---
phase: 08-social-sign-in
plan: 05
type: execute
wave: 5
depends_on:
  - 08-01
  - 08-02
  - 08-03
  - 08-04
files_modified:
  - backend/templates/account_providers.templ
  - backend/templates/*_templ.go
  - backend/internal/web/handlers_account.go
  - backend/internal/web/handlers_account_test.go
  - backend/internal/web/router.go
  - backend/.env.example
  - backend/README.md
autonomous: true
requirements_addressed: [AUTH-08, AUTH-09, AUTH-10, AUTH-11, AUTH-12, AUTH-13]
requirements:
  - AUTH-08
  - AUTH-09
  - AUTH-10
  - AUTH-11
  - AUTH-12
  - AUTH-13

must_haves:
  truths:
    - "D-04: Phase 8 includes a simple linked providers account view showing Google/Apple connection status; unlinking is deferred."
    - "D-09: Google and Apple buttons remain on both login and signup pages."
    - "D-10: Missing provider config remains visible as disabled buttons in local/dev."
    - "D-11: Google and Apple remain equal prominence."
    - "D-12: Successful provider sign-in redirects to `/`."
    - "D-13: Linked providers view can show stored provider email/profile metadata without exposing tokens."
    - "AUTH-08: Google start route is visible from auth UI."
    - "AUTH-09: Google callback creates/links users and issues local session."
    - "AUTH-10: Apple start route is visible from auth UI."
    - "AUTH-11: Apple callback creates/links users and issues local session."
    - "AUTH-12: Social sign-in uses Xtablo server-managed session cookies."
    - "AUTH-13: Existing auth regression suite remains green."
  artifacts:
    - path: "backend/templates/account_providers.templ"
      provides: "minimal linked providers status view"
    - path: "backend/.env.example"
      provides: "Google and Apple provider config placeholders"
    - path: "backend/README.md"
      provides: "operator setup notes for provider config"
---

## Phase Goal

Finish the user-visible account status view, operator docs, and full regression coverage for Phase 8.

<objective>
Complete Phase 8 hardening:

1. Add a protected linked-provider status view with Google and Apple rows.
2. Document required Google and Apple env vars without committing secrets.
3. Run full auth regression coverage across email/password, Google, Apple, sessions, CSRF, and rate limiting.
4. Confirm every Phase 8 requirement AUTH-08 through AUTH-13 is verifiable.
</objective>

<execution_context>
@/Users/arthur.belleville/Documents/perso/projects/xtablo-source/.codex/get-shit-done/workflows/execute-plan.md
</execution_context>

<context>
@/Users/arthur.belleville/Documents/perso/projects/xtablo-source/.planning/phases/08-social-sign-in/08-CONTEXT.md
@/Users/arthur.belleville/Documents/perso/projects/xtablo-source/.planning/phases/08-social-sign-in/08-RESEARCH.md
@/Users/arthur.belleville/Documents/perso/projects/xtablo-source/.planning/phases/08-social-sign-in/08-UI-SPEC.md
@/Users/arthur.belleville/Documents/perso/projects/xtablo-source/.planning/phases/08-social-sign-in/08-PATTERNS.md
</context>

<tasks>

<task type="auto">
  <name>Task 1: Add protected linked providers status view</name>
  <files>
    backend/templates/account_providers.templ
    backend/templates/*_templ.go
    backend/internal/web/handlers_account.go
    backend/internal/web/handlers_account_test.go
    backend/internal/web/router.go
  </files>
  <read_first>
    - backend/internal/web/router.go
    - backend/internal/auth/middleware.go
    - backend/templates/layout.templ
    - backend/templates/tablos_list.templ
    - backend/internal/db/queries/user_identities.sql
    - .planning/phases/08-social-sign-in/08-UI-SPEC.md
  </read_first>
  <action>
    Add a protected route, preferably `GET /account/providers`, inside the `auth.RequireAuth` group. Query linked identities for the current user and render `Linked providers` with one Google row and one Apple row. Each row shows `Connected` plus stored provider email when present, otherwise `Not connected`. Do not add unlink buttons or add-password UI. Regenerate templ output.

