create-nevela 0.9.2 → 0.10.0

package/index.mjs

@@ -739,6 +739,15 @@ async function main() {
     if (fs.existsSync(env) && !/^NEVELA_PROXY_SECRET=/m.test(fs.readFileSync(env, 'utf8'))) {
       fs.appendFileSync(env, `\n# The same value as in apps/web/.env.local.\nNEVELA_PROXY_SECRET=${proxySecret}\n`);
     }
+    // Where to switch on Google and GitHub, and the keys they need, so nobody has to look the names up.
+    if (fs.existsSync(env) && !/^SOCIAL_AUTH_ENABLED=/m.test(fs.readFileSync(env, 'utf8'))) {
+      fs.appendFileSync(
+        env,
+        '\n# Sign in with Google and GitHub: https://nevela-docs.vercel.app/guides/authentication/#google-and-github\n' +
+          '# Off until this is true. A provider shows once both its keys are set.\n' +
+          'SOCIAL_AUTH_ENABLED=false\nGOOGLE_CLIENT_ID=\nGOOGLE_CLIENT_SECRET=\nGITHUB_CLIENT_ID=\nGITHUB_CLIENT_SECRET=\n',
+      );
+    }
     const sqlite = path.join(api, 'database', 'database.sqlite');
     if (/^DB_CONNECTION=sqlite\s*$/m.test(fs.readFileSync(env, 'utf8')) && !fs.existsSync(sqlite)) fs.writeFileSync(sqlite, '');
     return addApiTokens(path.join(api, 'app', 'Models', 'User.php'));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-nevela",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "description": "Create a new Nevela app: a Laravel API and a Next.js dashboard from one resource description.",
   "type": "module",
   "bin": {

package/template/laravel/composer.json

@@ -31,6 +31,7 @@
         "illuminate/database": "^11.17|^12.0|^13.0",
         "illuminate/http": "^11.0|^12.0|^13.0",
         "illuminate/console": "^11.0|^12.0|^13.0",
+        "laravel/socialite": "^5.31",
         "lbuchs/webauthn": "^2.2"
     },
     "require-dev": {

package/template/laravel/config/nevela.php

@@ -54,6 +54,31 @@ return [
         */
         'registration' => (bool) env('NEVELA_REGISTRATION', false),
 
+        /*
+        | Signing in with Google or GitHub (Laravel Socialite). SOCIAL_AUTH_ENABLED is the
+        | switch for the whole app: off, no button shows and the routes refuse. On, a provider
+        | shows once its two keys are set. The dashboard asks on every page, so the switch
+        | needs no rebuild, only `php artisan config:clear` where the config is cached.
+        |
+        | Give the provider this address to send people back to:
+        |     {NEVELA_WEB_URL}/api/auth/oauth/{provider}/callback
+        |
+        | Who may come in follows `registration`. Off: only someone with an account, found by
+        | the provider account connected to it or by an address the provider says is
+        | verified. On: anyone, and a new account is made for a new address.
+        */
+        'social' => [
+            'enabled' => (bool) env('SOCIAL_AUTH_ENABLED', false),
+            'google' => [
+                'client_id' => env('GOOGLE_CLIENT_ID'),
+                'client_secret' => env('GOOGLE_CLIENT_SECRET'),
+            ],
+            'github' => [
+                'client_id' => env('GITHUB_CLIENT_ID'),
+                'client_secret' => env('GITHUB_CLIENT_SECRET'),
+            ],
+        ],
+
         /* A sign-in link by email. */
         'magic_link' => true,
 

package/template/laravel/database/migrations/2026_10_18_000000_create_nevela_social_accounts_table.php

@@ -0,0 +1,35 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+// Which Google or GitHub account belongs to which account here.
+//
+// Matched by the provider's own id for the person, not by email address: the address at
+// Google can change, and a later sign-in still finds the account. The address is kept
+// only to show on the Account page.
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (Schema::hasTable('nevela_social_accounts')) {
+            return;
+        }
+        Schema::create('nevela_social_accounts', function (Blueprint $table) {
+            $table->uuid('id')->primary();
+            // Text, as the roles table keeps them: an account's id is a number or a UUID.
+            $table->string('user_id', 64)->index();
+            $table->string('provider', 32);
+            $table->string('provider_id', 191);
+            $table->string('email')->nullable();
+            $table->timestamps();
+            $table->unique(['provider', 'provider_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('nevela_social_accounts');
+    }
+};

