fix(sso): infer GitHub IdP from username when type is missing

A linked IdP carries an explicit `type` only when its idpId still matches an
active provider (joinLinkedIdps); a link to a deactivated/omitted provider
arrives with type undefined, so IdpIcon fell back to the generic mail glyph
even for a plain GitHub handle — confusing UX.

Add inferIdpType (handle-shaped username, no @/., → GITHUB) and apply it as a
fallback (type ?? inferIdpType(username)) on the linked-account icons in both
the SSO linked-accounts list and the account picker. A real backend type
always wins; email-shaped logins keep the neutral glyph.

Author: yahyafakhroji

app/modules/auth/idp-detect.ts

@@ -0,0 +1,22 @@
+// Best-effort IdP type inference from a linked account's username.
+//
+// Why: a linked IdP only carries an explicit `type` when its `idpId` still matches an ACTIVE
+// provider (see joinLinkedIdps). A link to a deactivated provider — or one the backend omits
+// from the active list — arrives with `type` undefined, so the row falls back to the generic
+// mail glyph even when the username is obviously a GitHub handle. This recovers the icon from
+// the only signal left: the shape of the username.
+//
+// Scope: v1 supports Google + GitHub (see idp-slug TYPE_TO_SLUG). Google logins are email
+// addresses; GitHub logins are bare handles (alphanumeric + non-leading/trailing hyphens, no
+// '@' or '.'). So only GitHub is inferable here — anything email-shaped returns undefined and
+// keeps the caller's generic fallback. Always pair as `link.type ?? inferIdpType(...)` so a real
+// type wins.
+
+// GitHub username rules: 1–39 chars, alphanumeric or single internal hyphens, no leading/
+// trailing or consecutive hyphens. This intentionally rejects emails (the '.'/'@' fail it).
+const GITHUB_HANDLE = /^[a-z\d](?:[a-z\d]|-(?=[a-z\d])){0,38}$/i;
+
+export function inferIdpType(username?: string | null): string | undefined {
+  if (!username) return undefined;
+  return GITHUB_HANDLE.test(username) ? 'GITHUB' : undefined;
+}

app/modules/i18n/locales/en.po

@@ -36,15 +36,15 @@ msgstr "A new code has been sent to your email."
 msgid "Activate your device"
 msgstr "Activate your device"
 
-#: app/routes/accounts.tsx:116
+#: app/routes/accounts.tsx:117
 msgid "Add an account"
 msgstr "Add an account"
 
 #: app/routes/setup/mfa.tsx:160
 msgid "Add an extra layer of security to your account by setting up a second factor."
 msgstr "Add an extra layer of security to your account by setting up a second factor."
 
-#: app/routes/accounts.tsx:198
+#: app/routes/accounts.tsx:201
 msgid "Add another account"
 msgstr "Add another account"
 
@@ -112,7 +112,7 @@ msgstr "Authorize device"
 msgid "Authorizing as"
 msgstr "Authorizing as"
 
-#: app/routes/sso/index.tsx:141
+#: app/routes/sso/index.tsx:145
 msgid "Available accounts to link"
 msgstr "Available accounts to link"
 
@@ -148,7 +148,7 @@ msgstr "Check your email"
 msgid "Choose a new password"
 msgstr "Choose a new password"
 
-#: app/routes/accounts.tsx:90
+#: app/routes/accounts.tsx:91
 msgid "Choose an account"
 msgstr "Choose an account"
 
@@ -177,7 +177,7 @@ msgstr "Confirm new password"
 msgid "Confirm password"
 msgstr "Confirm password"
 
-#: app/routes/sso/index.tsx:88
+#: app/routes/sso/index.tsx:89
 msgid "Connected accounts"
 msgstr "Connected accounts"
 
@@ -339,15 +339,15 @@ msgstr "Link expired"
 msgid "Link your account"
 msgstr "Link your account"
 
-#: app/routes/sso/index.tsx:72
+#: app/routes/sso/index.tsx:73
 msgid "Linked accounts"
 msgstr "Linked accounts"
 
 #: app/routes/setup/authenticator.tsx:131
 msgid "Manual setup key"
 msgstr "Manual setup key"
 
-#: app/routes/accounts.tsx:161
+#: app/routes/accounts.tsx:164
 msgid "Needs re-authentication"
 msgstr "Needs re-authentication"
 
@@ -364,7 +364,7 @@ msgstr "No account was found and sign-up is not available."
 msgid "No sign-in method is available for this account."
 msgstr "No sign-in method is available for this account."
 
-#: app/routes/accounts.tsx:108
+#: app/routes/accounts.tsx:109
 msgid "No signed-in accounts."
 msgstr "No signed-in accounts."
 