    Keep layout minimal: single column on mobile, bordered rows or subtle row surfaces, no nested cards, no marketing copy, no token/provider diagnostic details.
  </action>
  <verify>
    <automated>cd /Users/arthur.belleville/Documents/perso/projects/xtablo-source/backend && go test ./internal/web -run 'Test.*LinkedProviders' -count=1</automated>
  </verify>
  <acceptance_criteria>
    - Unauthenticated request to `/account/providers` redirects to `/login` or returns the existing auth-required HTMX redirect.
    - Authenticated user with Google identity sees `Linked providers`, `Google`, `Connected`, and that identity email.
    - Authenticated user without Apple identity sees `Apple` and `Not connected`.
    - Rendered HTML contains no unlink button and no add-password copy.
  </acceptance_criteria>
  <done>
    Linked provider status view satisfies D-04 and the UI-SPEC.
  </done>
</task>

<task type="auto">
  <name>Task 2: Add provider env docs and run full Phase 8 regression</name>
  <files>
    backend/.env.example
    backend/README.md
    backend/internal/web/handlers_social_test.go
    backend/internal/web/handlers_auth_test.go
  </files>
  <read_first>
    - backend/.env.example
    - backend/README.md
    - .planning/phases/08-social-sign-in/08-RESEARCH.md
    - backend/internal/web/handlers_social_test.go
    - backend/internal/web/handlers_auth_test.go
  </read_first>
  <action>
    Add placeholder-only env documentation for `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, `GOOGLE_REDIRECT_URL`, `APPLE_CLIENT_ID`, `APPLE_TEAM_ID`, `APPLE_KEY_ID`, `APPLE_PRIVATE_KEY`, and `APPLE_REDIRECT_URL`. Do not include real secrets. README should state that missing provider config keeps buttons visible but disabled in local/dev.

    Run and fix failures in full auth-related regression. Required behavior: Google and Apple start routes work when configured; callbacks reject invalid state/nonce/unverified email; callbacks create/link users and issue Xtablo sessions; existing signup/login/logout/CSRF/rate-limit tests pass.
  </action>
  <verify>
    <automated>cd /Users/arthur.belleville/Documents/perso/projects/xtablo-source/backend && go test ./... -count=1</automated>
  </verify>
  <acceptance_criteria>
    - `backend/.env.example` contains all Google and Apple env var names with placeholder values only.
    - `backend/README.md` documents missing-config disabled provider buttons.
    - `go test ./... -count=1` exits 0.
    - Test names or assertions cover AUTH-08, AUTH-09, AUTH-10, AUTH-11, AUTH-12, and AUTH-13.
  </acceptance_criteria>
  <done>
    Phase 8 is documented and the full backend test suite passes.
  </done>
</task>

</tasks>

<threat_model>
| Threat ID | Severity | Component | Mitigation |
|-----------|----------|-----------|------------|
| T-08-17 | low | Linked providers view | Protected by `auth.RequireAuth`; only current user's identities are queried |
| T-08-18 | medium | Env docs | `.env.example` and README use placeholders only, no committed secrets |
| T-08-19 | medium | Regression drift | Full `go test ./...` must pass after Google, Apple, nullable-password, UI, and account-view changes |
</threat_model>

<verification>
Run:

```
cd /Users/arthur.belleville/Documents/perso/projects/xtablo-source/backend && go test ./... -count=1
```
</verification>

<success_criteria>
1. Protected linked-provider view shows Google/Apple connection status and provider email when connected.
2. Provider env vars are documented with placeholders only.
3. Full backend suite passes.
4. AUTH-08 through AUTH-13 are all covered by final regression evidence.
</success_criteria>

