Guard legacy Google accounts through provider login expansion

internal/auth/slack_test.go

@@ -192,3 +192,31 @@ func (t rewriteTransport) RoundTrip(r *http.Request) (*http.Response, error) {
 	cloned.URL.Scheme, cloned.URL.Host = target.Scheme, target.Host
 	return http.DefaultTransport.RoundTrip(cloned)
 }
+
+func TestGoogleIdentityKeepsLegacyAccount(t *testing.T) {
+	dsn := os.Getenv("PLATFORM_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("requires isolated integration database")
+	}
+	db, err := sql.Open("pgx", dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	s := &service{db: db}
+	grant, err := s.identityGrant(context.Background(), "fixture", "google", "existing-google", nil, "Existing Google User", "", digest(token()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	var account string
+	if err = db.QueryRow("SELECT account_id::text FROM login_grants WHERE project='fixture' AND token_hash=$1", digest(grant)).Scan(&account); err != nil {
+		t.Fatal(err)
+	}
+	if account != "00000000-0000-0000-0000-000000000001" {
+		t.Fatal("legacy Google identity changed account ID")
+	}
+	var count int
+	if err = db.QueryRow("SELECT count(*) FROM project_sessions WHERE project='fixture' AND token_hash='existing-session'").Scan(&count); err != nil || count != 1 {
+		t.Fatalf("existing Google session was lost %v", err)
+	}
+}