---
phase: 8
slug: social-sign-in
status: verified
nyquist_compliant: true
wave_0_complete: true
created: 2026-05-15
updated: 2026-05-15
---

# Phase 8 — Validation Strategy

> Per-phase validation contract for feedback sampling during execution.

---

## Test Infrastructure

| Property | Value |
|----------|-------|
| **Framework** | Go test |
| **Config file** | `backend/go.mod`, `backend/sqlc.yaml` |
| **Quick run command** | `cd backend && go test ./internal/auth ./internal/web -count=1` |
| **Full suite command** | `cd backend && go test ./... -count=1` |
| **Estimated runtime** | ~30-90 seconds |

---

## Sampling Rate

- **After every task commit:** Run `cd backend && go test ./internal/auth ./internal/web -count=1`
- **After every plan wave:** Run `cd backend && go test ./... -count=1`
- **Before `$gsd-verify-work`:** Full suite must be green
- **Max feedback latency:** 90 seconds

---

## Per-Requirement Verification Map

| Requirement | Secure Behavior | Test Type | Automated Command | File Exists | Status |
|-------------|-----------------|-----------|-------------------|-------------|--------|
| AUTH-08 | Google start route exists, provider controls render correctly, and missing config does not leak secrets | handler/unit | `cd backend && go test ./internal/web -count=1` | ✅ `handlers_social_test.go`, `handlers_auth_test.go` | ✅ green |
| AUTH-09 | Google callback validates state and verified ID token before local link/session | integration | `cd backend && go test ./internal/web -count=1` | ✅ `handlers_social_test.go` | ✅ green |
| AUTH-10 | Apple sign-in is hidden from login/signup while disabled | handler/unit | `cd backend && go test ./internal/web -count=1` | ✅ `handlers_auth_test.go` | ✅ green |
| AUTH-11 | Direct Apple sign-in routes are unavailable while disabled | handler/unit | `cd backend && go test ./internal/web -count=1` | ✅ `handlers_social_test.go` | ✅ green |
| AUTH-12 | Provider callback creates existing Xtablo session cookie, not provider-token session | integration | `cd backend && go test ./internal/web -count=1` | ✅ `handlers_social_test.go` | ✅ green |
| AUTH-13 | Email/password signup/login/logout/CSRF/rate-limit tests continue passing | regression | `cd backend && go test ./internal/auth ./internal/web -count=1` | ✅ auth + web test suites | ✅ green |

*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*

---

## Wave 0 Requirements

- [x] `backend/migrations/0006_social_identities.sql` — nullable `users.password_hash` plus `user_identities`
- [x] `backend/internal/db/queries/user_identities.sql` — identity lookup/link/update queries
- [x] `backend/internal/web/handlers_social_test.go` — Google start/callback tests plus Apple-disabled route guard
- [x] `backend/internal/auth/oauth_test.go` — config, cookie, nonce, verifier, and provider helper coverage

---

## Manual-Only Verifications

No manual-only validation gaps remain for Phase 8. Live Google provider dashboard configuration is covered by UAT rather than Nyquist unit coverage.

---

## Validation Audit 2026-05-15

| Metric | Count |
|--------|-------|
| Requirements audited | 6 |
| Gaps found | 0 |
| Resolved | 0 |
| Escalated | 0 |

Commands run:

- `cd backend && go test ./internal/web -run 'TestGoogleStart|TestSignupProviderButtons|TestLoginProviderButtons' -count=1`
- `cd backend && go test ./internal/web -run 'TestGoogleCallback' -count=1`
- `cd backend && go test ./internal/web -run 'TestAppleRoutesAreDisabled|TestSignupProviderButtons|TestLoginProviderButtons' -count=1`
- `cd backend && go test ./internal/auth ./internal/web -count=1`

---

## Validation Sign-Off

- [x] All tasks have `<automated>` verify or Wave 0 dependencies
- [x] Sampling continuity: no 3 consecutive tasks without automated verify
- [x] Wave 0 covers all MISSING references
- [x] No watch-mode flags
- [x] Feedback latency < 90s
- [x] `nyquist_compliant: true` set in frontmatter

**Approval:** verified 2026-05-15
