PAV-7: Vincular conta social a usuário local + merge de contas

backend/src/modules/auth/auth.controller.ts

@@ -1,7 +1,9 @@
 import { randomBytes } from "crypto";
 import { Request, Response } from "express";
+import { AppError } from "../../lib/errors.js";
 import type { OAuthProvider } from "../types/auth.types.js";
 import { AuthCallbackParamsSchema } from "../types/auth.types.js";
+import { linkProviderToUser } from "../users/functions/linkProviderToUser.js";
 import { AuthService } from "./auth.service.js";
 
 export class AuthController {
@@ -12,6 +14,13 @@ export class AuthController {
  const state = randomBytes(16).toString("hex");
 
  (req.session as { oauth_state?: string }).oauth_state = state;
+
+ if (req.query.intent === "link" && req.session.userId) {
+ (req.session as { oauth_intent?: string }).oauth_intent = "link";
+ } else {
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+ }
+
  await req.session.save();
 
  const url = await this.authService.getAuthUrl(provider, state);
@@ -43,6 +52,33 @@ export class AuthController {
 
  delete (req.session as { oauth_state?: string }).oauth_state;
 
+ const intent = (req.session as { oauth_intent?: string }).oauth_intent;
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+
+ if (intent === "link" && req.session.userId) {
+ try {
+ const profile = await this.authService.getProfileFromProvider({
+ ...params,
+ callbackUrl,
+ });
+ await linkProviderToUser({
+ userId: req.session.userId,
+ provider: params.provider,
+ profile,
+ });
+ await req.session.save();
+ return res.redirect(
+ `${frontendUrl}/perfil?linked=${params.provider}`,
+ );
+ } catch (linkError) {
+ const code =
+ linkError instanceof AppError && linkError.code === "CONFLICT"
+ ? "provider_already_linked"
+ : "link_failed";
+ return res.redirect(`${frontendUrl}/perfil?error=${code}`);
+ }
+ }
+
  const result = await this.authService.handleCallback({
  ...params,
  callbackUrl,

backend/src/modules/auth/connections.controller.ts

@@ -0,0 +1,28 @@
+// backend/src/modules/auth/connections.controller.ts
+import { Request, Response } from "express";
+import { AppError } from "../../lib/errors";
+import { disconnectProvider } from "../users/functions/disconnectProvider";
+import {
+ listUserConnections,
+ SUPPORTED_PROVIDERS,
+} from "../users/functions/listUserConnections";
+
+export class ConnectionsController {
+ async list(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const result = await listUserConnections(userId);
+ return res.json(result);
+ }
+
+ async disconnect(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const provider = req.params.provider;
+
+ if (!(SUPPORTED_PROVIDERS as readonly string[]).includes(provider)) {
+ throw AppError.validation("Provider inválido.");
+ }
+
+ await disconnectProvider({ userId, provider });
+ return res.json({ ok: true });
+ }
+}

backend/src/modules/users/functions/disconnectProvider.ts

@@ -0,0 +1,48 @@
+import { and, eq } from "drizzle-orm";
+import { db } from "../../../db/client";
+import { accounts } from "../../../db/schema";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+
+type DisconnectParams = { userId: string; provider: string };
+
+async function runDisconnect(
+ { userId, provider }: DisconnectParams,
+ tx: DB,
+): Promise<void> {
+ const userAccounts = await tx
+ .select()
+ .from(accounts)
+ .where(eq(accounts.userId, userId))
+ .for("update");
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const remainingProviders = new Set(
+ userAccounts.map((a) => a.provider).filter((p) => p !== provider),
+ );
+
+ const methodsAfter = remainingProviders.size + (hasPassword ? 1 : 0);
+
+ if (methodsAfter === 0) {
+ throw AppError.conflict(
+ "Não é possível desconectar seu último método de login.",
+ );
+ }
+
+ await tx
+ .delete(accounts)
+ .where(and(eq(accounts.userId, userId), eq(accounts.provider, provider)));
+}
+
+export async function disconnectProvider(
+ params: DisconnectParams,
+ tx?: DB,
+): Promise<void> {
+ if (tx) return runDisconnect(params, tx);
+ return db.transaction((t) => runDisconnect(params, t as unknown as DB));
+}

backend/src/modules/users/functions/linkProviderToUser.ts

@@ -0,0 +1,28 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+import { OAuthProfile } from "../../types/auth.types";
+import { createAccount } from "./createAccount";
+
+type LinkProviderParams = {
+ userId: string;
+ provider: string;
+ profile: OAuthProfile;
+};
+
+export async function linkProviderToUser(
+ { userId, provider, profile }: LinkProviderParams,
+ tx: DB = db,
+): Promise<void> {
+ const existingAccount = await tx.query.accounts.findFirst({
+ where: (acc, { eq, and }) =>
+ and(eq(acc.provider, provider), eq(acc.providerAccountId, profile.id)),
+ });
+
+ if (existingAccount) {
+ if (existingAccount.userId === userId) return;
+ throw AppError.conflict("Essa conta já está vinculada a outro usuário.");
+ }
+
+ await createAccount({ userId, provider, profile }, tx);
+}

backend/src/modules/users/functions/listUserConnections.ts

@@ -0,0 +1,42 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+
+export const SUPPORTED_PROVIDERS = ["google", "linkedin", "github"] as const;
+export type SupportedProvider = (typeof SUPPORTED_PROVIDERS)[number];
+
+export type ConnectionStatus = {
+ provider: SupportedProvider;
+ connected: boolean;
+ connectedAt: Date | null;
+};
+
+export type UserConnections = {
+ hasPassword: boolean;
+ connections: ConnectionStatus[];
+};
+
+export async function listUserConnections(
+ userId: string,
+ tx: DB = db,
+): Promise<UserConnections> {
+ const userAccounts = await tx.query.accounts.findMany({
+ where: (acc, { eq }) => eq(acc.userId, userId),
+ });
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const connections: ConnectionStatus[] = SUPPORTED_PROVIDERS.map((provider) => {
+ const account = userAccounts.find((a) => a.provider === provider);
+ return {
+ provider,
+ connected: Boolean(account),
+ connectedAt: account?.createdAt ?? null,
+ };
+ });
+
+ return { hasPassword, connections };
+}

backend/src/routes/auth.routes.ts

@@ -4,9 +4,11 @@ import {
  authAccountRateLimiter,
  authIpRateLimiter,
 } from "../middleware/rateLimit";
+import { requireAuth } from "../middleware/requireAuth";
 import { validate } from "../middleware/validate";
 import { AuthController } from "../modules/auth/auth.controller";
 import { AuthService } from "../modules/auth/auth.service";
+import { ConnectionsController } from "../modules/auth/connections.controller";
 import { CredentialsController } from "../modules/auth/credentials.controller";
 import { CredentialsService } from "../modules/auth/credentials.service";
 import { OAuthProviderSchema } from "../modules/types/auth.types";
@@ -21,6 +23,7 @@ const authService = new AuthService();
 const authController = new AuthController(authService);
 const credentialsService = new CredentialsService();
 const credentialsController = new CredentialsController(credentialsService);
+const connectionsController = new ConnectionsController();
 
 const providerParamsSchema = z.object({
  provider: OAuthProviderSchema,
@@ -38,6 +41,14 @@ router.get("/:provider/callback", (req, res, next) => {
  authController.callback(req, res).catch(next);
 });
 
+// Connections (usuário logado)
+router.get("/connections", requireAuth, (req, res, next) => {
+ connectionsController.list(req, res).catch(next);
+});
+router.delete("/connections/:provider", requireAuth, (req, res, next) => {
+ connectionsController.disconnect(req, res).catch(next);
+});
+
 // Credentials
 router.post(
  "/register",

backend/tests/integration/routes/connections.routes.test.ts

@@ -0,0 +1,87 @@
+// backend/tests/integration/routes/connections.routes.test.ts
+import express from "express";
+import request from "supertest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { AppError } from "../../../src/lib/errors";
+
+const mocks = vi.hoisted(() => ({
+ listUserConnections: vi.fn(),
+ disconnectProvider: vi.fn(),
+}));
+
+vi.mock("../../../src/modules/users/functions/listUserConnections", () => ({
+ listUserConnections: mocks.listUserConnections,
+ SUPPORTED_PROVIDERS: ["google", "linkedin", "github"],
+}));
+
+vi.mock("../../../src/modules/users/functions/disconnectProvider", () => ({
+ disconnectProvider: mocks.disconnectProvider,
+}));
+
+// Sessão fake: injeta userId
+vi.mock("../../../src/middleware/requireAuth", () => ({
+ requireAuth: (req: any, _res: any, next: any) => {
+ req.session = { userId: "user-A" };
+ next();
+ },
+}));
+
+import { errorHandler } from "../../../src/middleware/errorHandler";
+import { ConnectionsController } from "../../../src/modules/auth/connections.controller";
+import { requireAuth } from "../../../src/middleware/requireAuth";
+
+function buildApp() {
+ const app = express();
+ app.use(express.json());
+ const controller = new ConnectionsController();
+ app.get("/auth/connections", requireAuth, (req, res, next) =>
+ controller.list(req, res).catch(next),
+ );
+ app.delete("/auth/connections/:provider", requireAuth, (req, res, next) =>
+ controller.disconnect(req, res).catch(next),
+ );
+ app.use(errorHandler);
+ return app;
+}
+
+beforeEach(() => {
+ vi.clearAllMocks();
+});
+
+describe("connections routes", () => {
+ it("GET /auth/connections retorna status", async () => {
+ mocks.listUserConnections.mockResolvedValue({
+ hasPassword: false,
+ connections: [{ provider: "google", connected: true, connectedAt: null }],
+ });
+ const res = await request(buildApp()).get("/auth/connections");
+ expect(res.status).toBe(200);
+ expect(res.body.connections[0].provider).toBe("google");
+ });
+
+ it("DELETE /auth/connections/:provider retorna 200", async () => {
+ mocks.disconnectProvider.mockResolvedValue(undefined);
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(200);
+ expect(mocks.disconnectProvider).toHaveBeenCalledWith({
+ userId: "user-A",
+ provider: "google",
+ });
+ });
+
+ it("DELETE responde 409 no último método", async () => {
+ mocks.disconnectProvider.mockRejectedValue(
+ AppError.conflict("Não é possível desconectar seu último método de login."),
+ );
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(409);
+ expect(res.body.code).toBe("CONFLICT");
+ });
+
+ it("DELETE responde 400 para provider não suportado", async () => {
+ const res = await request(buildApp()).delete("/auth/connections/facebook");
+ expect(res.status).toBe(400);
+ expect(res.body.code).toBe("VALIDATION_ERROR");
+ expect(mocks.disconnectProvider).not.toHaveBeenCalled();
+ });
+});

backend/src/modules/auth/auth.controller.ts

@@ -1,7 +1,9 @@
 import { randomBytes } from "crypto";
 import { Request, Response } from "express";
+import { AppError } from "../../lib/errors.js";
 import type { OAuthProvider } from "../types/auth.types.js";
 import { AuthCallbackParamsSchema } from "../types/auth.types.js";
+import { linkProviderToUser } from "../users/functions/linkProviderToUser.js";
 import { AuthService } from "./auth.service.js";
 
 export class AuthController {
@@ -12,6 +14,13 @@ export class AuthController {
  const state = randomBytes(16).toString("hex");
 