package/template/laravel/src/Access/ClosedAccounts.php

@@ -195,7 +195,7 @@ final class ClosedAccounts
         DB::transaction(function () use ($user, $key) {
             Account::revokeTokens($user);
             DB::table('nevela_role_user')->where('user_id', $key)->delete();
-            foreach (['nevela_two_factor', 'nevela_passkeys'] as $table) {
+            foreach (['nevela_two_factor', 'nevela_passkeys', 'nevela_social_accounts'] as $table) {
                 if (Schema::hasTable($table)) {
                     DB::table($table)->where('user_id', $key)->delete();
                 }

package/template/laravel/src/Auth/Social.php

@@ -0,0 +1,120 @@
+<?php
+
+namespace Nevela\Laravel\Auth;
+
+use Illuminate\Http\Request;
+use Laravel\Socialite\Contracts\User as ProviderUser;
+use Laravel\Socialite\Facades\Socialite;
+use Laravel\Socialite\Two\AbstractProvider;
+use Laravel\Socialite\Two\GithubProvider;
+use Laravel\Socialite\Two\GoogleProvider;
+
+/**
+ * Signing in with Google or GitHub, through Laravel Socialite.
+ *
+ * One switch turns it on or off for the whole app (SOCIAL_AUTH_ENABLED), and a provider
+ * is offered once its two keys are set. Off, no button shows and the routes refuse.
+ *
+ * The browser never talks to Laravel here. The dashboard's server asks for the provider's
+ * address, and the provider sends the browser back to the dashboard, whose server hands
+ * the code to Laravel. So the address registered with the provider is the dashboard's:
+ *
+ *     {NEVELA_WEB_URL}/api/auth/oauth/{provider}/callback
+ */
+final class Social
+{
+    /** The providers Nevela knows, and Socialite's class for each. */
+    public const PROVIDERS = [
+        'google' => GoogleProvider::class,
+        'github' => GithubProvider::class,
+    ];
+
+    public const LABELS = ['google' => 'Google', 'github' => 'GitHub'];
+
+    /**
+     * Stands in for the provider in tests, which have no Google to ask: given the provider
+     * and the code, the person it would have answered with.
+     *
+     * @var (callable(string, string): ProviderUser)|null
+     */
+    public static $fake = null;
+
+    /** Whether social sign-in is switched on at all. */
+    public static function enabled(): bool
+    {
+        return (bool) config('nevela.auth.social.enabled', false);
+    }
+
+    /**
+     * The providers people can use: switched on, and with both keys.
+     *
+     * @return list<string>
+     */
+    public static function available(): array
+    {
+        if (! self::enabled()) {
+            return [];
+        }
+
+        return array_values(array_filter(array_keys(self::PROVIDERS), fn (string $provider) => self::configured($provider)));
+    }
+
+    /** Whether a provider has its keys, whether or not the switch is on. */
+    public static function configured(string $provider): bool
+    {
+        $keys = (array) config("nevela.auth.social.{$provider}", []);
+
+        return isset(self::PROVIDERS[$provider]) && (string) ($keys['client_id'] ?? '') !== '' && (string) ($keys['client_secret'] ?? '') !== '';
+    }
+
+    /** Where the provider sends the browser back to: a page of the dashboard. */
+    public static function callback(string $provider, ?Request $request = null): string
+    {
+        return Web::url("/api/auth/oauth/{$provider}/callback", [], $request);
+    }
+
+    /** Socialite's provider, set up from config/nevela.php, with no session: the state is ours. */
+    public static function driver(string $provider, string $callback): AbstractProvider
+    {
+        $keys = (array) config("nevela.auth.social.{$provider}", []);
+
+        /** @var AbstractProvider $driver */
+        $driver = Socialite::buildProvider(self::PROVIDERS[$provider], [
+            'client_id' => (string) ($keys['client_id'] ?? ''),
+            'client_secret' => (string) ($keys['client_secret'] ?? ''),
+            'redirect' => $callback,
+        ]);
+
+        return $driver->stateless();
+    }
+
+    /** The address to send the browser to, carrying our state. */
+    public static function authorizationUrl(string $provider, string $callback, string $state): string
+    {
+        return self::driver($provider, $callback)->with(['state' => $state])->redirect()->getTargetUrl();
+    }
+
+    /**
+     * Who the provider says this is, from the code it sent back.
+     *
+     * @return array{id: string, email: string|null, verified: bool, name: string|null}
+     */
+    public static function profile(string $provider, string $callback, string $code): array
+    {
+        $user = self::$fake !== null ? (self::$fake)($provider, $code) : self::driver($provider, $callback)->user();
+        $raw = method_exists($user, 'getRaw') ? (array) $user->getRaw() : [];
+        $email = $user->getEmail();
+
+        return [
+            'id' => (string) $user->getId(),
+            'email' => is_string($email) && $email !== '' ? mb_strtolower(trim($email)) : null,
+            // Google says, of each address. GitHub only gives an address that is verified:
+            // the public one has to be, and Socialite otherwise asks for the primary verified one.
+            'verified' => match ($provider) {
+                'google' => ($raw['email_verified'] ?? $raw['verified_email'] ?? false) === true,
+                default => is_string($email) && $email !== '',
+            },
+            'name' => $user->getName() ?: $user->getNickname(),
+        ];
+    }
+}

