Disable sign-in using connected accounts by default

[JeanMeijer]

What would you like to see?

If a user connects another external account (i.e. Google, or Microsoft) to their account on Analog the connected account can be used to sign into Analog.

We want to disable this behaviour by default, and allow users to pick which accounts are allowed to be used for sign in.

• However, make sure there is always at least one account with sign in capabilities enabled. So automatically designate the account used to sign up as such, and implement the relevant checks.

• Update the procedures in the accounts router to return whether or not sign in is enabled.

• Add two new procedures to the account router: enableSignIn, and disableSignIn.

• Restrict the accounts that can be used for sign in to the following providers: google, microsoft. We are adding support for other providers in the future that should not be used for signing in.

This task is solely about the backend implementation, involves using tRPC, Better-Auth, and DrizzleORM.

Why is this feature useful?

No response

Have you considered any alternatives?

No response

Additional context or visuals

No response

[j4redux]

Will look into this by tonight and let you know if i have questions

[fozagtx]

Will plan what I can do about this tonight , immediately

[JeanMeijer]

@j4redux @4ozan Did you have any success with this issue?

[j4redux]

didn’t get a chance yet, was busier than expected this week! @JeanMeijer

anyone, feel free to pick this up

[j4redux]

@JeanMeijer how tied are we to better auth? been looking at #112

it seems better auth creates sessions for users, but not for specific oauth accounts. when someone signs in, the library knows who they are but not which linked account they used. the session hooks can't validate the specific account because that information never arrives.

essentially, the architecture makes account-specific sign-in control impossible. you can check if any account has permission, but not if the account they're using has permission.

i think proper implementation requires switching auth libraries or building custom oauth flows. open to suggestions

[fozagtx]

I also run into the same issue while trying to implement it

[JeanMeijer]

I would have to see whether Zero Email found a solution for this. Otherwise I'll ask Beka from Better-Auth.

[omraval18]

@4ozan can you elaborate the issue didn't get what the issue is ??

[mohammadanas51]

Hi everyone, I came across this issue and found the discussion very insightful.
I’d love to contribute once the Better-Auth limitation is resolved or a direction is confirmed.
Please feel free to tag me when the issue is ready for implementation.