  (req.session as { oauth_state?: string }).oauth_state = state;
+
+ if (req.query.intent === "link" && req.session.userId) {
+ (req.session as { oauth_intent?: string }).oauth_intent = "link";
+ } else {
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+ }
+
  await req.session.save();
 
  const url = await this.authService.getAuthUrl(provider, state);
@@ -43,6 +52,33 @@ export class AuthController {
 
  delete (req.session as { oauth_state?: string }).oauth_state;
 
+ const intent = (req.session as { oauth_intent?: string }).oauth_intent;
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+
+ if (intent === "link" && req.session.userId) {
+ try {
+ const profile = await this.authService.getProfileFromProvider({
+ ...params,
+ callbackUrl,
+ });
+ await linkProviderToUser({
+ userId: req.session.userId,
+ provider: params.provider,
+ profile,
+ });
+ await req.session.save();
+ return res.redirect(
+ `${frontendUrl}/perfil?linked=${params.provider}`,
+ );
+ } catch (linkError) {
+ const code =
+ linkError instanceof AppError && linkError.code === "CONFLICT"
+ ? "provider_already_linked"
+ : "link_failed";
+ return res.redirect(`${frontendUrl}/perfil?error=${code}`);
+ }
+ }
+
  const result = await this.authService.handleCallback({
  ...params,
  callbackUrl,

backend/src/modules/auth/connections.controller.ts

@@ -0,0 +1,28 @@
+// backend/src/modules/auth/connections.controller.ts
+import { Request, Response } from "express";
+import { AppError } from "../../lib/errors";
+import { disconnectProvider } from "../users/functions/disconnectProvider";
+import {
+ listUserConnections,
+ SUPPORTED_PROVIDERS,
+} from "../users/functions/listUserConnections";
+
+export class ConnectionsController {
+ async list(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const result = await listUserConnections(userId);
+ return res.json(result);
+ }
+
+ async disconnect(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const provider = req.params.provider;
+
+ if (!(SUPPORTED_PROVIDERS as readonly string[]).includes(provider)) {
+ throw AppError.validation("Provider inválido.");
+ }
+
+ await disconnectProvider({ userId, provider });
+ return res.json({ ok: true });
+ }
+}

backend/src/modules/users/functions/disconnectProvider.ts

@@ -0,0 +1,48 @@
+import { and, eq } from "drizzle-orm";
+import { db } from "../../../db/client";
+import { accounts } from "../../../db/schema";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+
+type DisconnectParams = { userId: string; provider: string };
+
+async function runDisconnect(
+ { userId, provider }: DisconnectParams,
+ tx: DB,
+): Promise<void> {
+ const userAccounts = await tx
+ .select()
+ .from(accounts)
+ .where(eq(accounts.userId, userId))
+ .for("update");
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const remainingProviders = new Set(
+ userAccounts.map((a) => a.provider).filter((p) => p !== provider),
+ );
+
+ const methodsAfter = remainingProviders.size + (hasPassword ? 1 : 0);
+
+ if (methodsAfter === 0) {
+ throw AppError.conflict(
+ "Não é possível desconectar seu último método de login.",
+ );
+ }
+
+ await tx
+ .delete(accounts)
+ .where(and(eq(accounts.userId, userId), eq(accounts.provider, provider)));
+}
+
+export async function disconnectProvider(
+ params: DisconnectParams,
+ tx?: DB,
+): Promise<void> {
+ if (tx) return runDisconnect(params, tx);
+ return db.transaction((t) => runDisconnect(params, t as unknown as DB));
+}

backend/src/modules/users/functions/linkProviderToUser.ts

@@ -0,0 +1,28 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+import { OAuthProfile } from "../../types/auth.types";
+import { createAccount } from "./createAccount";
+
+type LinkProviderParams = {
+ userId: string;
+ provider: string;
+ profile: OAuthProfile;
+};
+
+export async function linkProviderToUser(
+ { userId, provider, profile }: LinkProviderParams,
+ tx: DB = db,
+): Promise<void> {
+ const existingAccount = await tx.query.accounts.findFirst({
+ where: (acc, { eq, and }) =>
+ and(eq(acc.provider, provider), eq(acc.providerAccountId, profile.id)),
+ });
+
+ if (existingAccount) {
+ if (existingAccount.userId === userId) return;
+ throw AppError.conflict("Essa conta já está vinculada a outro usuário.");
+ }
+
+ await createAccount({ userId, provider, profile }, tx);
+}

backend/src/modules/users/functions/listUserConnections.ts

@@ -0,0 +1,42 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+
+export const SUPPORTED_PROVIDERS = ["google", "linkedin", "github"] as const;
+export type SupportedProvider = (typeof SUPPORTED_PROVIDERS)[number];
+
+export type ConnectionStatus = {
+ provider: SupportedProvider;
+ connected: boolean;
+ connectedAt: Date | null;
+};
+
+export type UserConnections = {
+ hasPassword: boolean;
+ connections: ConnectionStatus[];
+};
+
+export async function listUserConnections(
+ userId: string,
+ tx: DB = db,
+): Promise<UserConnections> {
+ const userAccounts = await tx.query.accounts.findMany({
+ where: (acc, { eq }) => eq(acc.userId, userId),
+ });
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const connections: ConnectionStatus[] = SUPPORTED_PROVIDERS.map((provider) => {
+ const account = userAccounts.find((a) => a.provider === provider);
+ return {
+ provider,
+ connected: Boolean(account),
+ connectedAt: account?.createdAt ?? null,
+ };
+ });
+
+ return { hasPassword, connections };
+}

backend/src/routes/auth.routes.ts

@@ -4,9 +4,11 @@ import {
  authAccountRateLimiter,
  authIpRateLimiter,
 } from "../middleware/rateLimit";
+import { requireAuth } from "../middleware/requireAuth";
 import { validate } from "../middleware/validate";
 import { AuthController } from "../modules/auth/auth.controller";
 import { AuthService } from "../modules/auth/auth.service";
+import { ConnectionsController } from "../modules/auth/connections.controller";
 import { CredentialsController } from "../modules/auth/credentials.controller";
 import { CredentialsService } from "../modules/auth/credentials.service";
 import { OAuthProviderSchema } from "../modules/types/auth.types";
@@ -21,6 +23,7 @@ const authService = new AuthService();
 const authController = new AuthController(authService);
 const credentialsService = new CredentialsService();
 const credentialsController = new CredentialsController(credentialsService);
+const connectionsController = new ConnectionsController();
 
 const providerParamsSchema = z.object({
  provider: OAuthProviderSchema,
@@ -38,6 +41,14 @@ router.get("/:provider/callback", (req, res, next) => {
  authController.callback(req, res).catch(next);
 });
 
+// Connections (usuário logado)
+router.get("/connections", requireAuth, (req, res, next) => {
+ connectionsController.list(req, res).catch(next);
+});
+router.delete("/connections/:provider", requireAuth, (req, res, next) => {
+ connectionsController.disconnect(req, res).catch(next);
+});
+
 // Credentials
 router.post(
  "/register",

backend/tests/integration/routes/connections.routes.test.ts

@@ -0,0 +1,87 @@
+// backend/tests/integration/routes/connections.routes.test.ts
+import express from "express";
+import request from "supertest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { AppError } from "../../../src/lib/errors";
+
+const mocks = vi.hoisted(() => ({
+ listUserConnections: vi.fn(),
+ disconnectProvider: vi.fn(),
+}));
+
+vi.mock("../../../src/modules/users/functions/listUserConnections", () => ({
+ listUserConnections: mocks.listUserConnections,
+ SUPPORTED_PROVIDERS: ["google", "linkedin", "github"],
+}));
+
+vi.mock("../../../src/modules/users/functions/disconnectProvider", () => ({
+ disconnectProvider: mocks.disconnectProvider,
+}));
+
+// Sessão fake: injeta userId
+vi.mock("../../../src/middleware/requireAuth", () => ({
+ requireAuth: (req: any, _res: any, next: any) => {
+ req.session = { userId: "user-A" };
+ next();
+ },
+}));
+
+import { errorHandler } from "../../../src/middleware/errorHandler";
+import { ConnectionsController } from "../../../src/modules/auth/connections.controller";
+import { requireAuth } from "../../../src/middleware/requireAuth";
+
+function buildApp() {
+ const app = express();
+ app.use(express.json());
+ const controller = new ConnectionsController();
+ app.get("/auth/connections", requireAuth, (req, res, next) =>
+ controller.list(req, res).catch(next),
+ );
+ app.delete("/auth/connections/:provider", requireAuth, (req, res, next) =>
+ controller.disconnect(req, res).catch(next),
+ );
+ app.use(errorHandler);
+ return app;
+}
+
+beforeEach(() => {
+ vi.clearAllMocks();
+});
+
+describe("connections routes", () => {
+ it("GET /auth/connections retorna status", async () => {
+ mocks.listUserConnections.mockResolvedValue({
+ hasPassword: false,
+ connections: [{ provider: "google", connected: true, connectedAt: null }],
+ });
+ const res = await request(buildApp()).get("/auth/connections");
+ expect(res.status).toBe(200);
+ expect(res.body.connections[0].provider).toBe("google");
+ });
+
+ it("DELETE /auth/connections/:provider retorna 200", async () => {
+ mocks.disconnectProvider.mockResolvedValue(undefined);
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(200);
+ expect(mocks.disconnectProvider).toHaveBeenCalledWith({
+ userId: "user-A",
+ provider: "google",
+ });
+ });
+
+ it("DELETE responde 409 no último método", async () => {
+ mocks.disconnectProvider.mockRejectedValue(
+ AppError.conflict("Não é possível desconectar seu último método de login."),
+ );
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(409);
+ expect(res.body.code).toBe("CONFLICT");
+ });
+
+ it("DELETE responde 400 para provider não suportado", async () => {
+ const res = await request(buildApp()).delete("/auth/connections/facebook");
+ expect(res.status).toBe(400);
+ expect(res.body.code).toBe("VALIDATION_ERROR");
+ expect(mocks.disconnectProvider).not.toHaveBeenCalled();
+ });
+});

backend/src/modules/auth/auth.controller.ts

@@ -1,7 +1,9 @@
 import { randomBytes } from "crypto";
 import { Request, Response } from "express";
+import { AppError } from "../../lib/errors.js";
 import type { OAuthProvider } from "../types/auth.types.js";
 import { AuthCallbackParamsSchema } from "../types/auth.types.js";
+import { linkProviderToUser } from "../users/functions/linkProviderToUser.js";
 import { AuthService } from "./auth.service.js";
 
 export class AuthController {
@@ -12,6 +14,13 @@ export class AuthController {
  const state = randomBytes(16).toString("hex");
 
