raystack / frontier / 33429107510

50%

main: 49%

Pull #1912

github

feat(authenticate): separate login from signup with an explicit intent

Frontier cannot tell a signup from a login: every strategy ends at
getOrCreateUser, which returns the existing user or creates one, so a
login with an unknown address silently creates the account.

Adds a FlowIntent carried on flow metadata and both gates from the RFC's
intent by strategy table. StartFlow is the fast path, rejecting a login
with no account or a signup with one before an OTP is sent, for the
strategies that know the email that early. User creation is the gate that
matters, since every strategy reaches it and OIDC has no email until the
callback.

The intent also replaces the passkey guess: signup picks the register
ceremony, login picks the login ceremony. An unspecified intent keeps
today's create-or-get and today's guess, so existing clients and
deployments are unaffected.

Flow.Metadata is existing JSONB, so no migration. The accessors parse
rather than assert, since JSONB does not return the types it was given,
and are nil-receiver-safe so the caller without a flow needs no branch.

Error mapping at the handlers and all consent work follow separately.

Refs docs/rfcs/0002-explicit-consent-at-signup.md

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VW3nysiE4H83VQk6BroMYc

115 of 119 new or added lines in 3 files covered. (96.64%)

20112 of 40611 relevant lines covered (49.52%)

15.83 hits per line