AUTH-004 — Link a Google identity to an existing Firebase member account

[daliu]

Outcome

Allow an already signed-in member to link a Google sign-in credential to the same Firebase UID without creating a second MPRC account or changing membership.

Scope

• Link Google identity to the current Firebase user after reauthentication.
• Request identity-only access; do not request Drive, Sites, Groups, or Directory scopes from members.
• Store only minimum non-secret provider metadata.
• Handle cancellation, different Google email, provider conflict, and credential already linked to another Firebase UID.
• Provide safe unlink and account-recovery behavior.

Acceptance criteria

• Existing email/password account keeps its UID and all data after linking.
• Provider identity is verified from Firebase token/provider data, never request fields.
• Linking, unlinking, or email equality never grants member/admin role.
• No Google OAuth token appears in client-readable Firestore, custom claims, logs, or issues.
• Conflict, cancellation, reauthentication, unlink, and relink tests pass.
• Privacy/consent copy explains why Google identity is linked.

Dependencies

#81 (MEMBERS-IDENTITY-001) and coordinating backlog AUTH-001.

Official references

• https://firebase.google.com/docs/auth/web/account-linking
• https://firebase.google.com/docs/rules/rules-and-auth
• https://firebase.google.com/docs/auth/users

Coordination

Parent: #79

Do not begin implementation until dependencies are complete, this issue is assigned, and a timestamped CLAIMED comment naming the agent and branch is posted. Creation of this ticket is not a claim. Preserve the parallel agent work tracked by stable IDs in GITHUB_ISSUES.md.

[daliu]

DEPENDENCY/UX NOTE (2026-07-12): new dual-method account entry is tracked by #109 and depends on this issue's explicit existing-account linking/recovery contract. A same-email Google credential must never be silently auto-linked or used to create a duplicate member account. The low-friction recovery path is: sign in with the existing email/password account, reauthenticate, link Google to the same UID here, then use Continue with Google on later visits. Cancellation/conflict copy must avoid provider jargon while preserving UID and membership state.