  (req.session as { oauth_state?: string }).oauth_state = state;
+
+ if (req.query.intent === "link" && req.session.userId) {
+ (req.session as { oauth_intent?: string }).oauth_intent = "link";
+ } else {
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+ }
+
  await req.session.save();
 
  const url = await this.authService.getAuthUrl(provider, state);
@@ -43,6 +52,33 @@ export class AuthController {
 
  delete (req.session as { oauth_state?: string }).oauth_state;
 
+ const intent = (req.session as { oauth_intent?: string }).oauth_intent;
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+
+ if (intent === "link" && req.session.userId) {
+ try {
+ const profile = await this.authService.getProfileFromProvider({
+ ...params,
+ callbackUrl,
+ });
+ await linkProviderToUser({
+ userId: req.session.userId,
+ provider: params.provider,
+ profile,
+ });
+ await req.session.save();
+ return res.redirect(
+ `${frontendUrl}/perfil?linked=${params.provider}`,
+ );
+ } catch (linkError) {
+ const code =
+ linkError instanceof AppError && linkError.code === "CONFLICT"
+ ? "provider_already_linked"
+ : "link_failed";
+ return res.redirect(`${frontendUrl}/perfil?error=${code}`);
+ }
+ }
+
  const result = await this.authService.handleCallback({
  ...params,
  callbackUrl,

backend/src/modules/auth/connections.controller.ts

@@ -0,0 +1,28 @@
+// backend/src/modules/auth/connections.controller.ts
+import { Request, Response } from "express";
+import { AppError } from "../../lib/errors";
+import { disconnectProvider } from "../users/functions/disconnectProvider";
+import {
+ listUserConnections,
+ SUPPORTED_PROVIDERS,
+} from "../users/functions/listUserConnections";
+
+export class ConnectionsController {
+ async list(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const result = await listUserConnections(userId);
+ return res.json(result);
+ }
+
+ async disconnect(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const provider = req.params.provider;
+
+ if (!(SUPPORTED_PROVIDERS as readonly string[]).includes(provider)) {
+ throw AppError.validation("Provider inválido.");
+ }
+
+ await disconnectProvider({ userId, provider });
+ return res.json({ ok: true });
+ }
+}

backend/src/modules/users/functions/disconnectProvider.ts

@@ -0,0 +1,48 @@
+import { and, eq } from "drizzle-orm";
+import { db } from "../../../db/client";
+import { accounts } from "../../../db/schema";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+
+type DisconnectParams = { userId: string; provider: string };
+
+async function runDisconnect(
+ { userId, provider }: DisconnectParams,
+ tx: DB,
+): Promise<void> {
+ const userAccounts = await tx
+ .select()
+ .from(accounts)
+ .where(eq(accounts.userId, userId))
+ .for("update");
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const remainingProviders = new Set(
+ userAccounts.map((a) => a.provider).filter((p) => p !== provider),
+ );
+
+ const methodsAfter = remainingProviders.size + (hasPassword ? 1 : 0);
+
+ if (methodsAfter === 0) {
+ throw AppError.conflict(
+ "Não é possível desconectar seu último método de login.",
+ );
+ }
+
+ await tx
+ .delete(accounts)
+ .where(and(eq(accounts.userId, userId), eq(accounts.provider, provider)));
+}
+
+export async function disconnectProvider(
+ params: DisconnectParams,
+ tx?: DB,
+): Promise<void> {
+ if (tx) return runDisconnect(params, tx);
+ return db.transaction((t) => runDisconnect(params, t as unknown as DB));
+}

backend/src/modules/users/functions/linkProviderToUser.ts

@@ -0,0 +1,28 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+import { OAuthProfile } from "../../types/auth.types";
+import { createAccount } from "./createAccount";
+
+type LinkProviderParams = {
+ userId: string;
+ provider: string;
+ profile: OAuthProfile;
+};
+
+export async function linkProviderToUser(
+ { userId, provider, profile }: LinkProviderParams,
+ tx: DB = db,
+): Promise<void> {
+ const existingAccount = await tx.query.accounts.findFirst({
+ where: (acc, { eq, and }) =>
+ and(eq(acc.provider, provider), eq(acc.providerAccountId, profile.id)),
+ });
+
+ if (existingAccount) {
+ if (existingAccount.userId === userId) return;
+ throw AppError.conflict("Essa conta já está vinculada a outro usuário.");
+ }
+
+ await createAccount({ userId, provider, profile }, tx);
+}

backend/src/modules/users/functions/listUserConnections.ts

@@ -0,0 +1,42 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+
+export const SUPPORTED_PROVIDERS = ["google", "linkedin", "github"] as const;
+export type SupportedProvider = (typeof SUPPORTED_PROVIDERS)[number];
+
+export type ConnectionStatus = {
+ provider: SupportedProvider;
+ connected: boolean;
+ connectedAt: Date | null;
+};
+
+export type UserConnections = {
+ hasPassword: boolean;
+ connections: ConnectionStatus[];
+};
+
+export async function listUserConnections(
+ userId: string,
+ tx: DB = db,
+): Promise<UserConnections> {
+ const userAccounts = await tx.query.accounts.findMany({
+ where: (acc, { eq }) => eq(acc.userId, userId),
+ });
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const connections: ConnectionStatus[] = SUPPORTED_PROVIDERS.map((provider) => {
+ const account = userAccounts.find((a) => a.provider === provider);
+ return {
+ provider,
+ connected: Boolean(account),
+ connectedAt: account?.createdAt ?? null,
+ };
+ });
+
+ return { hasPassword, connections };
+}

backend/src/routes/auth.routes.ts

@@ -4,9 +4,11 @@ import {
  authAccountRateLimiter,
  authIpRateLimiter,
 } from "../middleware/rateLimit";
+import { requireAuth } from "../middleware/requireAuth";
 import { validate } from "../middleware/validate";
 import { AuthController } from "../modules/auth/auth.controller";
 import { AuthService } from "../modules/auth/auth.service";
+import { ConnectionsController } from "../modules/auth/connections.controller";
 import { CredentialsController } from "../modules/auth/credentials.controller";
 import { CredentialsService } from "../modules/auth/credentials.service";
 import { OAuthProviderSchema } from "../modules/types/auth.types";
@@ -21,6 +23,7 @@ const authService = new AuthService();
 const authController = new AuthController(authService);
 const credentialsService = new CredentialsService();
 const credentialsController = new CredentialsController(credentialsService);
+const connectionsController = new ConnectionsController();
 
 const providerParamsSchema = z.object({
  provider: OAuthProviderSchema,
@@ -38,6 +41,14 @@ router.get("/:provider/callback", (req, res, next) => {
  authController.callback(req, res).catch(next);
 });
 
+// Connections (usuário logado)
+router.get("/connections", requireAuth, (req, res, next) => {
+ connectionsController.list(req, res).catch(next);
+});
+router.delete("/connections/:provider", requireAuth, (req, res, next) => {
+ connectionsController.disconnect(req, res).catch(next);
+});
+
 // Credentials
 router.post(
  "/register",

backend/tests/integration/routes/connections.routes.test.ts

@@ -0,0 +1,87 @@
+// backend/tests/integration/routes/connections.routes.test.ts
+import express from "express";
+import request from "supertest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { AppError } from "../../../src/lib/errors";
+
+const mocks = vi.hoisted(() => ({
+ listUserConnections: vi.fn(),
+ disconnectProvider: vi.fn(),
+}));
+
+vi.mock("../../../src/modules/users/functions/listUserConnections", () => ({
+ listUserConnections: mocks.listUserConnections,
+ SUPPORTED_PROVIDERS: ["google", "linkedin", "github"],
+}));
+
+vi.mock("../../../src/modules/users/functions/disconnectProvider", () => ({
+ disconnectProvider: mocks.disconnectProvider,
+}));
+
+// Sessão fake: injeta userId
+vi.mock("../../../src/middleware/requireAuth", () => ({
+ requireAuth: (req: any, _res: any, next: any) => {
+ req.session = { userId: "user-A" };
+ next();
+ },
+}));
+
+import { errorHandler } from "../../../src/middleware/errorHandler";
+import { ConnectionsController } from "../../../src/modules/auth/connections.controller";
+import { requireAuth } from "../../../src/middleware/requireAuth";
+
+function buildApp() {
+ const app = express();
+ app.use(express.json());
+ const controller = new ConnectionsController();
+ app.get("/auth/connections", requireAuth, (req, res, next) =>
+ controller.list(req, res).catch(next),
+ );
+ app.delete("/auth/connections/:provider", requireAuth, (req, res, next) =>
+ controller.disconnect(req, res).catch(next),
+ );
+ app.use(errorHandler);
+ return app;
+}
+
+beforeEach(() => {
+ vi.clearAllMocks();
+});
+
+describe("connections routes", () => {
+ it("GET /auth/connections retorna status", async () => {
+ mocks.listUserConnections.mockResolvedValue({
+ hasPassword: false,
+ connections: [{ provider: "google", connected: true, connectedAt: null }],
+ });
+ const res = await request(buildApp()).get("/auth/connections");
+ expect(res.status).toBe(200);
+ expect(res.body.connections[0].provider).toBe("google");
+ });
+
+ it("DELETE /auth/connections/:provider retorna 200", async () => {
+ mocks.disconnectProvider.mockResolvedValue(undefined);
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(200);
+ expect(mocks.disconnectProvider).toHaveBeenCalledWith({
+ userId: "user-A",
+ provider: "google",
+ });
+ });
+
+ it("DELETE responde 409 no último método", async () => {
+ mocks.disconnectProvider.mockRejectedValue(
+ AppError.conflict("Não é possível desconectar seu último método de login."),
+ );
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(409);
+ expect(res.body.code).toBe("CONFLICT");
+ });
+
+ it("DELETE responde 400 para provider não suportado", async () => {
+ const res = await request(buildApp()).delete("/auth/connections/facebook");
+ expect(res.status).toBe(400);
+ expect(res.body.code).toBe("VALIDATION_ERROR");
+ expect(mocks.disconnectProvider).not.toHaveBeenCalled();
+ });
+});

backend/src/modules/auth/auth.controller.ts

@@ -1,7 +1,9 @@
 import { randomBytes } from "crypto";
 import { Request, Response } from "express";
+import { AppError } from "../../lib/errors.js";
 import type { OAuthProvider } from "../types/auth.types.js";
 import { AuthCallbackParamsSchema } from "../types/auth.types.js";
+import { linkProviderToUser } from "../users/functions/linkProviderToUser.js";
 import { AuthService } from "./auth.service.js";
 
 export class AuthController {
@@ -12,6 +14,13 @@ export class AuthController {
  const state = randomBytes(16).toString("hex");
 
