Validate external account state and identity

[niemyjski]

Prevent simultaneous external sign-in and linking from creating duplicate identity owners or losing another link. Validate provider names and subject IDs at the request/model boundaries, and use fresh ownership reads while preserving account transfers, session revocation, and last-sign-in protection.

Validation: clean build; 84 local tests and all CI checks passed, including 3,450 backend tests (3 configured skips), six browser shards and the flaky-test gate, client, and Docker. Local integration startup was blocked by unhealthy Docker; hosted CI verified those cases.

API behavior change: unlink rejects unknown, mixed-case, or whitespace-padded provider names with 422; accepted names are exactly github, google, facebook, and windowslive. Blank/null/whitespace subject IDs retain their existing 400 status and ProblemDetails title. The request body remains { "value": "subject" }.

Verification and implementation details

• Provider allowlists live in the unlink request and OAuth account DataAnnotations. The account model also requires a nonblank subject ID. Existing MiniValidation filters and repository validation reject invalid input before mutation/persistence; helpers and repository queries contain no provider whitelist guards. A boundary response filter preserves unlink's existing 400 response for invalid subjects after request validation. The OAuth adapter assigns the canonical name for its selected SDK client.
• External login holds identity and normalized-email locks before resolving ownership, then affected-user locks. Foundatio 13.0.5's multi-resource helper deduplicates and sorts keys. Mandatory locks use AcquireAsync, and unlink shares the user lock. The existing UserRepository immediate-consistency default makes writes searchable before lock release. Fresh user records must be active, retain the exact identity, and match the current authentication generation before authentication or writes.
• Account admission explicitly disables email-lookup caching. A canceled cached lookup can otherwise finish after locks are released and publish a stale cached miss, concealing a user saved by another request. The new HTTP regression seeds that miss and requires the stored owner's token, unchanged user count, and link on that owner. Ordinary email lookups retain their existing cached default.
• Request cancellation and a 15-second deadline bound acquisition/read waits. The installed timeout overload cannot also accept a request token, so the linked source is required. Native repository reads lack cancellation support; WaitAsync is confined to uncached admission reads. Before mutation, admission disables its deadline; persistence, token revocation, invitations, and replacement-token issuance then remain fully awaited inside the locks.
• Exact ordinal provider/subject pairing and pagination remain in the repository because Elasticsearch object mappings flatten arrays. Ambiguous legacy owners fail closed. Link addition is idempotent; removal cleans duplicate copies while preserving a sign-in method.
• Integration coverage includes simultaneous creation, competing transfers, different links on one user, unavailable locks, cancellation, login racing unlink, stale email-cache misses, invalid input without state/token changes, and persistence validation. Handler regressions require token issuance after cancellation following persistence. Validator regressions reproduced six invalid-input failures before their fixes. OpenAPI response metadata and the snapshot reflect unlink's validation and last-sign-in responses.
• Automatic shard discovery, retries, required checks, dependencies, and infrastructure configuration are unchanged. The webhook telemetry test uses an explicit parent sampling decision to remain stable with parallel application tracing providers; production telemetry is unchanged.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c8fe4a7e1b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 947136c138

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 90e17b83be

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1b01df4dbd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7887e932c0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8242e080e6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 388b2a6401

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a7b95bf33e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Package	Line Rate	Branch Rate	Complexity	Health
Exceptionless.AppHost	23%	23%	128	❌
Exceptionless.Core	78%	70%	10942	✔
Exceptionless.Insulation	51%	43%	370	➖
Exceptionless.Web	86%	71%	9296	✔
Summary	80% (28441 / 35395)	69% (14079 / 20300)	20736	✔