identity-and-accountslisted

# Identity, OAuth and the account lifecycle **Read [`references/IDENTITY-AND-ACCOUNTS.md`](references/IDENTITY-AND-ACCOUNTS.md) before applying any of this.** That file is the standard; everything below it is a summary to help you decide whether this skill applies and to check your work afterwards. Reference-architecture principles: P5. ## What this standard covers - Claims are enriched at issuance - Refresh tokens - OAuth providers - Account linking - Enumeration safety - Lockout - Transactional email - Account deletion - Versioned legal consent - Key material ## Failure modes | Symptom | Cause | |---|---| | Provider error `redirect_uri_mismatch` | Callback built from an internal `Request.Host`; set the public callback base URL | | OAuth callback 404s | Provider registered with the controller's route instead of the middleware's `/signin-*` path | | Two accounts for one person | Link-by-email flow missing; first external sign-in created a duplicate | | Password reset reveals which emails exist | Branches return different messages/timing; unify to the generic 200 | | Sessions survive password reset | Refresh revocation not wired to the reset path | | Support tickets: "locked out forever" | Lockout shipped without the admin unlock endpoint | | Invitation email storms | No attempt log/cooldown; resend button wired straight to the sender | | "Deleted" user's files still downloadable | Blob cleanup missing from the reaper; cascade never reaches object storage | | Users never