  (req.session as { oauth_state?: string }).oauth_state = state;
+
+ if (req.query.intent === "link" && req.session.userId) {
+ (req.session as { oauth_intent?: string }).oauth_intent = "link";
+ } else {
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+ }
+
  await req.session.save();
 
  const url = await this.authService.getAuthUrl(provider, state);
@@ -43,6 +52,33 @@ export class AuthController {
 
  delete (req.session as { oauth_state?: string }).oauth_state;
 
+ const intent = (req.session as { oauth_intent?: string }).oauth_intent;
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+
+ if (intent === "link" && req.session.userId) {
+ try {
+ const profile = await this.authService.getProfileFromProvider({
+ ...params,
+ callbackUrl,
+ });
+ await linkProviderToUser({
+ userId: req.session.userId,
+ provider: params.provider,
+ profile,
+ });
+ await req.session.save();
+ return res.redirect(
+ `${frontendUrl}/perfil?linked=${params.provider}`,
+ );
+ } catch (linkError) {
+ const code =
+ linkError instanceof AppError && linkError.code === "CONFLICT"
+ ? "provider_already_linked"
+ : "link_failed";
+ return res.redirect(`${frontendUrl}/perfil?error=${code}`);
+ }
+ }
+
  const result = await this.authService.handleCallback({
  ...params,
  callbackUrl,

backend/src/modules/auth/connections.controller.ts

@@ -0,0 +1,28 @@
+// backend/src/modules/auth/connections.controller.ts
+import { Request, Response } from "express";
+import { AppError } from "../../lib/errors";
+import { disconnectProvider } from "../users/functions/disconnectProvider";
+import {
+ listUserConnections,
+ SUPPORTED_PROVIDERS,
+} from "../users/functions/listUserConnections";
+
+export class ConnectionsController {
+ async list(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const result = await listUserConnections(userId);
+ return res.json(result);
+ }
+
+ async disconnect(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const provider = req.params.provider;
+
+ if (!(SUPPORTED_PROVIDERS as readonly string[]).includes(provider)) {
+ throw AppError.validation("Provider inválido.");
+ }
+
+ await disconnectProvider({ userId, provider });
+ return res.json({ ok: true });
+ }
+}

backend/src/modules/users/functions/disconnectProvider.ts

@@ -0,0 +1,48 @@
+import { and, eq } from "drizzle-orm";
+import { db } from "../../../db/client";
+import { accounts } from "../../../db/schema";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+
+type DisconnectParams = { userId: string; provider: string };
+
+async function runDisconnect(
+ { userId, provider }: DisconnectParams,
+ tx: DB,
+): Promise<void> {
+ const userAccounts = await tx
+ .select()
+ .from(accounts)
+ .where(eq(accounts.userId, userId))
+ .for("update");
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const remainingProviders = new Set(
+ userAccounts.map((a) => a.provider).filter((p) => p !== provider),
+ );
+
+ const methodsAfter = remainingProviders.size + (hasPassword ? 1 : 0);
+
+ if (methodsAfter === 0) {
+ throw AppError.conflict(
+ "Não é possível desconectar seu último método de login.",
+ );
+ }
+
+ await tx
+ .delete(accounts)
+ .where(and(eq(accounts.userId, userId), eq(accounts.provider, provider)));
+}
+
+export async function disconnectProvider(
+ params: DisconnectParams,
+ tx?: DB,
+): Promise<void> {
+ if (tx) return runDisconnect(params, tx);
+ return db.transaction((t) => runDisconnect(params, t as unknown as DB));
+}

backend/src/modules/users/functions/linkProviderToUser.ts

@@ -0,0 +1,28 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+import { OAuthProfile } from "../../types/auth.types";
+import { createAccount } from "./createAccount";
+
+type LinkProviderParams = {
+ userId: string;
+ provider: string;
+ profile: OAuthProfile;
+};
+
+export async function linkProviderToUser(
+ { userId, provider, profile }: LinkProviderParams,
+ tx: DB = db,
+): Promise<void> {
+ const existingAccount = await tx.query.accounts.findFirst({
+ where: (acc, { eq, and }) =>
+ and(eq(acc.provider, provider), eq(acc.providerAccountId, profile.id)),
+ });
+
+ if (existingAccount) {
+ if (existingAccount.userId === userId) return;
+ throw AppError.conflict("Essa conta já está vinculada a outro usuário.");
+ }
+
+ await createAccount({ userId, provider, profile }, tx);
+}

backend/src/modules/users/functions/listUserConnections.ts

@@ -0,0 +1,42 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+
+export const SUPPORTED_PROVIDERS = ["google", "linkedin", "github"] as const;
+export type SupportedProvider = (typeof SUPPORTED_PROVIDERS)[number];
+
+export type ConnectionStatus = {
+ provider: SupportedProvider;
+ connected: boolean;
+ connectedAt: Date | null;
+};
+
+export type UserConnections = {
+ hasPassword: boolean;
+ connections: ConnectionStatus[];
+};
+
+export async function listUserConnections(
+ userId: string,
+ tx: DB = db,
+): Promise<UserConnections> {
+ const userAccounts = await tx.query.accounts.findMany({
+ where: (acc, { eq }) => eq(acc.userId, userId),
+ });
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const connections: ConnectionStatus[] = SUPPORTED_PROVIDERS.map((provider) => {
+ const account = userAccounts.find((a) => a.provider === provider);
+ return {
+ provider,
+ connected: Boolean(account),
+ connectedAt: account?.createdAt ?? null,
+ };
+ });
+
+ return { hasPassword, connections };
+}

backend/src/routes/auth.routes.ts

@@ -4,9 +4,11 @@ import {
  authAccountRateLimiter,
  authIpRateLimiter,
 } from "../middleware/rateLimit";
+import { requireAuth } from "../middleware/requireAuth";
 import { validate } from "../middleware/validate";
 import { AuthController } from "../modules/auth/auth.controller";
 import { AuthService } from "../modules/auth/auth.service";
+import { ConnectionsController } from "../modules/auth/connections.controller";
 import { CredentialsController } from "../modules/auth/credentials.controller";
 import { CredentialsService } from "../modules/auth/credentials.service";
 import { OAuthProviderSchema } from "../modules/types/auth.types";
@@ -21,6 +23,7 @@ const authService = new AuthService();
 const authController = new AuthController(authService);
 const credentialsService = new CredentialsService();
 const credentialsController = new CredentialsController(credentialsService);
+const connectionsController = new ConnectionsController();
 
 const providerParamsSchema = z.object({
  provider: OAuthProviderSchema,
@@ -38,6 +41,14 @@ router.get("/:provider/callback", (req, res, next) => {
  authController.callback(req, res).catch(next);
 });
 
+// Connections (usuário logado)
+router.get("/connections", requireAuth, (req, res, next) => {
+ connectionsController.list(req, res).catch(next);
+});
+router.delete("/connections/:provider", requireAuth, (req, res, next) => {
+ connectionsController.disconnect(req, res).catch(next);
+});
+
 // Credentials
 router.post(
  "/register",

backend/tests/integration/routes/connections.routes.test.ts

@@ -0,0 +1,87 @@
+// backend/tests/integration/routes/connections.routes.test.ts
+import express from "express";
+import request from "supertest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { AppError } from "../../../src/lib/errors";
+
+const mocks = vi.hoisted(() => ({
+ listUserConnections: vi.fn(),
+ disconnectProvider: vi.fn(),
+}));
+
+vi.mock("../../../src/modules/users/functions/listUserConnections", () => ({
+ listUserConnections: mocks.listUserConnections,
+ SUPPORTED_PROVIDERS: ["google", "linkedin", "github"],
+}));
+
+vi.mock("../../../src/modules/users/functions/disconnectProvider", () => ({
+ disconnectProvider: mocks.disconnectProvider,
+}));
+
+// Sessão fake: injeta userId
+vi.mock("../../../src/middleware/requireAuth", () => ({
+ requireAuth: (req: any, _res: any, next: any) => {
+ req.session = { userId: "user-A" };
+ next();
+ },
+}));
+
+import { errorHandler } from "../../../src/middleware/errorHandler";
+import { ConnectionsController } from "../../../src/modules/auth/connections.controller";
+import { requireAuth } from "../../../src/middleware/requireAuth";
+
+function buildApp() {
+ const app = express();
+ app.use(express.json());
+ const controller = new ConnectionsController();
+ app.get("/auth/connections", requireAuth, (req, res, next) =>
+ controller.list(req, res).catch(next),
+ );
+ app.delete("/auth/connections/:provider", requireAuth, (req, res, next) =>
+ controller.disconnect(req, res).catch(next),
+ );
+ app.use(errorHandler);
+ return app;
+}
+
+beforeEach(() => {
+ vi.clearAllMocks();
+});
+
+describe("connections routes", () => {
+ it("GET /auth/connections retorna status", async () => {
+ mocks.listUserConnections.mockResolvedValue({
+ hasPassword: false,
+ connections: [{ provider: "google", connected: true, connectedAt: null }],
+ });
+ const res = await request(buildApp()).get("/auth/connections");
+ expect(res.status).toBe(200);
+ expect(res.body.connections[0].provider).toBe("google");
+ });
+
+ it("DELETE /auth/connections/:provider retorna 200", async () => {
+ mocks.disconnectProvider.mockResolvedValue(undefined);
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(200);
+ expect(mocks.disconnectProvider).toHaveBeenCalledWith({
+ userId: "user-A",
+ provider: "google",
+ });
+ });
+
+ it("DELETE responde 409 no último método", async () => {
+ mocks.disconnectProvider.mockRejectedValue(
+ AppError.conflict("Não é possível desconectar seu último método de login."),
+ );
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(409);
+ expect(res.body.code).toBe("CONFLICT");
+ });
+
+ it("DELETE responde 400 para provider não suportado", async () => {
+ const res = await request(buildApp()).delete("/auth/connections/facebook");
+ expect(res.status).toBe(400);
+ expect(res.body.code).toBe("VALIDATION_ERROR");
+ expect(mocks.disconnectProvider).not.toHaveBeenCalled();
+ });
+});

backend/src/modules/auth/auth.controller.ts

@@ -1,7 +1,9 @@
 import { randomBytes } from "crypto";
 import { Request, Response } from "express";
+import { AppError } from "../../lib/errors.js";
 import type { OAuthProvider } from "../types/auth.types.js";
 import { AuthCallbackParamsSchema } from "../types/auth.types.js";
+import { linkProviderToUser } from "../users/functions/linkProviderToUser.js";
 import { AuthService } from "./auth.service.js";
 
 export class AuthController {
@@ -12,6 +14,13 @@ export class AuthController {
  const state = randomBytes(16).toString("hex");
 
