feat(sso): multi-identity-per-provider on /sso, gated by ALLOW_IDP_LINK_ANY_EMAIL

/sso now supports linking multiple identities of the same provider, gated by the existing ALLOW_IDP_LINK_ANY_EMAIL flag so the UI matches what the decision layer allows.

- joinLinkedIdps gains perIdentity: dedupe by idpId:idpUserId (every identity shown, residue still collapsed) vs legacy idpId.

- New linkableProviders helper: all active providers when multi-identity is on, else only not-yet-linked (legacy).

- resolveSsoManagement reads env.ALLOW_IDP_LINK_ANY_EMAIL and threads it into both helpers; SsoManagementData.unlinked renamed to linkable; route renders each identity as its own unlinkable row.

Flag off = byte-identical one-per-provider behavior. No decision-layer change: an already-mapped identity is still rejected (Shape-1 access-denied / ALREADY_EXISTS).

Author: yahyafakhroji

app/resources/sso/sso-management.ts

@@ -1,6 +1,6 @@
 // app/resources/sso/sso-management.ts
 //
-// /sso loader business logic: list linked/unlinked IdPs for the session user.
+// /sso loader business logic: list linked IdPs + linkable providers for the session user.
 // Extracted from sso.service.ts. Pure-internal decomposition — the
 // `resolveSsoManagement` signature + `SsoManagementData`/`SsoManagementResult`
 // shapes are unchanged and re-exported through the sso barrel.
@@ -30,7 +30,7 @@ export interface SsoManagementData {
   userId: string;
   loginName: string | null;
   linked: LinkedIdpView[];
-  unlinked: IdProvider[];
+  linkable: IdProvider[];
   allowUnlink: boolean;
 }
 
@@ -42,13 +42,21 @@ export interface SsoManagementData {
  * link that errored mid-ceremony could leave two rows for one IdP). First occurrence wins.
  * Exported for unit testing the join + dedupe in isolation from the loader's I/O.
  */
-export function joinLinkedIdps(links: IdpLink[], active: IdProvider[]): LinkedIdpView[] {
+export function joinLinkedIdps(
+  links: IdpLink[],
+  active: IdProvider[],
+  perIdentity = false
+): LinkedIdpView[] {
   const byId = new Map<string, IdProvider>(active.map((p) => [p.id, p]));
   const seen = new Set<string>();
   const out: LinkedIdpView[] = [];
   for (const link of links) {
-    if (seen.has(link.idpId)) continue; // dedupe by idpId — first occurrence wins
-    seen.add(link.idpId);
+    // perIdentity (multi-identity mode): dedupe on the full identity (idpId:idpUserId) so every
+    // distinct identity gets a row while still collapsing partial-link residue (the SAME identity
+    // duplicated mid-ceremony). Default (per-provider): dedupe on idpId — legacy one row per IdP.
+    const key = perIdentity ? `${link.idpId}:${link.idpUserId}` : link.idpId;
+    if (seen.has(key)) continue; // first occurrence wins
+    seen.add(key);
     const provider = byId.get(link.idpId);
     out.push(
       provider
@@ -59,14 +67,31 @@ export function joinLinkedIdps(links: IdpLink[], active: IdProvider[]): LinkedId
   return out;
 }
 
+/**
+ * Providers offered in the "link an account" section. With multi-identity linking ON every active
+ * provider is offered (you can always add another identity); with it OFF a provider is offered only
+ * when no link for it exists yet (legacy one-per-provider).
+ */
+export function linkableProviders(
+  active: IdProvider[],
+  linked: LinkedIdpView[],
+  allowMulti: boolean
+): IdProvider[] {
+  if (allowMulti) return [...active];
+  const linkedIds = new Set(linked.map((l) => l.idpId));
+  return active.filter((p) => !linkedIds.has(p.id));
+}
+
 export type SsoManagementResult =
   | { kind: 'redirect'; location: string }
   | { kind: 'data'; data: SsoManagementData; setCookie: string | null };
 
 /**
  * /sso loader logic. Lists the active IdPs, resolves the ceremony session (guarding a
  * transient ProviderError into a service_unavailable redirect), and shapes the
- * linked/unlinked split. Returns a redirect to /login when there is no session user.
+ * linked list + linkable providers (env.ALLOW_IDP_LINK_ANY_EMAIL gates multi-identity:
+ * per-identity rows + all providers offered when on; legacy one-per-provider when off).
+ * Returns a redirect to /login when there is no session user.
  *
  * `getCsrfToken` is injected so the route can wire the request-scoped CSRF token without
  * the service depending on the server CSRF module directly.
@@ -103,11 +128,10 @@ export async function resolveSsoManagement(
     return { kind: 'redirect', location: '/login' };
   }
 
-  // listIdpLinks now returns IdpLink[] — no cast needed.
+  const allowMulti = env.ALLOW_IDP_LINK_ANY_EMAIL;
   const links = await provider.listIdpLinks(userId);
-  // Join links ↔ active IdPs by idpId to attach {name,type,logoUrl} and dedupe.
-  const linked = joinLinkedIdps(links, active);
-  const linkedIds = new Set(linked.map((l) => l.idpId));
+  // Join links ↔ active IdPs; per-identity rows when multi-identity linking is on.
+  const linked = joinLinkedIdps(links, active, allowMulti);
 
   return {
     kind: 'data',
@@ -116,7 +140,8 @@ export async function resolveSsoManagement(
       userId,
       loginName: session?.user?.loginName ?? null,
       linked,
-      unlinked: active.filter((p) => !linkedIds.has(p.id)),
+      // Multi on → offer every provider (add another); off → only providers with no link yet.
+      linkable: linkableProviders(active, linked, allowMulti),
       allowUnlink: env.ALLOW_IDP_UNLINK,
     },
     setCookie: csrf.setCookie,

app/routes/sso/index.tsx

@@ -66,7 +66,7 @@ export async function action({ request }: ActionFunctionArgs, deps: SsoActionDep
 // ---------------------------------------------------------------------------
 
 export default function SsoPage() {
-  const { csrfToken, loginName, linked, unlinked, allowUnlink } = useLoaderData<typeof loader>();
+  const { csrfToken, loginName, linked, linkable, allowUnlink } = useLoaderData<typeof loader>();
 
   return (
     <AuthCard
@@ -136,16 +136,16 @@ export default function SsoPage() {
 
