Add account linking configs

pkg/lib/config/authentication_flow.go

@@ -41,7 +41,8 @@ var _ = Schema.Add("AuthenticationFlowConfig", `
 			"minItems": 1,
 			"items": { "$ref": "#/$defs/AuthenticationFlowAccountRecoveryFlow" }
 		},
-		"rate_limits": { "$ref": "#/$defs/AuthenticationFlowRateLimitsConfig" }
+		"rate_limits": { "$ref": "#/$defs/AuthenticationFlowRateLimitsConfig" },
+		"default_account_linking": { "$ref": "#/$defs/AuthenticationFlowAccountLinking" }
 	}
 }
 `)
@@ -72,6 +73,7 @@ var _ = Schema.Add("AuthenticationFlowSignupFlow", `
 	"required": ["name", "steps"],
 	"properties": {
 		"name": { "$ref": "#/$defs/AuthenticationFlowObjectName" },
+		"account_linking": { "$ref": "#/$defs/AuthenticationFlowAccountLinking" },
 		"steps": {
 			"type": "array",
 			"minItems": 1,
@@ -624,6 +626,56 @@ var _ = Schema.Add("AuthenticationFlowAccountRecoveryIdentification", `
 }
 `)
 
+var _ = Schema.Add("AuthenticationFlowAccountLinking", `
+{
+	"type": "object",
+	"required": [],
+	"properties": {
+		"oauth": {
+			"type": "array",
+			"items": { "$ref": "#/$defs/AccountLinkingOAuth" }
+		}
+	}
+}
+`)
+
+var _ = Schema.Add("AccountLinkingOAuth", `
+{
+	"type": "object",
+	"required": ["alias", "oauth_claim", "user_profile", "action"],
+	"properties": {
+		"alias": { "type": "string" },
+		"oauth_claim": { "$ref": "#/$defs/AccountLinkingJSONPointer" },
+		"user_profile": { "$ref": "#/$defs/AccountLinkingJSONPointer" },
+		"action": { "$ref": "#/$defs/AccountLinkingOAuthAction" },
+		"login_flow": { "type": "string" }
+	}
+}
+`)
+
+var _ = Schema.Add("AccountLinkingOAuthAction", `
+{
+	"type": "string",
+	"enum": [
+		"error",
+		"login_and_link"
+	]
+}
+`)
+
+var _ = Schema.Add("AccountLinkingJSONPointer", `
+{
+	"type": "object",
+	"additionalProperties": false,
+	"properties": {
+		"pointer": {
+			"type": "string",
+			"format": "json-pointer"
+		}
+	}
+}
+`)
+
 type AuthenticationFlowObject interface {
 	IsFlowObject()
 }
@@ -798,12 +850,14 @@ type AuthenticationFlowConfig struct {
 	ReauthFlows          []*AuthenticationFlowReauthFlow          `json:"reauth_flows,omitempty"`
 	AccountRecoveryFlows []*AuthenticationFlowAccountRecoveryFlow `json:"account_recovery_flows,omitempty"`
 
-	RateLimits *AuthenticationFlowRateLimitsConfig `json:"rate_limits,omitempty"`
+	RateLimits            *AuthenticationFlowRateLimitsConfig `json:"rate_limits,omitempty"`
+	DefaultAccountLinking *AuthenticationFlowAccountLinking   `json:"default_account_linking,omitempty"`
 }
 
 type AuthenticationFlowSignupFlow struct {
-	Name  string                              `json:"name,omitempty"`
-	Steps []*AuthenticationFlowSignupFlowStep `json:"steps,omitempty"`
+	Name           string                              `json:"name,omitempty"`
+	AccountLinking *AuthenticationFlowAccountLinking   `json:"account_linking,omitempty"`
+	Steps          []*AuthenticationFlowSignupFlowStep `json:"steps,omitempty"`
 }
 
 var _ AuthenticationFlowObjectFlowRoot = &AuthenticationFlowSignupFlow{}
@@ -1332,6 +1386,32 @@ const (
 	AuthenticationFlowAccountRecoveryIdentificationOnFailureIgnore = AuthenticationFlowAccountRecoveryIdentificationOnFailure("ignore")
 )
 
+type AuthenticationFlowAccountLinking struct {
+	OAuth []*AccountLinkingOAuth `json:"oauth,omitempty"`
+}
+
+type AccountLinkingOAuth struct {
+	Alias       string                    `json:"alias,omitempty"`
+	OAuthClaim  AccountLinkingJSONPointer `json:"oauth_claim,omitempty"`
+	UserProfile AccountLinkingJSONPointer `json:"user_profile,omitempty"`
+	Action      AccountLinkingOAuthAction `json:"action,omitempty"`
+
+	// login_flow is only relevant if action is "login_and_link"
+	// If empty, the current flow name should be used
+	LoginFlow string `json:"login_flow,omitempty"`
+}
+
+type AccountLinkingOAuthAction string
+
+const (
+	AccountLinkingOAuthActionError        AccountLinkingOAuthAction = "error"
+	AccountLinkingOAuthActionLoginAndLink AccountLinkingOAuthAction = "login_andLink"
+)
+
+type AccountLinkingJSONPointer struct {
+	Pointer string `json:"pointer,omitempty"`
+}
+
 func init() {
 	accountRecoveryChannelsOneOf := ""
 	addAccountRecoveryChannel := func(channel AccountRecoveryCodeChannel, otpForm AccountRecoveryCodeForm) {

pkg/lib/config/testdata/default_config.yaml

@@ -638,6 +638,7 @@ test_mode:
   email:
     enabled: false
 authentication_flow:
+  default_account_linking: {}
   rate_limits:
     per_ip:
       enabled: true