  (req.session as { oauth_state?: string }).oauth_state = state;
+
+ if (req.query.intent === "link" && req.session.userId) {
+ (req.session as { oauth_intent?: string }).oauth_intent = "link";
+ } else {
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+ }
+
  await req.session.save();
 
  const url = await this.authService.getAuthUrl(provider, state);
@@ -43,6 +52,33 @@ export class AuthController {
 
  delete (req.session as { oauth_state?: string }).oauth_state;
 
+ const intent = (req.session as { oauth_intent?: string }).oauth_intent;
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+
+ if (intent === "link" && req.session.userId) {
+ try {
+ const profile = await this.authService.getProfileFromProvider({
+ ...params,
+ callbackUrl,
+ });
+ await linkProviderToUser({
+ userId: req.session.userId,
+ provider: params.provider,
+ profile,
+ });
+ await req.session.save();
+ return res.redirect(
+ `${frontendUrl}/perfil?linked=${params.provider}`,
+ );
+ } catch (linkError) {
+ const code =
+ linkError instanceof AppError && linkError.code === "CONFLICT"
+ ? "provider_already_linked"
+ : "link_failed";
+ return res.redirect(`${frontendUrl}/perfil?error=${code}`);
+ }
+ }
+
  const result = await this.authService.handleCallback({
  ...params,
  callbackUrl,

backend/src/modules/auth/connections.controller.ts

@@ -0,0 +1,28 @@
+// backend/src/modules/auth/connections.controller.ts
+import { Request, Response } from "express";
+import { AppError } from "../../lib/errors";
+import { disconnectProvider } from "../users/functions/disconnectProvider";
+import {
+ listUserConnections,
+ SUPPORTED_PROVIDERS,
+} from "../users/functions/listUserConnections";
+
+export class ConnectionsController {
+ async list(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const result = await listUserConnections(userId);
+ return res.json(result);
+ }
+
+ async disconnect(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const provider = req.params.provider;
+
+ if (!(SUPPORTED_PROVIDERS as readonly string[]).includes(provider)) {
+ throw AppError.validation("Provider inválido.");
+ }
+
+ await disconnectProvider({ userId, provider });
+ return res.json({ ok: true });
+ }
+}

backend/src/modules/users/functions/disconnectProvider.ts

@@ -0,0 +1,48 @@
+import { and, eq } from "drizzle-orm";
+import { db } from "../../../db/client";
+import { accounts } from "../../../db/schema";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+
+type DisconnectParams = { userId: string; provider: string };
+
+async function runDisconnect(
+ { userId, provider }: DisconnectParams,
+ tx: DB,
+): Promise<void> {
+ const userAccounts = await tx
+ .select()
+ .from(accounts)
+ .where(eq(accounts.userId, userId))
+ .for("update");
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const remainingProviders = new Set(
+ userAccounts.map((a) => a.provider).filter((p) => p !== provider),
+ );
+
+ const methodsAfter = remainingProviders.size + (hasPassword ? 1 : 0);
+
+ if (methodsAfter === 0) {
+ throw AppError.conflict(
+ "Não é possível desconectar seu último método de login.",
+ );
+ }
+
+ await tx
+ .delete(accounts)
+ .where(and(eq(accounts.userId, userId), eq(accounts.provider, provider)));
+}
+
+export async function disconnectProvider(
+ params: DisconnectParams,
+ tx?: DB,
+): Promise<void> {
+ if (tx) return runDisconnect(params, tx);
+ return db.transaction((t) => runDisconnect(params, t as unknown as DB));
+}

backend/src/modules/users/functions/linkProviderToUser.ts

@@ -0,0 +1,28 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+import { OAuthProfile } from "../../types/auth.types";
+import { createAccount } from "./createAccount";
+
+type LinkProviderParams = {
+ userId: string;
+ provider: string;
+ profile: OAuthProfile;
+};
+
+export async function linkProviderToUser(
+ { userId, provider, profile }: LinkProviderParams,
+ tx: DB = db,
+): Promise<void> {
+ const existingAccount = await tx.query.accounts.findFirst({
+ where: (acc, { eq, and }) =>
+ and(eq(acc.provider, provider), eq(acc.providerAccountId, profile.id)),
+ });
+
+ if (existingAccount) {
+ if (existingAccount.userId === userId) return;
+ throw AppError.conflict("Essa conta já está vinculada a outro usuário.");
+ }
+
+ await createAccount({ userId, provider, profile }, tx);
+}

backend/src/modules/users/functions/listUserConnections.ts

@@ -0,0 +1,42 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+
+export const SUPPORTED_PROVIDERS = ["google", "linkedin", "github"] as const;
+export type SupportedProvider = (typeof SUPPORTED_PROVIDERS)[number];
+
+export type ConnectionStatus = {
+ provider: SupportedProvider;
+ connected: boolean;
+ connectedAt: Date | null;
+};
+
+export type UserConnections = {
+ hasPassword: boolean;
+ connections: ConnectionStatus[];
+};
+
+export async function listUserConnections(
+ userId: string,
+ tx: DB = db,
+): Promise<UserConnections> {
+ const userAccounts = await tx.query.accounts.findMany({
+ where: (acc, { eq }) => eq(acc.userId, userId),
+ });
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const connections: ConnectionStatus[] = SUPPORTED_PROVIDERS.map((provider) => {
+ const account = userAccounts.find((a) => a.provider === provider);
+ return {
+ provider,
+ connected: Boolean(account),
+ connectedAt: account?.createdAt ?? null,
+ };
+ });
+
+ return { hasPassword, connections };
+}

backend/src/routes/auth.routes.ts

@@ -4,9 +4,11 @@ import {
  authAccountRateLimiter,
  authIpRateLimiter,
 } from "../middleware/rateLimit";
+import { requireAuth } from "../middleware/requireAuth";
 import { validate } from "../middleware/validate";
 import { AuthController } from "../modules/auth/auth.controller";
 import { AuthService } from "../modules/auth/auth.service";
+import { ConnectionsController } from "../modules/auth/connections.controller";
 import { CredentialsController } from "../modules/auth/credentials.controller";
 import { CredentialsService } from "../modules/auth/credentials.service";
 import { OAuthProviderSchema } from "../modules/types/auth.types";
@@ -21,6 +23,7 @@ const authService = new AuthService();
 const authController = new AuthController(authService);
 const credentialsService = new CredentialsService();
 const credentialsController = new CredentialsController(credentialsService);
+const connectionsController = new ConnectionsController();
 
 const providerParamsSchema = z.object({
  provider: OAuthProviderSchema,
@@ -38,6 +41,14 @@ router.get("/:provider/callback", (req, res, next) => {
  authController.callback(req, res).catch(next);
 });
 
+// Connections (usuário logado)
+router.get("/connections", requireAuth, (req, res, next) => {
+ connectionsController.list(req, res).catch(next);
+});
+router.delete("/connections/:provider", requireAuth, (req, res, next) => {
+ connectionsController.disconnect(req, res).catch(next);
+});
+
 // Credentials
 router.post(
  "/register",

backend/tests/integration/routes/connections.routes.test.ts

@@ -0,0 +1,87 @@
+// backend/tests/integration/routes/connections.routes.test.ts
+import express from "express";
+import request from "supertest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { AppError } from "../../../src/lib/errors";
+
+const mocks = vi.hoisted(() => ({
+ listUserConnections: vi.fn(),
+ disconnectProvider: vi.fn(),
+}));
+
+vi.mock("../../../src/modules/users/functions/listUserConnections", () => ({
+ listUserConnections: mocks.listUserConnections,
+ SUPPORTED_PROVIDERS: ["google", "linkedin", "github"],
+}));
+
+vi.mock("../../../src/modules/users/functions/disconnectProvider", () => ({
+ disconnectProvider: mocks.disconnectProvider,
+}));
+
+// Sessão fake: injeta userId
+vi.mock("../../../src/middleware/requireAuth", () => ({
+ requireAuth: (req: any, _res: any, next: any) => {
+ req.session = { userId: "user-A" };
+ next();
+ },
+}));
+
+import { errorHandler } from "../../../src/middleware/errorHandler";
+import { ConnectionsController } from "../../../src/modules/auth/connections.controller";
+import { requireAuth } from "../../../src/middleware/requireAuth";
+
+function buildApp() {
+ const app = express();
+ app.use(express.json());
+ const controller = new ConnectionsController();
+ app.get("/auth/connections", requireAuth, (req, res, next) =>
+ controller.list(req, res).catch(next),
+ );
+ app.delete("/auth/connections/:provider", requireAuth, (req, res, next) =>
+ controller.disconnect(req, res).catch(next),
+ );
+ app.use(errorHandler);
+ return app;
+}
+
+beforeEach(() => {
+ vi.clearAllMocks();
+});
+
+describe("connections routes", () => {
+ it("GET /auth/connections retorna status", async () => {
+ mocks.listUserConnections.mockResolvedValue({
+ hasPassword: false,
+ connections: [{ provider: "google", connected: true, connectedAt: null }],
+ });
+ const res = await request(buildApp()).get("/auth/connections");
+ expect(res.status).toBe(200);
+ expect(res.body.connections[0].provider).toBe("google");
+ });
+
+ it("DELETE /auth/connections/:provider retorna 200", async () => {
+ mocks.disconnectProvider.mockResolvedValue(undefined);
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(200);
+ expect(mocks.disconnectProvider).toHaveBeenCalledWith({
+ userId: "user-A",
+ provider: "google",
+ });
+ });
+
+ it("DELETE responde 409 no último método", async () => {
+ mocks.disconnectProvider.mockRejectedValue(
+ AppError.conflict("Não é possível desconectar seu último método de login."),
+ );
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(409);
+ expect(res.body.code).toBe("CONFLICT");
+ });
+
+ it("DELETE responde 400 para provider não suportado", async () => {
+ const res = await request(buildApp()).delete("/auth/connections/facebook");
+ expect(res.status).toBe(400);
+ expect(res.body.code).toBe("VALIDATION_ERROR");
+ expect(mocks.disconnectProvider).not.toHaveBeenCalled();
+ });
+});

backend/src/modules/auth/auth.controller.ts

@@ -1,7 +1,9 @@
 import { randomBytes } from "crypto";
 import { Request, Response } from "express";
+import { AppError } from "../../lib/errors.js";
 import type { OAuthProvider } from "../types/auth.types.js";
 import { AuthCallbackParamsSchema } from "../types/auth.types.js";
+import { linkProviderToUser } from "../users/functions/linkProviderToUser.js";
 import { AuthService } from "./auth.service.js";
 
 export class AuthController {
@@ -12,6 +14,13 @@ export class AuthController {
  const state = randomBytes(16).toString("hex");
 
