110,7 @@
           <% if TeSS::Config.feature['registration'] %>
             <%= link_to "Manage account", edit_user_registration_path, class: 'btn btn-default' %>
           <% end %>
+          <%= link_to "Manage identities", user_identities_path(@user), class: 'btn btn-default' %>
           <!-- Subscriptions Button -->
           <% if TeSS::Config.feature['subscription'] %>
             <%= link_to "Manage subscriptions", subscriptions_path, class: 'btn btn-default' %>

config/routes.rb

@@ -53,6 +53,7 @@
   get 'sitemap.xml' => 'sitemaps#index', format: false
 
   resources :users, only: [:show, :index, :edit, :create, :update, :destroy] do
+    resources :identities, only: [:index, :destroy]
     resource :ban, only: [:create, :new, :destroy]
   end
 

db/migrate/20260723102000_create_identities.rb

@@ -0,0 +1,25 @@
+class CreateIdentities < ActiveRecord::Migration[8.1]
+  def change
+    create_table :identities do |t|
+      t.references :user, null: false, foreign_key: true
+      t.string :provider, null: false
+      t.string :uid
+
+      t.timestamps
+    end
+
+    add_index :identities, [:provider, :uid], unique: true
+
+    reversible do |dir|
+      dir.up do
+        execute <<~SQL
+          INSERT INTO identities (user_id, provider, uid, created_at, updated_at)
+          SELECT id, provider, uid, NOW(), NOW()
+          FROM users
+          WHERE provider IS NOT NULL AND provider <> ''
+          ON CONFLICT (provider, uid) DO NOTHING
+        SQL
+      end
+    end
+  end
+end

test/controllers/identities_controller_test.rb

@@ -0,0 +1,48 @@
+require 'test_helper'
+
+class IdentitiesControllerTest < ActionController::TestCase
+  include Devise::Test::ControllerHelpers
+
+  test 'should show identities for current user' do
+    sign_in users(:existing_aaf_user)
+
+    get :index, params: { user_id: users(:existing_aaf_user) }
+
+    assert_response :success
+    assert_select 'h1', 'Manage identities'
+    assert_select 'tbody tr', minimum: 1
+  end
+
+  test "should not show another user's identities" do
+    sign_in users(:regular_user)
+
+    get :index, params: { user_id: users(:existing_aaf_user) }
+
+    assert_response :forbidden
+  end
+
+  test 'should remove linked identity' do
+    user = users(:regular_user)
+    sign_in user
+    identity = user.identities.create!(provider: 'oidc', uid: 'abc-123')
+
+    assert_difference('Identity.count', -1) do
+      delete :destroy, params: { user_id: user, id: identity }
+    end
+
+    assert_redirected_to user_identities_path(user)
+    assert_equal 'Identity removed.', flash[:notice]
+  end
+
+  test 'should not remove last identity when account has no password' do
+    user = users(:existing_aaf_user)
+    sign_in user
+
+    assert_no_difference('Identity.count') do
+      delete :destroy, params: { user_id: user, id: user.identities.first }
+    end
+
+    assert_redirected_to user_identities_path(user)
+    assert_equal 'You cannot remove your last identity because your account has no password.', flash[:notice]
+  end
+end

test/fixtures/identities.yml

@@ -0,0 +1,21 @@
+existing_aaf_user_oidc:
+  user: existing_aaf_user
+  provider: oidc
+  uid: '1234'
+
+trainer_user_oidc:
+  user: trainer_user
+  provider: oidc
+
+private_user_oidc:
+  user: private_user
+  provider: oidc
+
+existing_tuakiri_user_oidc2:
+  user: existing_tuakiri_user
+  provider: oidc2
+
+existing_aai_user_elixir_aai:
+  user: existing_aai_user
+  provider: elixir_aai
+  uid: '1234'