feat: OAuth login (Google, GitHub, GitLab) #28

New issue

2026-03-23T03:40:45Z

barrettruth commented

2026-03-23 03:40:45 +00:00

Problem

Auth is currently username/password only. Friends who want to use delta need credentials created manually. OAuth would make onboarding frictionless.

Scope

Add OAuth 2.0 login support for:

GitHub (primary — most likely provider for this audience)
Google (broad coverage)
GitLab (nice to have, same OAuth2 flow)

Design

Add an accounts table linking OAuth provider + provider user ID to a delta users row
Support linking multiple providers to one user
On first OAuth login, auto-create the user if invite policy allows (or require a pre-created account to link)
OAuth client credentials (OAUTH_GITHUB_CLIENT_ID, etc.) configured via env vars
Callback routes: /api/auth/callback/github, /api/auth/callback/google, /api/auth/callback/gitlab
Login page shows provider buttons alongside existing username/password form
Settings page allows linking/unlinking OAuth providers to existing account

Non-goals

No OIDC/SAML enterprise SSO
No replacing the existing session system — OAuth just becomes another way to establish a session

## Problem Auth is currently username/password only. Friends who want to use delta need credentials created manually. OAuth would make onboarding frictionless. ## Scope Add OAuth 2.0 login support for: - **GitHub** (primary — most likely provider for this audience) - **Google** (broad coverage) - **GitLab** (nice to have, same OAuth2 flow) ## Design - Add an `accounts` table linking OAuth provider + provider user ID to a delta `users` row - Support linking multiple providers to one user - On first OAuth login, auto-create the user if invite policy allows (or require a pre-created account to link) - OAuth client credentials (`OAUTH_GITHUB_CLIENT_ID`, etc.) configured via env vars - Callback routes: `/api/auth/callback/github`, `/api/auth/callback/google`, `/api/auth/callback/gitlab` - Login page shows provider buttons alongside existing username/password form - Settings page allows linking/unlinking OAuth providers to existing account ## Non-goals - No OIDC/SAML enterprise SSO - No replacing the existing session system — OAuth just becomes another way to establish a session

Sign in to join this conversation.