  (req.session as { oauth_state?: string }).oauth_state = state;
+
+ if (req.query.intent === "link" && req.session.userId) {
+ (req.session as { oauth_intent?: string }).oauth_intent = "link";
+ } else {
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+ }
+
  await req.session.save();
 
  const url = await this.authService.getAuthUrl(provider, state);
@@ -43,6 +52,33 @@ export class AuthController {
 
  delete (req.session as { oauth_state?: string }).oauth_state;
 
+ const intent = (req.session as { oauth_intent?: string }).oauth_intent;
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+
+ if (intent === "link" && req.session.userId) {
+ try {
+ const profile = await this.authService.getProfileFromProvider({
+ ...params,
+ callbackUrl,
+ });
+ await linkProviderToUser({
+ userId: req.session.userId,
+ provider: params.provider,
+ profile,
+ });
+ await req.session.save();
+ return res.redirect(
+ `${frontendUrl}/perfil?linked=${params.provider}`,
+ );
+ } catch (linkError) {
+ const code =
+ linkError instanceof AppError && linkError.code === "CONFLICT"
+ ? "provider_already_linked"
+ : "link_failed";
+ return res.redirect(`${frontendUrl}/perfil?error=${code}`);
+ }
+ }
+
  const result = await this.authService.handleCallback({
  ...params,
  callbackUrl,

backend/src/modules/auth/connections.controller.ts

@@ -0,0 +1,28 @@
+// backend/src/modules/auth/connections.controller.ts
+import { Request, Response } from "express";
+import { AppError } from "../../lib/errors";
+import { disconnectProvider } from "../users/functions/disconnectProvider";
+import {
+ listUserConnections,
+ SUPPORTED_PROVIDERS,
+} from "../users/functions/listUserConnections";
+
+export class ConnectionsController {
+ async list(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const result = await listUserConnections(userId);
+ return res.json(result);
+ }
+
+ async disconnect(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const provider = req.params.provider;
+
+ if (!(SUPPORTED_PROVIDERS as readonly string[]).includes(provider)) {
+ throw AppError.validation("Provider inválido.");
+ }
+
+ await disconnectProvider({ userId, provider });
+ return res.json({ ok: true });
+ }
+}

backend/src/modules/users/functions/disconnectProvider.ts

@@ -0,0 +1,48 @@
+import { and, eq } from "drizzle-orm";
+import { db } from "../../../db/client";
+import { accounts } from "../../../db/schema";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+
+type DisconnectParams = { userId: string; provider: string };
+
+async function runDisconnect(
+ { userId, provider }: DisconnectParams,
+ tx: DB,
+): Promise<void> {
+ const userAccounts = await tx
+ .select()
+ .from(accounts)
+ .where(eq(accounts.userId, userId))
+ .for("update");
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const remainingProviders = new Set(
+ userAccounts.map((a) => a.provider).filter((p) => p !== provider),
+ );
+
+ const methodsAfter = remainingProviders.size + (hasPassword ? 1 : 0);
+
+ if (methodsAfter === 0) {
+ throw AppError.conflict(
+ "Não é possível desconectar seu último método de login.",
+ );
+ }
+
+ await tx
+ .delete(accounts)
+ .where(and(eq(accounts.userId, userId), eq(accounts.provider, provider)));
+}
+
+export async function disconnectProvider(
+ params: DisconnectParams,
+ tx?: DB,
+): Promise<void> {
+ if (tx) return runDisconnect(params, tx);
+ return db.transaction((t) => runDisconnect(params, t as unknown as DB));
+}

backend/src/modules/users/functions/linkProviderToUser.ts

@@ -0,0 +1,28 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+import { OAuthProfile } from "../../types/auth.types";
+import { createAccount } from "./createAccount";
+
+type LinkProviderParams = {
+ userId: string;
+ provider: string;
+ profile: OAuthProfile;
+};
+
+export async function linkProviderToUser(
+ { userId, provider, profile }: LinkProviderParams,
+ tx: DB = db,
+): Promise<void> {
+ const existingAccount = await tx.query.accounts.findFirst({
+ where: (acc, { eq, and }) =>
+ and(eq(acc.provider, provider), eq(acc.providerAccountId, profile.id)),
+ });
+
+ if (existingAccount) {
+ if (existingAccount.userId === userId) return;
+ throw AppError.conflict("Essa conta já está vinculada a outro usuário.");
+ }
+
+ await createAccount({ userId, provider, profile }, tx);
+}

backend/src/modules/users/functions/listUserConnections.ts

@@ -0,0 +1,42 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+
+export const SUPPORTED_PROVIDERS = ["google", "linkedin", "github"] as const;
+export type SupportedProvider = (typeof SUPPORTED_PROVIDERS)[number];
+
+export type ConnectionStatus = {
+ provider: SupportedProvider;
+ connected: boolean;
+ connectedAt: Date | null;
+};
+
+export type UserConnections = {
+ hasPassword: boolean;
+ connections: ConnectionStatus[];
+};
+
+export async function listUserConnections(
+ userId: string,
+ tx: DB = db,
+): Promise<UserConnections> {
+ const userAccounts = await tx.query.accounts.findMany({
+ where: (acc, { eq }) => eq(acc.userId, userId),
+ });
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const connections: ConnectionStatus[] = SUPPORTED_PROVIDERS.map((provider) => {
+ const account = userAccounts.find((a) => a.provider === provider);
+ return {
+ provider,
+ connected: Boolean(account),
+ connectedAt: account?.createdAt ?? null,
+ };
+ });
+
+ return { hasPassword, connections };
+}

backend/src/routes/auth.routes.ts

@@ -4,9 +4,11 @@ import {
  authAccountRateLimiter,
  authIpRateLimiter,
 } from "../middleware/rateLimit";
+import { requireAuth } from "../middleware/requireAuth";
 import { validate } from "../middleware/validate";
 import { AuthController } from "../modules/auth/auth.controller";
 import { AuthService } from "../modules/auth/auth.service";
+import { ConnectionsController } from "../modules/auth/connections.controller";
 import { CredentialsController } from "../modules/auth/credentials.controller";
 import { CredentialsService } from "../modules/auth/credentials.service";
 import { OAuthProviderSchema } from "../modules/types/auth.types";
@@ -21,6 +23,7 @@ const authService = new AuthService();
 const authController = new AuthController(authService);
 const credentialsService = new CredentialsService();
 const credentialsController = new CredentialsController(credentialsService);
+const connectionsController = new ConnectionsController();
 
 const providerParamsSchema = z.object({
  provider: OAuthProviderSchema,
@@ -38,6 +41,14 @@ router.get("/:provider/callback", (req, res, next) => {
  authController.callback(req, res).catch(next);
 });
 
+// Connections (usuário logado)
+router.get("/connections", requireAuth, (req, res, next) => {
+ connectionsController.list(req, res).catch(next);
+});
+router.delete("/connections/:provider", requireAuth, (req, res, next) => {
+ connectionsController.disconnect(req, res).catch(next);
+});
+
 // Credentials
 router.post(
  "/register",

backend/tests/integration/routes/connections.routes.test.ts

@@ -0,0 +1,87 @@
+// backend/tests/integration/routes/connections.routes.test.ts
+import express from "express";
+import request from "supertest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { AppError } from "../../../src/lib/errors";
+
+const mocks = vi.hoisted(() => ({
+ listUserConnections: vi.fn(),
+ disconnectProvider: vi.fn(),
+}));
+
+vi.mock("../../../src/modules/users/functions/listUserConnections", () => ({
+ listUserConnections: mocks.listUserConnections,
+ SUPPORTED_PROVIDERS: ["google", "linkedin", "github"],
+}));
+
+vi.mock("../../../src/modules/users/functions/disconnectProvider", () => ({
+ disconnectProvider: mocks.disconnectProvider,
+}));
+
+// Sessão fake: injeta userId
+vi.mock("../../../src/middleware/requireAuth", () => ({
+ requireAuth: (req: any, _res: any, next: any) => {
+ req.session = { userId: "user-A" };
+ next();
+ },
+}));
+
+import { errorHandler } from "../../../src/middleware/errorHandler";
+import { ConnectionsController } from "../../../src/modules/auth/connections.controller";
+import { requireAuth } from "../../../src/middleware/requireAuth";
+
+function buildApp() {
+ const app = express();
+ app.use(express.json());
+ const controller = new ConnectionsController();
+ app.get("/auth/connections", requireAuth, (req, res, next) =>
+ controller.list(req, res).catch(next),
+ );
+ app.delete("/auth/connections/:provider", requireAuth, (req, res, next) =>
+ controller.disconnect(req, res).catch(next),
+ );
+ app.use(errorHandler);
+ return app;
+}
+
+beforeEach(() => {
+ vi.clearAllMocks();
+});
+
+describe("connections routes", () => {
+ it("GET /auth/connections retorna status", async () => {
+ mocks.listUserConnections.mockResolvedValue({
+ hasPassword: false,
+ connections: [{ provider: "google", connected: true, connectedAt: null }],
+ });
+ const res = await request(buildApp()).get("/auth/connections");
+ expect(res.status).toBe(200);
+ expect(res.body.connections[0].provider).toBe("google");
+ });
+
+ it("DELETE /auth/connections/:provider retorna 200", async () => {
+ mocks.disconnectProvider.mockResolvedValue(undefined);
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(200);
+ expect(mocks.disconnectProvider).toHaveBeenCalledWith({
+ userId: "user-A",
+ provider: "google",
+ });
+ });
+
+ it("DELETE responde 409 no último método", async () => {
+ mocks.disconnectProvider.mockRejectedValue(
+ AppError.conflict("Não é possível desconectar seu último método de login."),
+ );
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(409);
+ expect(res.body.code).toBe("CONFLICT");
+ });
+
+ it("DELETE responde 400 para provider não suportado", async () => {
+ const res = await request(buildApp()).delete("/auth/connections/facebook");
+ expect(res.status).toBe(400);
+ expect(res.body.code).toBe("VALIDATION_ERROR");
+ expect(mocks.disconnectProvider).not.toHaveBeenCalled();
+ });
+});

backend/src/modules/auth/auth.controller.ts

@@ -1,7 +1,9 @@
 import { randomBytes } from "crypto";
 import { Request, Response } from "express";
+import { AppError } from "../../lib/errors.js";
 import type { OAuthProvider } from "../types/auth.types.js";
 import { AuthCallbackParamsSchema } from "../types/auth.types.js";
+import { linkProviderToUser } from "../users/functions/linkProviderToUser.js";
 import { AuthService } from "./auth.service.js";
 
 export class AuthController {
@@ -12,6 +14,13 @@ export class AuthController {
  const state = randomBytes(16).toString("hex");
 
