feat(14.1-01): unlink OAuth identities with 204 and last-method 409

- Destroy allow-lists providers and shares WriteNotFound for unknown, missing and foreign rows
- Last remaining identity is refused with a localized 409; password flags are unused
- EN and PL last_method_blocked strings match the PHP texts

controllers/oauth_identities.go

@@ -1,7 +1,9 @@
 package controllers
 
 import (
+	"errors"
 	"net/http"
+	"slices"
 
 	"git.golem15.com/golem15/sm-user-plugin/models"
 	"git.golem15.com/golem15/summercms/modules/backpack"
@@ -48,6 +50,77 @@ func OAuthIdentitiesIndex(app *backpack.App) http.HandlerFunc {
 	}
 }
 
+// OAuthIdentitiesDestroy unlinks one provider for the caller.
+func OAuthIdentitiesDestroy(app *backpack.App, opts OAuthIdentitiesOptions) http.HandlerFunc {
+	providers := opts.Providers
+	if len(providers) == 0 {
+		providers = []string{"google", "facebook", "github"}
+	}
+	return func(w http.ResponseWriter, r *http.Request) {
+		db, user, ok := oauthIdentityDeps(w, r, app)
+		if !ok {
+			return
+		}
+		provider := r.PathValue("provider")
+		if !slices.Contains(providers, provider) {
+			writeOAuthIdentityNotFound(w, r, opts)
+			return
+		}
+		var row models.OAuthIdentity
+		err := db.WithContext(r.Context()).
+			Where("user_id = ? AND provider = ?", user.ID, provider).
+			First(&row).Error
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			writeOAuthIdentityNotFound(w, r, opts)
+			return
+		}
+		if err != nil {
+			writeOpaque500(w)
+			return
+		}
+		var n int64
+		if err := db.WithContext(r.Context()).
+			Model(&models.OAuthIdentity{}).
+			Where("user_id = ?", user.ID).
+			Count(&n).Error; err != nil {
+			writeOpaque500(w)
+			return
+		}
+		if n == 1 {
+			writeJSON(w, http.StatusConflict, map[string]any{
+				"error": oauthLastMethodBlocked(r, app),
+			})
+			return
+		}
+		if err := db.WithContext(r.Context()).Delete(&row).Error; err != nil {
+			writeOpaque500(w)
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}
+}
+
+func writeOAuthIdentityNotFound(w http.ResponseWriter, r *http.Request, opts OAuthIdentitiesOptions) {
+	if opts.WriteNotFound != nil {
+		opts.WriteNotFound(w, r)
+		return
+	}
+	writeOpaque500(w)
+}
+
+func oauthLastMethodBlocked(r *http.Request, app *backpack.App) string {
+	const fallback = "This is the only remaining way to sign in. Link another method before disconnecting this one."
+	tr := appTranslator(app)
+	if tr == nil {
+		return fallback
+	}
+	s := tr.Get(r.Context(), "golem15.user::lang.oauth.last_method_blocked", nil)
+	if s == "" || s == "golem15.user::lang.oauth.last_method_blocked" {
+		return fallback
+	}
+	return s
+}
+
 func oauthIdentityDeps(w http.ResponseWriter, r *http.Request, app *backpack.App) (*gorm.DB, *bouncer.Principal, bool) {
 	if app == nil {
 		writeOpaque500(w)