From db8a38206e2d3f03653a6b6839913f668a86e185 Mon Sep 17 00:00:00 2001
From: Enes Uysal <hulkienesuysal@gmail.com>
Date: Wed, 12 Aug 2026 16:30:53 +0300
Subject: [PATCH 1/2] feat(acp): add option to never match accounts by email
 address

A verified address is matched against existing users, so a second
provider sharing it joins the first account instead of registering its
own. Some forums want one account per provider.
---
 lib/controllers.js                                 |  2 +-
 library.js                                         |  4 ++--
 static/templates/partials/edit-oauth2-strategy.tpl | 11 +++++++++++
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/lib/controllers.js b/lib/controllers.js
index a9c81fc..e7259d2 100644
--- a/lib/controllers.js
+++ b/lib/controllers.js
@@ -74,7 +74,7 @@ Controllers.editStrategy = async (req, res) => {
 
 	payload.enabled = !!req.body.enabled;
 
-	const checkboxes = ['forceUsernameViaEmail', 'usernameViaEmail', 'trustEmailVerified', 'syncFullname', 'syncPicture'];
+	const checkboxes = ['forceUsernameViaEmail', 'usernameViaEmail', 'trustEmailVerified', 'disableEmailFallback', 'syncFullname', 'syncPicture'];
 	checkboxes.forEach((prop) => {
 		payload[prop] = payload.hasOwnProperty(prop) && payload[prop] === 'on' ? 1 : 0;
 	});
diff --git a/library.js b/library.js
index 961bb15..6e8fc3d 100644
--- a/library.js
+++ b/library.js
@@ -218,7 +218,7 @@ OAuth.login = async (payload) => {
 		return ({ uid });
 	}
 
-	const { trustEmailVerified } = await OAuth.getStrategy(payload.name);
+	const { trustEmailVerified, disableEmailFallback } = await OAuth.getStrategy(payload.name);
 	const { email } = payload;
 	const email_verified =
 		parseInt(trustEmailVerified, 10) &&
@@ -226,7 +226,7 @@ OAuth.login = async (payload) => {
 
 
 	// Check for user via email fallback
-	if (email && email_verified) {
+	if (email && email_verified && !parseInt(disableEmailFallback, 10)) {
 		uid = await user.getUidByEmail(payload.email);
 	}
 
diff --git a/static/templates/partials/edit-oauth2-strategy.tpl b/static/templates/partials/edit-oauth2-strategy.tpl
index dcc4f65..3650d31 100644
--- a/static/templates/partials/edit-oauth2-strategy.tpl
+++ b/static/templates/partials/edit-oauth2-strategy.tpl
@@ -121,6 +121,17 @@
 							<label for="trustEmailVerified" class="form-check-label">Automatically confirm emails when <code>email_verified</code> is true.</code></label>
 						</div>
 
+						<div class="form-check form-switch mb-3">
+							<input type="checkbox" class="form-check-input" id="disableEmailFallback" name="disableEmailFallback" {{{ if (./disableEmailFallback == "1") }}}checked{{{ end }}}>
+							<label for="disableEmailFallback" class="form-check-label">
+								Never attach this provider to an existing account that shares its email address
+								<p class="form-text">
+									A verified address is normally matched against existing users, so signing in with a
+									second provider joins the account already using that address.
+								</p>
+							</label>
+						</div>
+
 						<div class="mb-3">
 							<label class="form-label" for="idKey">Alternative <code>id</code> key</label>
 							<input type="text" id="idKey" name="idKey" title="Alternative id key" class="form-control" placeholder="e.g. auth0Id" value="{./idKey}">

From 589ba75238b5cef938f1e0534334573052a27eb0 Mon Sep 17 00:00:00 2001
From: Enes Uysal <hulkienesuysal@gmail.com>
Date: Wed, 12 Aug 2026 16:47:37 +0300
Subject: [PATCH 2/2] fix(login): do not abandon a new account when
 confirmation fails

NodeBB refuses to confirm an address that another uid already holds
confirmed, so with the email fallback disabled the registration threw
after user.create, leaving an account with no provider association and
no way to sign into it.
---
 library.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/library.js b/library.js
index 6e8fc3d..d3e7fe9 100644
--- a/library.js
+++ b/library.js
@@ -241,7 +241,11 @@ OAuth.login = async (payload) => {
 			await user.setUserField(uid, 'email', email);
 
 			if (email_verified) {
-				await user.email.confirmByUid(uid);
+				try {
+					await user.email.confirmByUid(uid);
+				} catch (err) {
+					winston.warn(`[plugin/sso-oauth2-multiple] Could not confirm ${email} for uid ${uid}: ${err.message}`);
+				}
 			}
 		}
 	}