Move browser authentication to HCA OIDC

[skyfallwastaken]

Summary of the problem

Hackatime currently has separate HCA, Slack and email sign-in paths. Their email and Slack claims can drift, which makes automatic legacy account matching unsafe and leaves Hackatime responsible for more authentication code than necessary.

Describe your changes

• Makes HCA OpenID Connect through OmniAuth the only normal browser sign-in authority, with state, nonce and S256 PKCE plus verified RS256 ID tokens.
• Uses the HCA subject as the durable identity. Known subjects remain authoritative while unknown subjects are linked conservatively by verified email or Slack ID. Split claims are denied and recorded for support instead of being merged.
• Replaces standalone email links with an HCA login_hint. Slack OAuth is limited to legacy recovery or reauthorisation after a recent HCA sign-in and cannot switch the signed-in user.
• Adds one-use, same-browser email recovery for legacy accounts and explicit account creation when no safe match exists.
• Invalidates pre-cutover browser sessions, prevents anonymised accounts from using browser or API credentials and closes deletion races that could restore identity data.
• Stops persisting HCA provider tokens and clears stored HCA credentials in bounded migration batches.
• Adds database uniqueness for HCA subjects and normalised emails. A read-only production preflight found no duplicate HCA subjects or case-insensitive email groups.

Production identity audit

A read-only current-claim audit checked all 31,784 stored HCA credentials. Of 26,905 valid credentials, 46 distinct HCA identities had a cross-provider ownership conflict. The remaining 4,879 credentials were invalid or expired and could not be checked. No individual identity data or credentials were retained.

Rollout blockers

Do not merge or deploy this PR until all of the following are complete:

1. HCA must add the Doorkeeper PKCE columns and verify that an S256 authorisation code cannot be redeemed without the correct verifier. Hackatime sends PKCE correctly, but HCA does not currently enforce it.
2. Production must have HCA_CLIENT_ID, HCA_CLIENT_SECRET and either HCA_REDIRECT_URI or PUBLIC_URL configured. The registered callback must be /auth/hca/callback on the production origin.
3. The cutover must drain the old web and worker processes before migrations and credential cleanup run, then start only the new release. This prevents old code from writing HCA tokens again during a rolling deployment.
4. The 46 observed conflicting identities need access-controlled review, resolution or an assigned support owner. Runtime conflict detection and recovery support must remain because 4,879 identities were uncheckable.
5. The three elevated legacy users without HCA subjects need manual review and onboarding. They are intentionally excluded from automatic recovery.

Screenshots / Media

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	gem/​omniauth@​2.1.4
	gem/​omniauth_openid_connect@​0.8.0
	gem/​omniauth-rails_csrf_protection@​1.0.2

View full report