package/template/laravel/src/Console/StatusCommand.php

@@ -7,6 +7,7 @@ use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Schema;
 use Nevela\Laravel\Access\ClosedAccounts;
+use Nevela\Laravel\Auth\Social;
 use Nevela\Laravel\Forms\FormGuard;
 use Nevela\Laravel\Nevela;
 use Nevela\Laravel\Support\DashboardState;
@@ -109,6 +110,17 @@ final class StatusCommand extends Command
             });
         }
 
+        // --- social sign-in ---
+        if (Social::enabled()) {
+            $missing = array_values(array_filter(array_keys(Social::PROVIDERS), fn (string $provider) => ! Social::configured($provider)));
+            $row('Social sign-in', Social::available() === []
+                ? '<fg=yellow>switched on, and no provider has its keys: set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET, or GitHub\'s</>'
+                : 'on: '.implode(', ', array_map(fn (string $provider) => Social::LABELS[$provider], Social::available()))
+                    .($missing === [] ? '' : ' <fg=gray>('.implode(', ', array_map(fn (string $provider) => Social::LABELS[$provider], $missing)).' has no keys)</>'));
+        } else {
+            $row('Social sign-in', '<fg=gray>off (SOCIAL_AUTH_ENABLED)</>');
+        }
+
         // --- dashboard ---
         $web = config('nevela.web_path');
         if (! $web || ! is_dir($web)) {

package/template/laravel/src/Generator/ResourceGenerator.php

@@ -447,7 +447,10 @@ final class ResourceGenerator
           checkBreachedPasswords: {$flag('check_breached_passwords')},
           /** People can close their own account, from the Account page. */
           closeAccount: {$flag('close_account')},
-          /** Signing in with Google, GitHub and the like isn't part of Nevela yet. */
+          /**
+           * Always empty here. Which of Google and GitHub show is asked of Laravel on each
+           * page, so SOCIAL_AUTH_ENABLED needs no generate or rebuild: see lib/social.ts.
+           */
           social: [] as SocialProvider[],
         };
         {$e}
@@ -455,7 +458,10 @@ final class ResourceGenerator
         /** Whether any second factor can be set up. */
         export const twoFactorAvailable = authConfig.twoFactor.authenticator || authConfig.twoFactor.email;
 
-        /** The social providers that are switched on and configured. None yet. */
+        /**
+         * @deprecated Kept so a page written before 0.10 still builds. It shows no providers:
+         * use `enabledSocialProviders` from "@/lib/social", which asks Laravel.
+         */
         export function enabledSocialProviders(): SocialProvider[] {
           return authConfig.social;
         }

package/template/laravel/src/Http/Auth/Answers.php

@@ -10,9 +10,10 @@ use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 /** What the auth controllers share: how they refuse, and how they check a setting or a password. */
 trait Answers
 {
-    private function refuse(string $code, string $message, int $status = 400): JsonResponse
+    /** @param array<string, mixed> $more Anything else the client needs with it, such as where to go next */
+    private function refuse(string $code, string $message, int $status = 400, array $more = []): JsonResponse
     {
-        return response()->json(['error' => $message, 'code' => $code], $status);
+        return response()->json(['error' => $message, 'code' => $code] + $more, $status);
     }
 