@@ -476,7 +476,7 @@ msgstr "Scan the QR code below with your authenticator app, then enter the 6-dig
 msgid "Security key"
 msgstr "Security key"
 
-#: app/routes/accounts.tsx:91
+#: app/routes/accounts.tsx:92
 msgid "Select an account to continue or add a new one."
 msgstr "Select an account to continue or add a new one."
 
@@ -492,7 +492,7 @@ msgstr "Send reset link"
 msgid "Service temporarily unavailable. Please try again."
 msgstr "Service temporarily unavailable. Please try again."
 
-#: app/routes/accounts.tsx:159
+#: app/routes/accounts.tsx:162
 msgid "Session active"
 msgstr "Session active"
 
@@ -557,7 +557,7 @@ msgstr "Sign in with LDAP"
 #: app/routes/logout/index.tsx:47
 #: app/routes/logout/index.tsx:53
 #: app/routes/signed-in.tsx:97
-#: app/routes/sso/index.tsx:179
+#: app/routes/sso/index.tsx:183
 msgid "Sign out"
 msgstr "Sign out"
 
@@ -663,7 +663,7 @@ msgstr "Too many attempts. Please wait a moment and try again."
 msgid "Two-factor verification"
 msgstr "Two-factor verification"
 
-#: app/routes/sso/index.tsx:123
+#: app/routes/sso/index.tsx:127
 msgid "Unlink"
 msgstr "Unlink"
 
@@ -771,7 +771,7 @@ msgid "You are signed in as <0>{loginName}</0>"
 msgstr "You are signed in as <0>{loginName}</0>"
 
 #. placeholder {0}: loginName && ( <> Logged in as <span className="font-medium">{loginName}</span>. </> )
-#: app/routes/sso/index.tsx:74
+#: app/routes/sso/index.tsx:75
 msgid "You can link multiple accounts to your Datum account. {0}"
 msgstr "You can link multiple accounts to your Datum account. {0}"
 
@@ -795,7 +795,7 @@ msgstr "You may return to your device."
 msgid "You must be signed in to link an external account."
 msgstr "You must be signed in to link an external account."
 
-#: app/routes/accounts.tsx:98
+#: app/routes/accounts.tsx:99
 msgid "You signed in as a different account than the one you were re-authenticating. Both are kept — choose an account to continue."
 msgstr "You signed in as a different account than the one you were re-authenticating. Both are kept — choose an account to continue."
 

app/routes/accounts.tsx

@@ -3,6 +3,7 @@ import { AuthFormFields } from '@/components/auth-form/auth-form-fields';
 import { FormError } from '@/components/form-error/form-error';
 import { IdpIcon } from '@/components/idp-icon/idp-icon';
 import { useAuthActionError } from '@/hooks/use-auth-action-error';
+import { inferIdpType } from '@/modules/auth/idp-detect';
 import { isAllowedRequestId } from '@/resources/authorize';
 import {
   listAccounts,
@@ -138,8 +139,10 @@ export default function AccountPicker() {
                   <button
                     type="submit"
                     className="hover:bg-muted/50 focus-visible:ring-ring flex w-full items-center gap-2 rounded-l-lg p-3 text-left transition-colors focus-visible:ring-2 focus-visible:outline-none">
+                    {/* idpType is absent for deactivated/unknown providers; recover GITHUB from a
+                        handle-shaped loginName so it doesn't fall back to the mail glyph. */}
                     <IdpIcon
-                      type={account.idpType}
+                      type={account.idpType ?? inferIdpType(account.loginName)}
                       name={account.displayName ?? account.loginName}
                     />
                     <span className="flex min-w-0 flex-col">

app/routes/sso/index.tsx

@@ -1,6 +1,7 @@
 import { AuthCard } from '@/components/auth-card/auth-card';
 import { AuthFormFields } from '@/components/auth-form/auth-form-fields';
 import { IdpIcon } from '@/components/idp-icon/idp-icon';
+import { inferIdpType } from '@/modules/auth/idp-detect';
 import { slugify } from '@/modules/auth/idp-slug';
 import type { IdProvider } from '@/modules/auth/types';
 import {
@@ -96,8 +97,11 @@ export default function SsoPage() {
                       Falls back to the bare IdP user name / id when the provider is no longer
                       active. Icon is non-interactive — no nested-interactive a11y violation. */}
                   <span className="flex min-w-0 items-center gap-3">
+                    {/* `type` is only joined in when the IdP is still active; for a deactivated
+                        provider it's undefined and the bare GitHub handle would fall back to the
+                        mail glyph. inferIdpType recovers GITHUB from the username shape. */}
                     <IdpIcon
-                      type={link.type}
+                      type={link.type ?? inferIdpType(link.idpUserName)}
                       name={link.name || link.idpUserName || link.idpId}
                       logoUrl={link.logoUrl}
                     />