feat: add manual linking APIs

[kangmingtay]

What kind of change does this PR introduce?

• Adds a new endpoint GET /user/identities/authorize which is an endpoint to initiate the manual linking process and can only be invoked if the user is authenticated
• GET /user/identities/authorize functions similarly to GET /authorize where the user needs to login to the new oauth identity in order to link the identity
• Example

// sign in with one of the supported auth methods to get the user's access token JWT first

// start the identity linking process
$ curl -X GET "http://localhost:9999/user/identities/authorize?provider=google" -H "Authorization: Bearer ACCESS_TOKEN_JWT"

{"url":"https://oauth_provider_url.com/path/to/sign-in"}

// visit the url returned and login to the oauth provider 
// request will be redirected to the /callback endpoint

// if the identity is successfully linked, the request will be redirected to `http://localhost:3000/#access_token=xxx&....`

// if the identity already exists, the request will be redirect to:
// http://localhost:3000/?error=invalid_request&error_code=400&error_description=Identity+is+already+linked+to+another+user#error=invalid_request&error_code=400&error_description=Identity+is+already+linked+to+another+user

Details

• The callback endpoint used will be the same callback as the oauth sign-in flow so that the developer doesn't have to add any additional callback URLs to the oauth provider in order to enable manual linking
• A special field LinkingTargetId is introduced in the oauth state to store the linking target user ID. This ID will be used in the callback to determine the target user to link the candidate identity used
• If the identity is already linked to the current user or another user, an error will be returned
• If the identity doesn't exist, then it will be successfully linked to the existing user and a new access & refresh token will be issued.

[hf]

Would appreciate at least one test to exercise linkIdentityToUser which can be tested in isolation, no need for a whole request-response setup.

[hf]

Yes!

[github-actions]

🎉 This PR is included in version 2.121.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[mosnicholas]

Is it possible to test this locally? It doesn't seem as though any set of env variables or config.toml changes enable us to :(

[johndpope]

i upgrade api to allow link by oicd token - #1885

would be good to be able to test locally - was there any feedback on @mosnicholas 's concerns.

UPDATE
digging through tests in internal
they're using localhost to test a bunch of socials -
still pulling this apart.

req := httptest.NewRequest(http.MethodGet, "http://localhost/authorize?provider=linkedin", nil)

UPDATE 2

@mosnicholas - I'm attempting to create local dev using this

dockercompose.yml

  auth:
    container_name: supabase-auth
#    image: supabase/gotrue:v2.164.0
    image: auth:local  

git clone https://www.github.com/johndpope/auth 
cd auth
docker build -t auth:local -f Dockerfile

back in supabase

docker compose up auth --remove-orphans