Merge OAuth init endpoints and change to POST

Author: hhvrc

API/Controller/Account/Authenticated/OAuthConnectionAdd.cs

@@ -10,29 +10,36 @@ namespace OpenShock.API.Controller.OAuth;
 public sealed partial class OAuthController
 {
     /// <summary>
-    /// Start OAuth authorization for a given provider (login-or-create flow).
+    /// Start OAuth authorization for a given provider with the specified flow.
     /// </summary>
     /// <remarks>
-    /// Initiates an OAuth challenge in "login-or-create" mode.  
     /// Returns <c>302</c> redirect to the provider authorization page.
     /// </remarks>
     /// <param name="provider">Provider key (e.g. <c>discord</c>).</param>
+    /// <param name="flow">Flow to run</param>
     /// <response code="302">Redirect to the provider authorization page.</response>
     /// <response code="400">Unsupported or misconfigured provider.</response>
     [EnableRateLimiting("auth")]
-    [HttpGet("{provider}/authorize")]
+    [HttpPost("{provider}/authorize")]
     [ProducesResponseType(StatusCodes.Status302Found)]
     [ProducesResponseType<OpenShockProblem>(StatusCodes.Status400BadRequest, MediaTypeNames.Application.Json)]
-    public async Task<IActionResult> OAuthAuthorize([FromRoute] string provider)
+    public async Task<IActionResult> OAuthAuthorize([FromRoute] string provider, [FromQuery] OAuthFlow flow)
     {
         if (!await _schemeProvider.IsSupportedOAuthScheme(provider))
             return Problem(OAuthError.UnsupportedProvider);
 
-        if (User.HasOpenShockUserIdentity())
+        switch (flow)
         {
-            return Problem(OAuthError.AnonymousOnlyEndpoint);
+            case OAuthFlow.LoginOrCreate:
+                if (User.HasOpenShockUserIdentity()) return Problem(OAuthError.FlowRequiresAnonymous);
+                break;
+            case OAuthFlow.Link:
+                if (!User.HasOpenShockUserIdentity()) return Problem(OAuthError.FlowRequiresAuthenticatedUser);
+                break;
+            default:
+                return Problem(OAuthError.UnsupportedFlow);
         }
 
-        return OAuthUtil.StartOAuth(provider, OAuthFlow.LoginOrCreate);
+        return OAuthUtil.StartOAuth(provider, flow);
     }
 }

API/Controller/OAuth/Authorize.cs

@@ -61,7 +61,7 @@ public async Task<IActionResult> OAuthSignupFinalize(
 
         if (User.HasOpenShockUserIdentity())
         {
-            return Problem(OAuthError.AnonymousOnlyEndpoint);
+            return Problem(OAuthError.FlowRequiresAnonymous);
         }
 
         // 1) Defense-in-depth: ensure the flow’s provider matches the route

API/Controller/OAuth/SignupFinalize.cs

@@ -32,7 +32,7 @@ public async Task<IActionResult> OAuthSignupGetData([FromRoute] string provider)
     {
         if (User.HasOpenShockUserIdentity())
         {
-            return Problem(OAuthError.AnonymousOnlyEndpoint);
+            return Problem(OAuthError.FlowRequiresAnonymous);
         }
 
         var result = await ValidateOAuthFlowAsync();

API/Controller/OAuth/SignupGetData.cs

@@ -27,10 +27,15 @@ public static class OAuthError
         "This OAuth flow differs from the flow the oauth flow started with",
         HttpStatusCode.Forbidden);
 
-    public static OpenShockProblem AnonymousOnlyEndpoint => new(
-        "OAuth.Flow.AnonymousOnlyEndpoint",
+    public static OpenShockProblem FlowRequiresAnonymous => new(
+        "OAuth.Flow.AnonymousOnly",
         "You must be signed out to call this endpoint",
-        HttpStatusCode.Unauthorized);
+        HttpStatusCode.BadRequest);
+
+    public static OpenShockProblem FlowRequiresAuthenticatedUser => new(
+        "OAuth.Link.AuthenticatedUserOnly",
+        "You must be signed in to link an external account",
+        HttpStatusCode.BadRequest);
 
     public static OpenShockProblem FlowNotFound => new(
         "OAuth.Flow.NotFound",
@@ -53,11 +58,6 @@ public static class OAuthError
         "This external account is already linked to another user",
         HttpStatusCode.Conflict);
 
-    public static OpenShockProblem NotAuthenticatedForLink => new(
-        "OAuth.Link.NotAuthenticated",
-        "You must be signed in to link an external account",
-        HttpStatusCode.Unauthorized);
-
     // Misc / generic
     public static OpenShockProblem InternalError => new(
         "OAuth.InternalError",