step3/docs/EXTERNAL_AUTH.md

External Authentication

RanaZe supports provider-neutral external identities. Users can sign in with a configured provider or connect it from Profile. Every account remains password-backed, and an external identity is never linked automatically by matching email addresses.

Google setup

Create separate Google OAuth 2.0 Web application clients for UAT and production. Configure these exact authorized redirect URIs:

• UAT: https://us3q.ranaze.com/api/Auth/external/google/callback
• Production: https://s3q.ranaze.com/api/Auth/external/google/callback

Add the credentials as Gitea repository secrets:

• UAT_GOOGLE_CLIENT_ID
• UAT_GOOGLE_CLIENT_SECRET
• PRD_GOOGLE_CLIENT_ID
• PRD_GOOGLE_CLIENT_SECRET

The deployment scripts treat Google as optional. If either credential is absent, Google is omitted from the API provider list and the client does not display its button.

Account-linking rules

• A provider subject can belong to only one RanaZe user.
• A RanaZe user can connect at most one identity per provider.
• A verified Google email that already exists requires the user to choose Link an existing RanaZe account and enter that account's password.
• Connected providers are intentionally not removable in the current UI to prevent accidental lockout and identity takeover edge cases.
• Legacy Users.SteamId values are backfilled into ExternalIdentities; new Steam links are dual-written during the compatibility period.

Collections

• ExternalIdentities stores durable provider-to-user mappings.
• ExternalAuthTransactions stores short-lived login/link state and has a TTL index.

Deleting a user purges both collections for that user.