Complete Google and GitHub public signup

[callumalpass]

Summary

Make Google and GitHub first-class public signup options, rather than exposing the existing login callbacks as an incomplete account-creation path.

• Reuse provider buttons on /signup. Existing identities still sign in directly; new identities from either /signup or /login must finish account setup by confirming their name and accepting current legal documents. No password is required.
• Persist a ten-minute verified-identity proof, not an account/session, after provider authentication. Carry its random token in an HTTP-only/Secure/same-site cookie; persist only its digest. Bind confirmation to the previewed proof to reject cross-tab identity replacement.
• Atomically consume the proof, claim the verified email, create account/email/session, record legal acceptance, grant open_beta_v1, and schedule welcome email/starter collection. Extract one onboarding implementation shared with password signup.
• Request GitHub user:email (no repository scopes) and require a verified primary email, including private addresses. Keep account-linking/deletion reauthentication identity-only. Do not persist provider tokens.
• Recheck registration/legal policy under a transaction lock, enforce configured-provider and shared-limiter prerequisites, preserve safe return destinations, and never infer account linking from email text.
• Serialize independent proofs of the same provider subject, and reject reopening an existing account through a disconnected subject. Handle GitHub cancellation with a recoverable sign-in page.

Migration and rollout

Additive migration: 0029_external_signup.sql. Server and bundled portal must ship together through the normal release process. Under an already-open policy, this flow becomes available when the existing provider, legal-document, and authentication-limiter dependencies are configured. Password/email-delivery kill switches do not disable provider-verified signup; registration closure does.

Existing external accounts are not retroactively granted public-signup allowances. Allowlisted bootstrap creation in closed/invite mode remains unchanged. Old server versions ignore the new table, but a server rollback also restores the previous external account-creation behavior.

No production configuration or deployment was changed. Actual public Google/GitHub account smoke tests and staging/release qualification remain required before production promotion; browser tests here use mocked provider responses.

Validation

Passed locally with Node 24.19.0 and the checked-in mdbase-rs revision:

• cargo fmt --all
• cargo test --workspace
• pnpm test
• pnpm typecheck
• pnpm check:architecture
• pnpm test:accessibility — mobile signup choices, consent gating, provider/email UI separation, stable Google nonce while typing, and preserved authorization return target
• pnpm e2e
• Dedicated disposable PostgreSQL 17 suite: single-proof replay, concurrent independent proofs, cross-provider email claims, full transaction rollback/retry, and disconnected-subject denial

Route coverage additionally includes both providers, absent/unverified email, stale legal versions, expiry, origin rejection, missing dependencies, registration closure, provider deconfiguration, cross-tab proof mismatch, duplicate-account denial, cancellation/replay, safe redirects, and independent preview/redemption rate budgets.

Architecture review

The budget change is explicit and documented: two production server modules, fourteen relative imports, and five TypeScript exports. external-signup.ts owns the new proof/transaction boundary; public-account-onboarding.ts replaces the password-only onboarding sequence with one shared implementation. File-size and cycle checks are unchanged.