# Phase 14.1: OAuth identities and fonoteka me routes - Discussion Log

> **Audit trail only.** Do not use as input to planning, research, or execution agents.
> Decisions are captured in CONTEXT.md. This log preserves the alternatives considered.

**Date:** 2026-10-04
**Phase:** 14.1-oauth-identities-and-fonoteka-me-routes
**Areas discussed:** where the identity table lives, token columns and import, parity case coverage, social-login-only users at cutover

The scout found two things before the discussion:

- `GET /api/v1/fonoteka/me` is already served in Go. Its only gap is that `collection_ids` is `[]` where PHP returns `null` for an unrestricted token. This is decided by the PHP contract and was not asked.
- Go has no model or migration for `golem15_user_oauth_identities`.

---

## Where the identity table lives

| Option | Description | Selected |
|--------|-------------|----------|
| sm-user-plugin | Mirrors PHP, where Golem15.User owns the table; additive change | ✓ |
| fonoteka plugin | Leaves the shared plugin untouched, but the table sits in the wrong plugin | |

The user asked what the handlers are for. They back Settings → Connected accounts in the Nuxt app, which lists linked Google, Facebook and GitHub logins and lets the user disconnect them. Unlinking the last one returns 409.

| Option | Description | Selected |
|--------|-------------|----------|
| fonoteka plugin | Same as PHP | |
| user plugin API | Reusable handlers that fonoteka mounts at its prefix | ✓ |

| Option | Description | Selected |
|--------|-------------|----------|
| User plugin lang, same text | New key in the user plugin with identical EN/PL text | ✓ |
| Host passes the message | The mount supplies the message key | |

| Option | Description | Selected |
|--------|-------------|----------|
| Mount option, default the three | google/facebook/github by default; the host can narrow or extend | ✓ |
| Hard-coded three | Matches PHP exactly | |

## Token columns and import

| Option | Description | Selected |
|--------|-------------|----------|
| Full PHP column set | Encrypted tokens, jsonb profile_data, both unique indexes | ✓ |
| Full columns, tokens nulled at import | Drop the stored provider tokens at import | |
| Only what list/unlink need | Minimal columns | |

| Option | Description | Selected |
|--------|-------------|----------|
| No, Phase 15 writes the import mapper | HasWinterImport does not exist yet | ✓ |
| Yes, note the transforms now | Docs only | |

## Parity case coverage

Identity cases to record (multi-select): list with linked rows ✓, unlink 204 and last-method 409 ✗, foreign vs missing 404 ✗, unknown provider and 401 ✗.

| Option | Description | Selected |
|--------|-------------|----------|
| Add unrestricted-token case (/me) | `collection_ids: null` case | ✓ |
| Also scope variants | Read-only and revoked tokens | |

| Option | Description | Selected |
|--------|-------------|----------|
| Go tests ported from the PHP tests | Covers the unselected behaviours in the final unit-test plan | ✓ |
| Keep only what's recorded | | |

## Social-login-only users at cutover

| Option | Description | Selected |
|--------|-------------|----------|
| Flag for the Phase 15 preflight | Count OAuth-only users in the dump; give them a password first, or schedule a social login phase | ✓ |
| Accept, nobody uses it | | |
| Pull social login into scope | Big scope jump | |

## Claude's Discretion

- The shape of the exported sm-user-plugin API and how fonoteka mounts it
- Where the throttle for `throttle:10,1` is declared
- ISO-8601 formatting that matches Laravel's `toIso8601String()`
- Plan split (unit tests come last; the plan count is confirmed first)
- README and docs updates

## Deferred Ideas

- Social login port (its own phase; the Phase 15 preflight decides the urgency)
- Winter-import mapper for the identities table (Phase 15)