---
phase: 08-social-sign-in
plan: 01
subsystem: auth-database
tags: [postgres, sqlc, nullable-passwords, social-identities]
requires:
  - phase: 02-authentication
    provides: local users, password auth, and database-backed sessions
provides:
  - nullable password hashes for social-only users
  - user_identities schema and sqlc query contracts
  - social-only login/signup regression handling
affects: [auth, google-sign-in, apple-sign-in, account-providers]
tech-stack:
  added: []
  patterns: [provider-subject identity table, nullable password_hash handling]
key-files:
  created:
    - backend/migrations/0006_social_identities.sql
    - backend/internal/db/queries/user_identities.sql
    - backend/internal/web/social_identity_migration_test.go
    - backend/internal/web/social_identity_schema_test.go
  modified:
    - backend/internal/db/queries/users.sql
    - backend/internal/auth/types.go
    - backend/internal/web/handlers_auth.go
    - backend/internal/web/handlers_auth_test.go
key-decisions:
  - "Social-only users use NULL password_hash; password login treats NULL as generic invalid credentials."
  - "Provider identity is keyed by unique (provider, provider_subject)."
patterns-established:
  - "Provider metadata lives in user_identities; local users and sessions remain authoritative."
requirements-completed: [AUTH-09, AUTH-11, AUTH-12, AUTH-13]
duration: 25min
completed: 2026-05-15
---

# Phase 8 Plan 01: Social Identity Schema Summary

**Postgres user identity foundation with nullable passwords, provider-subject uniqueness, and social-only auth safeguards**

## Performance

- **Duration:** ~25 min
- **Started:** 2026-05-15T18:51:00Z
- **Completed:** 2026-05-15T19:16:00Z
- **Tasks:** 2
- **Files modified:** 8

## Accomplishments

- Added `user_identities` with provider subject uniqueness and provider metadata.
- Made `users.password_hash` nullable and regenerated sqlc locally.
- Updated signup/login behavior for social-only users.
- Added schema and auth regression tests.

## Task Commits

1. **Schema and nullable auth foundation** - `2d004cd` (`feat(08-01)`)

## Deviations from Plan

Combined the two Plan 01 tasks into one production commit because sqlc nullable type changes require auth compile fixes in the same buildable state.

**Total deviations:** 1 process deviation. **Impact:** No scope change; kept the repository buildable.

## Issues Encountered

Integration tests that require Postgres skip locally without `TEST_DATABASE_URL`; fast migration contract tests cover local verification.

## User Setup Required

None.

## Next Phase Readiness

Ready for Google and Apple callback flows to call the shared local account-linking path.

