Sigra.OAuth.Callback (Sigra v1.20.0)

Copy Markdown View Source

Processes OAuth callback data and routes to the appropriate account action.

After successful token exchange, this module determines the correct path:

  1. Existing identity -- identity found by (provider, provider_uid). Updates identity fields (D-31) and logs user in.
  2. Email match -- no identity, but a user with the same email exists. Returns {:link_confirmation_required, ...} for the controller to redirect to login (D-01, D-02).
  3. New user -- no identity and no email match. Registers user with confirmed_at set if provider email is trusted (D-42). Creates identity and session in a single transaction (Pitfall 6: race condition safety).
  4. No email -- provider didn't return email. Error (D-08).
  5. UID/email conflict -- provider_uid maps to identity A but email matches user B. Blocked with generic error (D-09).

Identity lookups are always by (provider, provider_uid), never by email alone (D-32).

Summary

Functions

process_callback(config, provider, user_info, token)

Processes an OAuth callback and routes to the appropriate account action.

Functions

process_callback(config, provider, user_info, token)

(since 0.5.0) 
@spec process_callback(map(), atom(), map(), map()) ::
  {:ok, atom(), map(), map()}
  | {:link_confirmation_required, map()}
  | {:error,
     %Sigra.Error.OAuthError{
       __exception__: true,
       error_code: term(),
       message: term(),
       provider: term()
     }}

Processes an OAuth callback and routes to the appropriate account action.

Parameters

  • config - Sigra config map with :repo, :user_schema, :identity_schema, :oauth, :session
  • provider - Provider atom (e.g., :google)
  • user_info - Normalized user info map from the strategy wrapper
  • token - Token map from the provider

Returns

  • {:ok, :registered, user, session} - new user registered
  • {:ok, :logged_in, user, session} - existing identity login
  • {:link_confirmation_required, %{provider: p, email: e, provider_uid: uid}} - email match
  • {:error, %OAuthError{error_code: :no_email}} - provider returned no email
  • {:error, %OAuthError{error_code: :email_mismatch}} - UID/email cross-account conflict