     /** A method switched off in config/nevela.php is refused, not just hidden. */

package/template/laravel/src/Http/Auth/SignInController.php

@@ -11,6 +11,7 @@ use Nevela\Laravel\Auth\Account;
 use Nevela\Laravel\Auth\AuthMail;
 use Nevela\Laravel\Auth\Challenges;
 use Nevela\Laravel\Auth\Passkeys;
+use Nevela\Laravel\Auth\Social;
 use Nevela\Laravel\Auth\Web;
 use Nevela\Laravel\Models\TwoFactor;
 use RuntimeException;
@@ -51,6 +52,8 @@ final class SignInController
             ],
             'requireEmailVerification' => (bool) config('nevela.auth.require_email_verification', false),
             'closeAccount' => (bool) config('nevela.auth.close_account', true),
+            // Switched on, and with their keys: the buttons to draw.
+            'social' => Social::available(),
         ];
     }
 

package/template/laravel/src/Http/Auth/SocialController.php

@@ -0,0 +1,285 @@
+<?php
+
+namespace Nevela\Laravel\Http\Auth;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Str;
+use Nevela\Laravel\Access\Access;
+use Nevela\Laravel\Access\ClosedAccounts;
+use Nevela\Laravel\Auth\Account;
+use Nevela\Laravel\Auth\Challenges;
+use Nevela\Laravel\Auth\Social;
+use Nevela\Laravel\Auth\Web;
+use Nevela\Laravel\Support\Key;
+use Throwable;
+
+/**
+ * Signing in with Google or GitHub, and connecting them to an account (see Auth\Social).
+ *
+ *   POST auth/oauth/{provider}/start     → { url, state }   where to send the browser
+ *   POST auth/oauth/{provider}/callback  { state, code }    → a token, a second step, or { linked }
+ *   GET  auth/social                     the signed-in person's connected providers
+ *   DELETE auth/social/{id}              disconnect one
+ *
+ * The first two are called by the dashboard's server, never by the browser.
+ *
+ * Who may come in this way follows `registration`. Off, only someone who already has an
+ * account: matched by the provider account connected to it, or by an address the provider
+ * says is verified. On, anyone else gets a new account as well.
+ */
+final class SocialController
+{
+    use Answers;
+
+    /** How long the provider's page may take: the state is good for this long, once. */
+    private const STATE_SECONDS = 600;
+
+    private const TABLE = 'nevela_social_accounts';
+
+    public function start(Request $request, string $provider): JsonResponse
+    {
+        if (($refused = $this->unavailable($provider)) !== null) {
+            return $refused;
+        }
+        $input = $request->validate(['next' => ['nullable', 'string', 'max:2000'], 'link' => ['nullable', 'boolean']]);
+        $linking = (bool) ($input['link'] ?? false);
+        $user = $linking ? $request->user('sanctum') : null;
+        if ($linking && $user === null) {
+            return $this->refuse('UNAUTHENTICATED', 'Sign in first, then connect it from your account.', 401);
+        }
+
+        $callback = Social::callback($provider, $request);
+        $state = Challenges::start('oauth', [
+            'provider' => $provider,
+            'callback' => $callback,
+            'next' => Web::path($input['next'] ?? null, $linking ? '/dashboard/account/security' : '/dashboard'),
+            'user' => $user === null ? null : (string) $user->getAuthIdentifier(),
+            'device' => $request->input('deviceName'),
+        ], self::STATE_SECONDS);
+
+        return response()->json(['url' => Social::authorizationUrl($provider, $callback, $state), 'state' => $state]);
+    }
+
+    public function callback(Request $request, string $provider): JsonResponse
+    {
+        if (($refused = $this->unavailable($provider)) !== null) {
+            return $refused;
+        }
+        // Good once, and only for the provider it was made for: a callback can't be replayed,
+        // and can't be one that this app didn't start.
+        $pending = Challenges::take('oauth', (string) $request->input('state'));
+        if ($pending === null || ($pending['provider'] ?? null) !== $provider) {
+            return $this->refuse('OAUTH_STATE', 'That sign-in took too long or was already used. Start again.', 401);
+        }
+        $next = (string) ($pending['next'] ?? '/dashboard');
+        $label = Social::LABELS[$provider];
+        if ($request->filled('error')) {
+            return $this->refuse('OAUTH_DENIED', "{$label} sign-in was cancelled.", 401, ['next' => $next]);
+        }
+        $code = (string) $request->input('code');
