External authentication: a customer can get two links of the same provider
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 57/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- csharp, mongodb
调研方向
Start with src/Business/Grand.Business.Authentication/Services/ExternalAuthenticationService.cs and trace Authenticate through AuthenticateNewUser to AssociateCustomer; compare its duplicate-link behavior with the existing “Account is already assigned” check. Review Views/Account/Info.cshtml for the one-link-per-provider expectation. Decide how duplicate links should be handled, then check whether a migration and cleanup report are needed before adding a unique (ProviderSystemName, CustomerId) index; done means duplicate links are prevented and existing duplicates are addressed.
由索引模型根据 Issue 内容生成。
描述
Problem
A customer can end up with two external sign-in links of the same provider (for example two Google accounts attached to one customer).
ExternalAuthenticationService.Authenticate → AuthenticateNewUser → AssociateCustomer(currentLoggedInUser, parameters) (src/Business/Grand.Business.Authentication/Services/ExternalAuthenticationService.cs) runs when a signed-in, registered customer completes Google or Facebook sign-in with an external account that has no link yet. It inserts a new ExternalAuthentication record without checking whether this customer already has a link of that provider.
The account page suggests one link per provider: Views/Account/Info.cshtml offers to add more external records only while the number of active providers is greater than the number of links.
How to reproduce
- Enable the Google authentication plugin.
- Sign in to the store with a password and connect Google account A (sign in with Google while signed in).
- While still signed in, use "Sign in with Google" again and choose Google account B.
- My account → external authentication: two Google records for the same customer.
Expected
One link per provider and customer: a second account of the same provider is refused with a clear message (as "Account is already assigned" is today for an external account linked to someone else), or the existing link is replaced after confirmation. A unique index (ProviderSystemName, CustomerId) on ExternalAuthentication would then enforce it for every provider (existing duplicates have to be reported/cleaned up by the migration).
Notes
The OpenID Connect login (stack #892–#897) already enforces one OIDC identity per customer on its own (deterministic link id); this issue is about Google, Facebook and other providers using ExternalAuthenticationService.
- 主要语言
- C#
- 星标
- 1.3k
- 派生
- 549
- 平均合并
- 8 小时 14 分钟
- 30 天内合并 PR
- 55
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
grandnode/grandnode2 的其他 Issue
-
bug
难度 3/5 1-2 天 新手友好度 65/100
grandnode/grandnode2#881 ·
维护者通常 1 天内回复
-
enhancement
难度 5/5 一周以上 新手友好度 35/100
grandnode/grandnode2#880 ·
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 25/100
grandnode/grandnode2#849 ·
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 50/100
grandnode/grandnode2#499 ·
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 35/100
grandnode/grandnode2#410 ·
维护者通常 1 天内回复
查看 grandnode/grandnode2 的全部 Issue
相似的 Issue
-
:watch: Not Triaged async-task-programming/subsvc dotnet-csharp/svc
难度 1/5 1 小时以内 新手友好度 88/100
维护者通常 1 天内回复
-
Python: Bug: AnnotationContent and StreamingAnnotationContent to_element writes CitationType.X, so annotations in a rendered chat history fail to parse可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭python triage
难度 2/5 1-3 小时 新手友好度 82/100
microsoft/semantic-kernel#14590 ·
维护者通常 3 天内回复
-
难度 1/5 1 小时以内 新手友好度 90/100
维护者通常 1 天内回复
-
Needs-Triage
难度 1/5 1 小时以内 新手友好度 88/100
PowerShell/PowerShell#28194 ·
维护者通常 1 天内回复
-
AI Projects Client customer-reported needs-team-attention question Service Attention
难度 2/5 1-3 小时 新手友好度 70/100
Azure/azure-sdk-for-net#63804 · 3 条评论 · 1 个 reaction ·
维护者通常 1 天内回复