  (req.session as { oauth_state?: string }).oauth_state = state;
+
+ if (req.query.intent === "link" && req.session.userId) {
+ (req.session as { oauth_intent?: string }).oauth_intent = "link";
+ } else {
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+ }
+
  await req.session.save();
 
  const url = await this.authService.getAuthUrl(provider, state);
@@ -43,6 +52,33 @@ export class AuthController {
 
  delete (req.session as { oauth_state?: string }).oauth_state;
 
+ const intent = (req.session as { oauth_intent?: string }).oauth_intent;
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+
+ if (intent === "link" && req.session.userId) {
+ try {
+ const profile = await this.authService.getProfileFromProvider({
+ ...params,
+ callbackUrl,
+ });
+ await linkProviderToUser({
+ userId: req.session.userId,
+ provider: params.provider,
+ profile,
+ });
+ await req.session.save();
+ return res.redirect(
+ `${frontendUrl}/perfil?linked=${params.provider}`,
+ );
+ } catch (linkError) {
+ const code =
+ linkError instanceof AppError && linkError.code === "CONFLICT"
+ ? "provider_already_linked"
+ : "link_failed";
+ return res.redirect(`${frontendUrl}/perfil?error=${code}`);
+ }
+ }
+
  const result = await this.authService.handleCallback({
  ...params,
  callbackUrl,

backend/src/modules/auth/connections.controller.ts

@@ -0,0 +1,28 @@
+// backend/src/modules/auth/connections.controller.ts
+import { Request, Response } from "express";
+import { AppError } from "../../lib/errors";
+import { disconnectProvider } from "../users/functions/disconnectProvider";
+import {
+ listUserConnections,
+ SUPPORTED_PROVIDERS,
+} from "../users/functions/listUserConnections";
+
+export class ConnectionsController {
+ async list(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const result = await listUserConnections(userId);
+ return res.json(result);
+ }
+
+ async disconnect(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const provider = req.params.provider;
+
+ if (!(SUPPORTED_PROVIDERS as readonly string[]).includes(provider)) {
+ throw AppError.validation("Provider inválido.");
+ }
+
+ await disconnectProvider({ userId, provider });
+ return res.json({ ok: true });
+ }
+}

backend/src/modules/users/functions/disconnectProvider.ts

@@ -0,0 +1,48 @@
+import { and, eq } from "drizzle-orm";
+import { db } from "../../../db/client";
+import { accounts } from "../../../db/schema";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+
+type DisconnectParams = { userId: string; provider: string };
+
+async function runDisconnect(
+ { userId, provider }: DisconnectParams,
+ tx: DB,
+): Promise<void> {
+ const userAccounts = await tx
+ .select()
+ .from(accounts)
+ .where(eq(accounts.userId, userId))
+ .for("update");
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const remainingProviders = new Set(
+ userAccounts.map((a) => a.provider).filter((p) => p !== provider),
+ );
+
+ const methodsAfter = remainingProviders.size + (hasPassword ? 1 : 0);
+
+ if (methodsAfter === 0) {
+ throw AppError.conflict(
+ "Não é possível desconectar seu último método de login.",
+ );
+ }
+
+ await tx
+ .delete(accounts)
+ .where(and(eq(accounts.userId, userId), eq(accounts.provider, provider)));
+}
+
+export async function disconnectProvider(
+ params: DisconnectParams,
+ tx?: DB,
+): Promise<void> {
+ if (tx) return runDisconnect(params, tx);
+ return db.transaction((t) => runDisconnect(params, t as unknown as DB));
+}

backend/src/modules/users/functions/linkProviderToUser.ts

@@ -0,0 +1,28 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+import { OAuthProfile } from "../../types/auth.types";
+import { createAccount } from "./createAccount";
+
+type LinkProviderParams = {
+ userId: string;
+ provider: string;
+ profile: OAuthProfile;
+};
+
+export async function linkProviderToUser(
+ { userId, provider, profile }: LinkProviderParams,
+ tx: DB = db,
+): Promise<void> {
+ const existingAccount = await tx.query.accounts.findFirst({
+ where: (acc, { eq, and }) =>
+ and(eq(acc.provider, provider), eq(acc.providerAccountId, profile.id)),
+ });
+
+ if (existingAccount) {
+ if (existingAccount.userId === userId) return;
+ throw AppError.conflict("Essa conta já está vinculada a outro usuário.");
+ }
+
+ await createAccount({ userId, provider, profile }, tx);
+}

backend/src/modules/users/functions/listUserConnections.ts

@@ -0,0 +1,42 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+
+export const SUPPORTED_PROVIDERS = ["google", "linkedin", "github"] as const;
+export type SupportedProvider = (typeof SUPPORTED_PROVIDERS)[number];
+
+export type ConnectionStatus = {
+ provider: SupportedProvider;
+ connected: boolean;
+ connectedAt: Date | null;
+};
+
+export type UserConnections = {
+ hasPassword: boolean;
+ connections: ConnectionStatus[];
+};
+
+export async function listUserConnections(
+ userId: string,
+ tx: DB = db,
+): Promise<UserConnections> {
+ const userAccounts = await tx.query.accounts.findMany({
+ where: (acc, { eq }) => eq(acc.userId, userId),
+ });
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const connections: ConnectionStatus[] = SUPPORTED_PROVIDERS.map((provider) => {
+ const account = userAccounts.find((a) => a.provider === provider);
+ return {
+ provider,
+ connected: Boolean(account),
+ connectedAt: account?.createdAt ?? null,
+ };
+ });
+
+ return { hasPassword, connections };
+}

backend/src/routes/auth.routes.ts

@@ -4,9 +4,11 @@ import {
  authAccountRateLimiter,
  authIpRateLimiter,
 } from "../middleware/rateLimit";
+import { requireAuth } from "../middleware/requireAuth";
 import { validate } from "../middleware/validate";
 import { AuthController } from "../modules/auth/auth.controller";
 import { AuthService } from "../modules/auth/auth.service";
+import { ConnectionsController } from "../modules/auth/connections.controller";
 import { CredentialsController } from "../modules/auth/credentials.controller";
 import { CredentialsService } from "../modules/auth/credentials.service";
 import { OAuthProviderSchema } from "../modules/types/auth.types";
@@ -21,6 +23,7 @@ const authService = new AuthService();
 const authController = new AuthController(authService);
 const credentialsService = new CredentialsService();
 const credentialsController = new CredentialsController(credentialsService);
+const connectionsController = new ConnectionsController();
 
 const providerParamsSchema = z.object({
  provider: OAuthProviderSchema,
@@ -38,6 +41,14 @@ router.get("/:provider/callback", (req, res, next) => {
  authController.callback(req, res).catch(next);
 });
 
+// Connections (usuário logado)
+router.get("/connections", requireAuth, (req, res, next) => {
+ connectionsController.list(req, res).catch(next);
+});
+router.delete("/connections/:provider", requireAuth, (req, res, next) => {
+ connectionsController.disconnect(req, res).catch(next);
+});
+
 // Credentials
 router.post(
  "/register",

backend/tests/integration/routes/connections.routes.test.ts

@@ -0,0 +1,87 @@
+// backend/tests/integration/routes/connections.routes.test.ts
+import express from "express";
+import request from "supertest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { AppError } from "../../../src/lib/errors";
+
+const mocks = vi.hoisted(() => ({
+ listUserConnections: vi.fn(),
+ disconnectProvider: vi.fn(),
+}));
+
+vi.mock("../../../src/modules/users/functions/listUserConnections", () => ({
+ listUserConnections: mocks.listUserConnections,
+ SUPPORTED_PROVIDERS: ["google", "linkedin", "github"],
+}));
+
+vi.mock("../../../src/modules/users/functions/disconnectProvider", () => ({
+ disconnectProvider: mocks.disconnectProvider,
+}));
+
+// Sessão fake: injeta userId
+vi.mock("../../../src/middleware/requireAuth", () => ({
+ requireAuth: (req: any, _res: any, next: any) => {
+ req.session = { userId: "user-A" };
+ next();
+ },
+}));
+
+import { errorHandler } from "../../../src/middleware/errorHandler";
+import { ConnectionsController } from "../../../src/modules/auth/connections.controller";
+import { requireAuth } from "../../../src/middleware/requireAuth";
+
+function buildApp() {
+ const app = express();
+ app.use(express.json());
+ const controller = new ConnectionsController();
+ app.get("/auth/connections", requireAuth, (req, res, next) =>
+ controller.list(req, res).catch(next),
+ );
+ app.delete("/auth/connections/:provider", requireAuth, (req, res, next) =>
+ controller.disconnect(req, res).catch(next),
+ );
+ app.use(errorHandler);
+ return app;
+}
+
+beforeEach(() => {
+ vi.clearAllMocks();
+});
+
+describe("connections routes", () => {
+ it("GET /auth/connections retorna status", async () => {
+ mocks.listUserConnections.mockResolvedValue({
+ hasPassword: false,
+ connections: [{ provider: "google", connected: true, connectedAt: null }],
+ });
+ const res = await request(buildApp()).get("/auth/connections");
+ expect(res.status).toBe(200);
+ expect(res.body.connections[0].provider).toBe("google");
+ });
+
+ it("DELETE /auth/connections/:provider retorna 200", async () => {
+ mocks.disconnectProvider.mockResolvedValue(undefined);
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(200);
+ expect(mocks.disconnectProvider).toHaveBeenCalledWith({
+ userId: "user-A",
+ provider: "google",
+ });
+ });
+
+ it("DELETE responde 409 no último método", async () => {
+ mocks.disconnectProvider.mockRejectedValue(
+ AppError.conflict("Não é possível desconectar seu último método de login."),
+ );
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(409);
+ expect(res.body.code).toBe("CONFLICT");
+ });
+
+ it("DELETE responde 400 para provider não suportado", async () => {
+ const res = await request(buildApp()).delete("/auth/connections/facebook");
+ expect(res.status).toBe(400);
+ expect(res.body.code).toBe("VALIDATION_ERROR");
+ expect(mocks.disconnectProvider).not.toHaveBeenCalled();
+ });
+});

backend/src/modules/auth/auth.controller.ts

@@ -1,7 +1,9 @@
 import { randomBytes } from "crypto";
 import { Request, Response } from "express";
+import { AppError } from "../../lib/errors.js";
 import type { OAuthProvider } from "../types/auth.types.js";
 import { AuthCallbackParamsSchema } from "../types/auth.types.js";
+import { linkProviderToUser } from "../users/functions/linkProviderToUser.js";
 import { AuthService } from "./auth.service.js";
 
 export class AuthController {
@@ -12,6 +14,13 @@ export class AuthController {
  const state = randomBytes(16).toString("hex");
 
