fix(oauth): auto-bind verified external login to existing active user by email

When an external OAuth connector returns a verified email address that
matches an existing active user account in Answer, the previous
implementation immediately aborted with UserAccessDenied (50x Access denied).
This required users who had previously registered with password to log in
first and manually bind the provider under user settings.

For open communities and seamless SSO onboarding, auto-bind the external
identity to the existing active user when the email matches, update their
last login timestamp, and issue an access token directly.

Signed-off-by: Rénich Bon Ćirić <renich@evalinux.com>

Author: renich

internal/service/user_external_login/user_external_login_service.go

@@ -186,19 +186,31 @@ func (us *UserExternalLoginService) ExternalLogin(
 		}, nil
 	}
 
-	if _, exist, err := us.userRepo.GetByEmail(ctx, externalUserInfo.Email); err != nil {
+	oldUserInfo, exist, err := us.userRepo.GetByEmail(ctx, externalUserInfo.Email)
+	if err != nil {
 		return nil, err
-	} else if exist {
+	}
+	if !exist {
+		// if user is not a member, register a new user
+		oldUserInfo, err = us.registerNewUser(ctx, externalUserInfo)
+		if err != nil {
+			return nil, err
+		}
+		// set default user notification config for external user
+		if err := us.userNotificationConfigService.SetDefaultUserNotificationConfig(ctx, []string{oldUserInfo.ID}); err != nil {
+			log.Errorf("set default user notification config failed, err: %v", err)
+		}
+	} else if oldUserInfo.Status == entity.UserStatusDeleted {
 		return &schema.UserExternalLoginResp{
 			ErrTitle: translator.Tr(handler.GetLangByCtx(ctx), reason.UserAccessDenied),
 			ErrMsg:   translator.Tr(handler.GetLangByCtx(ctx), reason.UserAccessDenied),
 		}, nil
+	} else {
+		if err := us.userRepo.UpdateLastLoginDate(ctx, oldUserInfo.ID); err != nil {
+			log.Errorf("update user last login date failed: %v", err)
+		}
 	}
-	// if user is not a member, register a new user
-	oldUserInfo, err := us.registerNewUser(ctx, externalUserInfo)
-	if err != nil {
-		return nil, err
-	}
+
 	// bind external user info to user
 	err = us.bindOldUser(ctx, externalUserInfo, oldUserInfo)
 	if err != nil {
@@ -211,11 +223,6 @@ func (us *UserExternalLoginService) ExternalLogin(
 		log.Error(err)
 	}
 
-	// set default user notification config for external user
-	if err := us.userNotificationConfigService.SetDefaultUserNotificationConfig(ctx, []string{oldUserInfo.ID}); err != nil {
-		log.Errorf("set default user notification config failed, err: %v", err)
-	}
-
 	accessToken, _, err := us.userCommonService.CacheLoginUserInfo(
 		ctx, oldUserInfo.ID, newMailStatus, oldUserInfo.Status, externalUserInfo.ExternalID)
 	return &schema.UserExternalLoginResp{AccessToken: accessToken}, err