         {/* Divider between the connected list and the available-to-link list — only
             when both are present so a single-section page has no dangling rule. */}
-        {linked.length > 0 && unlinked.length > 0 ? <Separator /> : null}
+        {linked.length > 0 && linkable.length > 0 ? <Separator /> : null}
 
         {/* Unlinked / available IdPs */}
-        {unlinked.length > 0 ? (
+        {linkable.length > 0 ? (
           <section className="flex flex-col gap-3">
             <h2 className="text-foreground text-sm font-medium">
               <Trans>Available accounts to link</Trans>
             </h2>
             <ul className="flex flex-col gap-2">
-              {unlinked.map((idp: IdProvider) => (
+              {linkable.map((idp: IdProvider) => (
                 <li key={idp.id}>
                   {/* RRForm: auto-adds ?index → posts to the sso index action. */}
                   <RRForm method="post">

cypress/component/resources/sso/sso-management.cy.ts

@@ -4,7 +4,7 @@
 // joinLinkedIdps is the pure link↔active-IdP join + dedupe — imported from the module (not the
 // heavy barrel) so the browser bundle stays light; runs browser-side with Chai.
 import type { IdpLink, IdProvider } from '@/modules/auth/types';
-import { joinLinkedIdps } from '@/resources/sso/sso-management';
+import { joinLinkedIdps, linkableProviders } from '@/resources/sso/sso-management';
 
 const GOOGLE: IdProvider = {
   id: 'idp-google',
@@ -72,3 +72,56 @@ describe('joinLinkedIdps — 755-M6 join + dedupe', () => {
     expect(joinLinkedIdps([], [GOOGLE, GITHUB])).to.deep.equal([]);
   });
 });
+
+describe('joinLinkedIdps — per-identity dedupe (multi-identity mode)', () => {
+  it('keeps two identities of the SAME provider as separate rows when perIdentity=true', () => {
+    const a = linkOf('idp-github', 'gh-a', 'a-handle');
+    const b = linkOf('idp-github', 'gh-c', 'c-handle');
+    const out = joinLinkedIdps([a, b], [GITHUB], true);
+    expect(out).to.have.length(2);
+    expect(out.map((v) => v.idpUserId)).to.deep.equal(['gh-a', 'gh-c']);
+    expect(out.every((v) => v.name === 'GitHub')).to.equal(true);
+  });
+
+  it('still collapses exact-duplicate identity rows (partial-link residue) when perIdentity=true', () => {
+    const dup = linkOf('idp-github', 'gh-a', 'a-handle');
+    const out = joinLinkedIdps([dup, { ...dup }], [GITHUB], true);
+    expect(out).to.have.length(1);
+    expect(out[0].idpUserId).to.equal('gh-a');
+  });
+
+  it('per-provider dedupe (perIdentity=false / default) is unchanged — same idpId collapses', () => {
+    const out = joinLinkedIdps(
+      [linkOf('idp-github', 'gh-a'), linkOf('idp-github', 'gh-c')],
+      [GITHUB],
+      false
+    );
+    expect(out).to.have.length(1);
+    expect(out[0].idpUserId).to.equal('gh-a');
+  });
+});
+
+describe('linkableProviders — env-gated link options', () => {
+  it('returns ALL active providers when allowMulti=true (always offer another)', () => {
+    const linked = joinLinkedIdps([linkOf('idp-github', 'gh-a')], [GITHUB], true);
+    const out = linkableProviders([GOOGLE, GITHUB], linked, true);
+    expect(out.map((p) => p.id)).to.deep.equal(['idp-google', 'idp-github']);
+  });
+
+  it('filters out already-linked providers when allowMulti=false (legacy one-per-provider)', () => {
+    const linked = joinLinkedIdps([linkOf('idp-github', 'gh-a')], [GITHUB], false);
+    const out = linkableProviders([GOOGLE, GITHUB], linked, false);
+    expect(out.map((p) => p.id)).to.deep.equal(['idp-google']);
+  });
+
+  it('returns all active providers when nothing is linked (either mode)', () => {
+    expect(linkableProviders([GOOGLE, GITHUB], [], true).map((p) => p.id)).to.deep.equal([
+      'idp-google',
+      'idp-github',
+    ]);
+    expect(linkableProviders([GOOGLE, GITHUB], [], false).map((p) => p.id)).to.deep.equal([
+      'idp-google',
+      'idp-github',
+    ]);
+  });
+});

cypress/component/routes/sso/sso-render.cy.tsx

@@ -83,7 +83,7 @@ describe('SsoIndex — AuthFormFields csrf adoption', () => {
     userId: 'u1',
     loginName: 'you@acme.test',
     linked: [{ idpId: 'g', idpUserId: 'gx', idpUserName: 'Google You' }],
-    unlinked: [{ id: 'gh', name: 'GitHub' }],
+    linkable: [{ id: 'gh', name: 'GitHub' }],
     allowUnlink: true,
   };