fix(auth): a GitHub account someone has is theirs to switch to where passwords are offered too

Linking refused every GitHub account with `deprecated` where people sign in
with a password, before asking whether the account was someone else's. An
anonymous person tapping Sign in with GitHub, whose app links first and
switches to the account's person when it is taken, so never got to the
switch: the end-to-end test of 21 Oct found it. Nothing is linked either
way; the account someone has is said to be theirs first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-21 19:12:26 +02:00
commit 562d334e6e
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64

View file

@ -340,7 +340,8 @@ Built on the three parts above, on the register (members forward every step thro
- **Older ways:** an account that signs in with a password (it had a confirmed
authenticator, which a reset may have taken since: `passwordOnly` in its ways in) no
longer signs in with GitHub (`usePassword`); where passwords are offered, no new GitHub
account is linked (`deprecated`); from `GITHUB_SIGN_IN_ENDS` on GitHub signs nobody in
account is linked (`deprecated`; one someone else has is still `takenByAnotherPerson`,
so an anonymous person's app switches to it); from `GITHUB_SIGN_IN_ENDS` on GitHub signs nobody in
(`ended`), the basics stop naming the day (`gitHubSignInEnds`, which apps show until
then) and, 30 days later (`gitHubAccountsKeptAfterEnd`, so a date set wrong can be put
right first), `forgetGitHubAccounts` deletes every GitHub ID on the register, first