  (req.session as { oauth_state?: string }).oauth_state = state;
+
+ if (req.query.intent === "link" && req.session.userId) {
+ (req.session as { oauth_intent?: string }).oauth_intent = "link";
+ } else {
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+ }
+
  await req.session.save();
 
  const url = await this.authService.getAuthUrl(provider, state);
@@ -43,6 +52,33 @@ export class AuthController {
 
  delete (req.session as { oauth_state?: string }).oauth_state;
 
+ const intent = (req.session as { oauth_intent?: string }).oauth_intent;
+ delete (req.session as { oauth_intent?: string }).oauth_intent;
+
+ if (intent === "link" && req.session.userId) {
+ try {
+ const profile = await this.authService.getProfileFromProvider({
+ ...params,
+ callbackUrl,
+ });
+ await linkProviderToUser({
+ userId: req.session.userId,
+ provider: params.provider,
+ profile,
+ });
+ await req.session.save();
+ return res.redirect(
+ `${frontendUrl}/perfil?linked=${params.provider}`,
+ );
+ } catch (linkError) {
+ const code =
+ linkError instanceof AppError && linkError.code === "CONFLICT"
+ ? "provider_already_linked"
+ : "link_failed";
+ return res.redirect(`${frontendUrl}/perfil?error=${code}`);
+ }
+ }
+
  const result = await this.authService.handleCallback({
  ...params,
  callbackUrl,

backend/src/modules/auth/connections.controller.ts

@@ -0,0 +1,28 @@
+// backend/src/modules/auth/connections.controller.ts
+import { Request, Response } from "express";
+import { AppError } from "../../lib/errors";
+import { disconnectProvider } from "../users/functions/disconnectProvider";
+import {
+ listUserConnections,
+ SUPPORTED_PROVIDERS,
+} from "../users/functions/listUserConnections";
+
+export class ConnectionsController {
+ async list(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const result = await listUserConnections(userId);
+ return res.json(result);
+ }
+
+ async disconnect(req: Request, res: Response) {
+ const userId = req.session.userId as string;
+ const provider = req.params.provider;
+
+ if (!(SUPPORTED_PROVIDERS as readonly string[]).includes(provider)) {
+ throw AppError.validation("Provider inválido.");
+ }
+
+ await disconnectProvider({ userId, provider });
+ return res.json({ ok: true });
+ }
+}

backend/src/modules/users/functions/disconnectProvider.ts

@@ -0,0 +1,48 @@
+import { and, eq } from "drizzle-orm";
+import { db } from "../../../db/client";
+import { accounts } from "../../../db/schema";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+
+type DisconnectParams = { userId: string; provider: string };
+
+async function runDisconnect(
+ { userId, provider }: DisconnectParams,
+ tx: DB,
+): Promise<void> {
+ const userAccounts = await tx
+ .select()
+ .from(accounts)
+ .where(eq(accounts.userId, userId))
+ .for("update");
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const remainingProviders = new Set(
+ userAccounts.map((a) => a.provider).filter((p) => p !== provider),
+ );
+
+ const methodsAfter = remainingProviders.size + (hasPassword ? 1 : 0);
+
+ if (methodsAfter === 0) {
+ throw AppError.conflict(
+ "Não é possível desconectar seu último método de login.",
+ );
+ }
+
+ await tx
+ .delete(accounts)
+ .where(and(eq(accounts.userId, userId), eq(accounts.provider, provider)));
+}
+
+export async function disconnectProvider(
+ params: DisconnectParams,
+ tx?: DB,
+): Promise<void> {
+ if (tx) return runDisconnect(params, tx);
+ return db.transaction((t) => runDisconnect(params, t as unknown as DB));
+}

backend/src/modules/users/functions/linkProviderToUser.ts

@@ -0,0 +1,28 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+import { AppError } from "../../../lib/errors";
+import { OAuthProfile } from "../../types/auth.types";
+import { createAccount } from "./createAccount";
+
+type LinkProviderParams = {
+ userId: string;
+ provider: string;
+ profile: OAuthProfile;
+};
+
+export async function linkProviderToUser(
+ { userId, provider, profile }: LinkProviderParams,
+ tx: DB = db,
+): Promise<void> {
+ const existingAccount = await tx.query.accounts.findFirst({
+ where: (acc, { eq, and }) =>
+ and(eq(acc.provider, provider), eq(acc.providerAccountId, profile.id)),
+ });
+
+ if (existingAccount) {
+ if (existingAccount.userId === userId) return;
+ throw AppError.conflict("Essa conta já está vinculada a outro usuário.");
+ }
+
+ await createAccount({ userId, provider, profile }, tx);
+}

backend/src/modules/users/functions/listUserConnections.ts

@@ -0,0 +1,42 @@
+import { db } from "../../../db/client";
+import { DB } from "../../../db/types/types";
+
+export const SUPPORTED_PROVIDERS = ["google", "linkedin", "github"] as const;
+export type SupportedProvider = (typeof SUPPORTED_PROVIDERS)[number];
+
+export type ConnectionStatus = {
+ provider: SupportedProvider;
+ connected: boolean;
+ connectedAt: Date | null;
+};
+
+export type UserConnections = {
+ hasPassword: boolean;
+ connections: ConnectionStatus[];
+};
+
+export async function listUserConnections(
+ userId: string,
+ tx: DB = db,
+): Promise<UserConnections> {
+ const userAccounts = await tx.query.accounts.findMany({
+ where: (acc, { eq }) => eq(acc.userId, userId),
+ });
+
+ const hasPassword = Boolean(
+ await tx.query.credentials.findFirst({
+ where: (c, { eq }) => eq(c.userId, userId),
+ }),
+ );
+
+ const connections: ConnectionStatus[] = SUPPORTED_PROVIDERS.map((provider) => {
+ const account = userAccounts.find((a) => a.provider === provider);
+ return {
+ provider,
+ connected: Boolean(account),
+ connectedAt: account?.createdAt ?? null,
+ };
+ });
+
+ return { hasPassword, connections };
+}

backend/src/routes/auth.routes.ts

@@ -4,9 +4,11 @@ import {
  authAccountRateLimiter,
  authIpRateLimiter,
 } from "../middleware/rateLimit";
+import { requireAuth } from "../middleware/requireAuth";
 import { validate } from "../middleware/validate";
 import { AuthController } from "../modules/auth/auth.controller";
 import { AuthService } from "../modules/auth/auth.service";
+import { ConnectionsController } from "../modules/auth/connections.controller";
 import { CredentialsController } from "../modules/auth/credentials.controller";
 import { CredentialsService } from "../modules/auth/credentials.service";
 import { OAuthProviderSchema } from "../modules/types/auth.types";
@@ -21,6 +23,7 @@ const authService = new AuthService();
 const authController = new AuthController(authService);
 const credentialsService = new CredentialsService();
 const credentialsController = new CredentialsController(credentialsService);
+const connectionsController = new ConnectionsController();
 
 const providerParamsSchema = z.object({
  provider: OAuthProviderSchema,
@@ -38,6 +41,14 @@ router.get("/:provider/callback", (req, res, next) => {
  authController.callback(req, res).catch(next);
 });
 
+// Connections (usuário logado)
+router.get("/connections", requireAuth, (req, res, next) => {
+ connectionsController.list(req, res).catch(next);
+});
+router.delete("/connections/:provider", requireAuth, (req, res, next) => {
+ connectionsController.disconnect(req, res).catch(next);
+});
+
 // Credentials
 router.post(
  "/register",

backend/tests/integration/routes/connections.routes.test.ts

@@ -0,0 +1,87 @@
+// backend/tests/integration/routes/connections.routes.test.ts
+import express from "express";
+import request from "supertest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { AppError } from "../../../src/lib/errors";
+
+const mocks = vi.hoisted(() => ({
+ listUserConnections: vi.fn(),
+ disconnectProvider: vi.fn(),
+}));
+
+vi.mock("../../../src/modules/users/functions/listUserConnections", () => ({
+ listUserConnections: mocks.listUserConnections,
+ SUPPORTED_PROVIDERS: ["google", "linkedin", "github"],
+}));
+
+vi.mock("../../../src/modules/users/functions/disconnectProvider", () => ({
+ disconnectProvider: mocks.disconnectProvider,
+}));
+
+// Sessão fake: injeta userId
+vi.mock("../../../src/middleware/requireAuth", () => ({
+ requireAuth: (req: any, _res: any, next: any) => {
+ req.session = { userId: "user-A" };
+ next();
+ },
+}));
+
+import { errorHandler } from "../../../src/middleware/errorHandler";
+import { ConnectionsController } from "../../../src/modules/auth/connections.controller";
+import { requireAuth } from "../../../src/middleware/requireAuth";
+
+function buildApp() {
+ const app = express();
+ app.use(express.json());
+ const controller = new ConnectionsController();
+ app.get("/auth/connections", requireAuth, (req, res, next) =>
+ controller.list(req, res).catch(next),
+ );
+ app.delete("/auth/connections/:provider", requireAuth, (req, res, next) =>
+ controller.disconnect(req, res).catch(next),
+ );
+ app.use(errorHandler);
+ return app;
+}
+
+beforeEach(() => {
+ vi.clearAllMocks();
+});
+
+describe("connections routes", () => {
+ it("GET /auth/connections retorna status", async () => {
+ mocks.listUserConnections.mockResolvedValue({
+ hasPassword: false,
+ connections: [{ provider: "google", connected: true, connectedAt: null }],
+ });
+ const res = await request(buildApp()).get("/auth/connections");
+ expect(res.status).toBe(200);
+ expect(res.body.connections[0].provider).toBe("google");
+ });
+
+ it("DELETE /auth/connections/:provider retorna 200", async () => {
+ mocks.disconnectProvider.mockResolvedValue(undefined);
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(200);
+ expect(mocks.disconnectProvider).toHaveBeenCalledWith({
+ userId: "user-A",
+ provider: "google",
+ });
+ });
+
+ it("DELETE responde 409 no último método", async () => {
+ mocks.disconnectProvider.mockRejectedValue(
+ AppError.conflict("Não é possível desconectar seu último método de login."),
+ );
+ const res = await request(buildApp()).delete("/auth/connections/google");
+ expect(res.status).toBe(409);
+ expect(res.body.code).toBe("CONFLICT");
+ });
+
+ it("DELETE responde 400 para provider não suportado", async () => {
+ const res = await request(buildApp()).delete("/auth/connections/facebook");
+ expect(res.status).toBe(400);
+ expect(res.body.code).toBe("VALIDATION_ERROR");
+ expect(mocks.disconnectProvider).not.toHaveBeenCalled();
+ });
+});