docs(features): align password auth and google connect-later docs

[cursor]

Summary

• update docs/features/password-auth-flow.md to match current auth runtime behavior
• update docs/features/google-sync-and-websocket-flow.md with a concrete connect-later backfill flow

Docs added/updated

• Updated: docs/features/password-auth-flow.md
  • removed stale verify-email modal/link rewrite guidance
  • corrected account-linking semantics to in-session-only auto-linking
  • clarified reset-password link rewrite behavior and caveats
• Updated: docs/features/google-sync-and-websocket-flow.md
  • added explicit "Connect Google Later" sequence
  • documented backfill constraints for syncCompassEventsToGoogle() and recurring-instance provider-data updates

Codepaths covered

• Web auth/modal/session:
  • packages/web/src/components/AuthModal/hooks/useAuthFormHandlers.ts
  • packages/web/src/components/AuthModal/hooks/useAuthUrlParam.ts
  • packages/web/src/auth/session/SessionProvider.tsx
  • packages/web/src/auth/hooks/oauth/useConnectGoogle.ts
• Backend auth + sync:
  • packages/backend/src/common/middleware/supertokens.middleware.ts
  • packages/backend/src/common/middleware/supertokens.middleware.util.ts
  • packages/backend/src/auth/services/google/google.auth.service.ts
  • packages/backend/src/event/services/event.service.ts (syncCompassEventsToGoogle)
  • packages/backend/src/sync/services/sync/compass/compass.sync.processor.ts

Key knowledge gaps addressed

• clarified that ?auth=verify is not a first-class modal flow in current auth UI
• removed outdated claim that backend rewrites email-verification links
• documented the current in-session linking contract and why logged-out identities are not auto-merged
• made connect-later Google backfill behavior and constraints explicit for operators and maintainers

  

---

Note

Low Risk
Low risk: documentation-only changes that align described auth/linking behavior with current runtime semantics; no production code changes.

Overview
Updates the auth/sync docs to match current behavior: account linking is only allowed automatically when a user already has an active session, and logged-out same-email Google/password flows do not auto-merge identities.

Adds a concrete “Connect Google Later” sequence describing in-session Google linking plus the subsequent syncCompassEventsToGoogle() backfill (including constraints and recurring-event provider-id updates), and removes/clarifies stale guidance around ?auth=verify and email-verification link rewriting while tightening reset-link rewrite notes and caveats.

^{Written by Cursor Bugbot for commit c361d63. This will update automatically on new commits. Configure here.}