bug(experience): social sign-up offers to link an identifier that cannot sign in, ending in session.identifier_not_found

[DiegoPQ95]

Describe the bug

During social sign-up, when a required secondary identifier (e.g. phone) is already used by another account, the experience shows the "link and continue" modal even if that identifier cannot be used to sign in with a verification code. Clicking Bind and continue (or pressing Enter / Space while the modal is focused) calls signInAndLinkWithSocial, the server rejects the identification with user.sign_in_method_not_enabled, and a following attempt ends in session.identifier_not_found. The user is left on the verification code page with a 3-second toast and no way forward.

Expected behavior

Linking should only be offered when the identifier can sign in with a verification code, exactly like the email/phone sign-up branch of the same handler already does (isVerificationCodeEnabledForSignIn(type)). Otherwise the user should get the regular "identifier already exists" alert and go back to change it.

How to reproduce?

Logto OSS 1.42.0 (also present on master):

1. Sign-in experience:
   • signUp: identifiers: ["email"], password: true, verify: true, secondaryIdentifiers: [{ "identifier": "phone", "verify": true }]
   • signIn.methods: email only (password + verification code)
   • mfa.factors includes PhoneVerificationCode — which makes phone verification code sign-in impossible to enable (sign_in_experiences.phone_verification_code_cannot_be_used_for_mfa)
   • one social connector enabled
2. Sign in with a new social identity (not registered yet).
3. When asked for the phone number, enter one that already belongs to another user, and submit the verification code.
4. The "The account with Phone number … already exists. Do you want to link?" modal is shown.
5. Click Bind and continue.

Requests observed:

POST /api/experience/profile           422 user.phone_already_in_use
POST /api/experience/identification    422 user.sign_in_method_not_enabled
POST /api/experience/profile           404 session.identifier_not_found

Root cause

packages/experience/src/containers/VerificationCode/use-continue-flow-code-verification.ts, identifierExistsErrorHandler: the link_social branch returns before the isVerificationCodeEnabledForSignIn(type) check that guards the other branch. Linking identifies the user with the verification code record, which guardSignInVerificationMethod (packages/core/src/routes/experience/classes/libraries/sign-in-experience-validator.ts) rejects when that sign-in method is disabled.

Context

• Logto OSS
• Logto Cloud

Screenshots

N/A (flow described above). A fix with unit tests is ready and will be linked here.

[DiegoPQ95]

Fix with unit tests: #9593