fix(auth): a GitHub account someone has is theirs to switch to where passwords are offered too

Linking refused every GitHub account with `deprecated` where people sign in
with a password, before asking whether the account was someone else's. An
anonymous person tapping Sign in with GitHub, whose app links first and
switches to the account's person when it is taken, so never got to the
switch: the end-to-end test of 21 Oct found it. Nothing is linked either
way; the account someone has is said to be theirs first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_server/README.md

@@ -340,7 +340,8 @@ Built on the three parts above, on the register (members forward every step thro
 - **Older ways:** an account that signs in with a password (it had a confirmed
   authenticator, which a reset may have taken since: `passwordOnly` in its ways in) no
   longer signs in with GitHub (`usePassword`); where passwords are offered, no new GitHub
-  account is linked (`deprecated`); from `GITHUB_SIGN_IN_ENDS` on GitHub signs nobody in
+  account is linked (`deprecated`; one someone else has is still `takenByAnotherPerson`,
+  so an anonymous person's app switches to it); from `GITHUB_SIGN_IN_ENDS` on GitHub signs nobody in
   (`ended`), the basics stop naming the day (`gitHubSignInEnds`, which apps show until
   then) and, 30 days later (`gitHubAccountsKeptAfterEnd`, so a date set wrong can be put
   right first), `forgetGitHubAccounts` deletes every GitHub ID on the register, first

packages/halkyon_base_server/lib/src/auth/github.dart

@@ -208,7 +208,10 @@ Future<String> verifiedGitHubUserId(
 /// nothing changed, when the account belongs to someone else or the person
 /// has another GitHub account, and wherever people sign in with a password
 /// (ADR 0017: GitHub is deprecated, [GitHubSignInRefusal.deprecated])
-/// ([GitHubSignInRefusedException]).
+/// ([GitHubSignInRefusedException]). An account someone else has is said to
+/// be so there too, as nothing would be linked: an anonymous person's app
+/// then switches to it (`gitHubSignIn.signIn`), which still signs in those
+/// who have one.
 Future<void> linkGitHubAccount(
   Session session, {
   required UuidValue authUserId,
@@ -229,16 +232,16 @@ Future<void> linkGitHubAccount(
   )) {
     return;
   }
-  if (passwordSignInAvailable(session.serverpod)) {
-    throw GitHubSignInRefusedException(
-      reason: GitHubSignInRefusal.deprecated,
-    );
-  }
   if (accounts.any((account) => account.userIdentifier == gitHubUserId)) {
     throw GitHubSignInRefusedException(
       reason: GitHubSignInRefusal.takenByAnotherPerson,
     );
   }
+  if (passwordSignInAvailable(session.serverpod)) {
+    throw GitHubSignInRefusedException(
+      reason: GitHubSignInRefusal.deprecated,
+    );
+  }
   if (accounts.isNotEmpty) {
     throw GitHubSignInRefusedException(
       reason: GitHubSignInRefusal.otherGitHubAccountLinked,

packages/halkyon_base_server/test/integration/auth/github_test.dart

@@ -194,6 +194,22 @@ void main() {
         expect(await gitHubAccountToSignIn(session, '1001'), ben);
       });
 
+      test(
+        "tells an anonymous person whose GitHub account is another's so, "
+        'as linking nothing, for the app to switch to that account',
+        () async {
+          usePasswordKeys(session.serverpod, testPasswordKeys);
+          EmailCodes.of(session.serverpod).mailer = const LogCodeMailer();
+
+          await expectLater(
+            linkGitHubAccount(session, authUserId: anna, gitHubUserId: '1001'),
+            throwsA(_refusal(GitHubSignInRefusal.takenByAnotherPerson)),
+          );
+          expect(await _isAnonymous(session, anna), isTrue);
+          expect(await gitHubAccountToSignIn(session, '1001'), ben);
+        },
+      );
+
       test('signs nobody in and links nothing from the day it ends, after '
           'which pruning forgets every GitHub ID', () async {
         final ends = DateTime.utc(2027, 1, 22);