Cross-provider OAuth login cannot link accounts that share the same verified email address

[Ridanshi]

Summary

Users who authenticate through multiple OAuth providers using the same verified email address can end up with multiple independent accounts instead of a single linked identity.

This fragments profile data, cards, follows, analytics, and connected integrations.

Affected Files

• auth.ts
• oauth.ts
• userService.ts

Root Cause

OAuth account creation appears to prioritize provider identity over verified email reconciliation.

When a user signs in with a second provider, the authentication flow creates a new account rather than linking the new provider identity to the existing account associated with the same verified email address.

Reproduction

1. Sign up using Google OAuth.
2. Create cards and profile data.
3. Log out.
4. Sign in using GitHub OAuth with the same verified email address.
5. Observe that a second account is created.
6. Compare profile and card ownership between both accounts.

Expected Behavior

OAuth providers sharing the same verified email should resolve to the same user account and link identities appropriately.

Actual Behavior

Separate user accounts are created for the same individual.

Why This Is Difficult To Detect

Most testing focuses on a single OAuth provider.

The issue only appears when multiple providers are used with the same verified email address.

Production Impact

• Duplicate user accounts
• Split profile ownership
• Lost cards and follows
• Confusing login experience
• Fragmented analytics

Suggested Fix

Implement verified-email reconciliation and provider linking before account creation.

Severity

High

[Ridanshi]

I investigated this issue and would like to work on it.

The current OAuth account creation flow appears to create separate accounts instead of linking identities that share the same verified email address.

I plan to:

• review provider linking behavior
• preserve existing authentication flows
• implement safe account reconciliation
• add regression coverage for multi-provider authentication scenarios

Please assign this issue to me.