feat: add social_accounts table and provider tracking with verified-email linking

app/Http/Controllers/Auth/SocialiteController.php

@@ -3,10 +3,10 @@
 namespace App\Http\Controllers\Auth;
 
 use App\Http\Controllers\Controller;
+use App\Models\SocialAccount;
 use App\Models\User;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Support\Facades\Auth;
-use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Str;
 use Laravel\Socialite\Facades\Socialite;
 
@@ -63,11 +63,40 @@ class SocialiteController extends Controller
             ]);
         }
 
-        // Find existing user by provider ID or email
+        // First, check if this provider account is already linked to a user
-        $user = User::where('email', $socialUser->getEmail())->first();
+        $socialAccount = SocialAccount::where('provider', $provider)
+            ->where('provider_id', $socialUser->getId())
+            ->first();
 
-        if (! $user) {
+        if ($socialAccount) {
-            // Create new user if registration is enabled
+            Auth::login($socialAccount->user, remember: true);
+            request()->session()->regenerate();
+
+            return redirect()->intended(config('auth-ui.redirects.login', '/'));
+        }
+
+        // Check if a user with this email already exists
+        $existingUser = User::where('email', $socialUser->getEmail())->first();
+
+        if ($existingUser) {
+            if (! $existingUser->hasVerifiedEmail()) {
+                return redirect()->route('login')->withErrors([
+                    'email' => 'An account with this email already exists. Please verify your email first, then link your social account.',
+                ]);
+            }
+
+            $existingUser->socialAccounts()->create([
+                'provider' => $provider,
+                'provider_id' => $socialUser->getId(),
+            ]);
+
+            Auth::login($existingUser, remember: true);
+            request()->session()->regenerate();
+
+            return redirect()->intended(config('auth-ui.redirects.login', '/'));
+        }
+
+        // New user — check if registration is enabled
         if (! config('auth-ui.features.registration')) {
             return redirect()->route('login')->withErrors([
                 'email' => 'Registration is disabled. Please contact an administrator.',
@@ -80,13 +109,13 @@ class SocialiteController extends Controller
 
         // Check if username is already taken
         if (User::whereRaw('LOWER(username) = ?', [strtolower($suggestedUsername)])->exists()) {
-                // Store social data in session and redirect to complete profile
             session()->put('socialite_user', [
                 'email' => $socialUser->getEmail(),
                 'first_name' => $nameParts[0],
                 'last_name' => $nameParts[1] ?? '',
                 'suggested_username' => $suggestedUsername,
                 'provider' => $provider,
+                'provider_id' => $socialUser->getId(),
             ]);
 
             return redirect()->route('auth.complete-profile');
@@ -97,10 +126,14 @@ class SocialiteController extends Controller
             'first_name' => $nameParts[0],
             'last_name' => $nameParts[1] ?? '',
             'email' => $socialUser->getEmail(),
-                'password' => Hash::make(Str::random(24)),
-                'email_verified_at' => now(),
         ]);
-        }
+
+        $user->forceFill(['email_verified_at' => now()])->save();
+
+        $user->socialAccounts()->create([
+            'provider' => $provider,
+            'provider_id' => $socialUser->getId(),
+        ]);
 
         Auth::login($user, remember: true);
         request()->session()->regenerate();

app/Models/SocialAccount.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class SocialAccount extends Model
+{
+    /**
+     * The attributes that are mass assignable.
+     *
+     * @var list<string>
+     */
+    protected $fillable = [
+        'user_id',
+        'provider',
+        'provider_id',
+    ];
+
+    /**
+     * Get the user that owns the social account.
+     */
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+}

database/migrations/2026_03_19_212955_create_social_accounts_table.php

@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('social_accounts', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
+            $table->string('provider');
+            $table->string('provider_id');
+            $table->timestamps();
+
+            $table->unique(['provider', 'provider_id']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('social_accounts');
+    }
+};