+        if ($code === '') {
+            return $this->refuse('OAUTH_FAILED', "{$label} didn't say who you are. Try again.", 401, ['next' => $next]);
+        }
+
+        try {
+            $profile = Social::profile($provider, (string) $pending['callback'], $code);
+        } catch (Throwable $e) {
+            report($e);
+
+            return $this->refuse('OAUTH_FAILED', "{$label} sign-in didn't finish. Try again.", 401, ['next' => $next]);
+        }
+        if ($profile['email'] === null) {
+            return $this->refuse('NO_EMAIL', "Your {$label} account didn't share an email address, so it can't be matched to an account.", 422, ['next' => $next]);
+        }
+
+        // Connecting it to the account that asked, from the Account page.
+        if (($pending['user'] ?? null) !== null) {
+            return $this->connect($provider, $profile, (string) $pending['user'], $next);
+        }
+
+        $user = $this->linked($provider, $profile['id']);
+        if ($user === null) {
+            if (! $profile['verified']) {
+                return $this->refuse('EMAIL_NOT_VERIFIED', "Verify your email address with {$label} first, then try again.", 422, ['next' => $next]);
+            }
+            $user = Account::findByEmail($profile['email']);
+            if ($user === null) {
+                $made = $this->register($profile);
+                if ($made instanceof JsonResponse) {
+                    return $made;
+                }
+                $user = $made;
+            } elseif ($user->email_verified_at === null) {
+                $this->reclaim($user);
+            }
+            if (! $this->link($provider, $profile, $user)) {
+                return $this->refuse('ALREADY_LINKED', "That {$label} account is connected to another account here.", 409, ['next' => $next]);
+            }
+        }
+        // The provider has seen this address work.
+        if ($profile['verified'] && $user->email_verified_at === null && mb_strtolower((string) $user->email) === $profile['email']) {
+            $user->forceFill(['email_verified_at' => now()])->save();
+        }
+
+        $request->merge(['deviceName' => $pending['device'] ?? null]);
+        // The same as after a password: an account with a second step still owes it.
+        $answer = SignInController::finish($user, $request);
+        $answer->setData(['next' => $next] + (array) $answer->getData(true));
+
+        return $answer;
+    }
+
+    /** GET auth/social: the providers connected to the signed-in account. */
+    public function accounts(Request $request): JsonResponse
+    {
+        if (! Schema::hasTable(self::TABLE)) {
+            return response()->json(['data' => []]);
+        }
+        $rows = DB::table(self::TABLE)->where('user_id', (string) $request->user()->getAuthIdentifier())->orderBy('created_at')->get();
+
+        return response()->json(['data' => $rows->map(fn ($row) => [
+            'id' => (string) $row->id,
+            'provider' => (string) $row->provider,
+            'email' => $row->email,
+            'connectedAt' => $row->created_at,
+        ])->all()]);
+    }
+
+    /**
+     * DELETE auth/social/{id}. Always allowed: every account has an email address, and so a
+     * way back in by password reset, a sign-in link or a code, whichever are switched on.
+     */
+    public function disconnect(Request $request, string $id): Response
+    {
+        if (Key::isUuid($id) && Schema::hasTable(self::TABLE)) {
+            DB::table(self::TABLE)->where('id', $id)->where('user_id', (string) $request->user()->getAuthIdentifier())->delete();
+        }
+
+        return response()->noContent();
+    }
+
+    /** Refused when the switch is off, the provider is unknown, or it has no keys. */
+    private function unavailable(string $provider): ?JsonResponse
+    {
+        return in_array($provider, Social::available(), true)
+            ? null
+            : $this->refuse('NOT_ENABLED', "Signing in with that provider isn't switched on for this app.", 404);
+    }
+
+    /** The account a provider's account is connected to. */
+    private function linked(string $provider, string $providerId): mixed
+    {
+        if (! Schema::hasTable(self::TABLE)) {
+            return null;
+        }
+        $row = DB::table(self::TABLE)->where('provider', $provider)->where('provider_id', $providerId)->first();
+        if ($row === null) {
+            return null;
+        }
+        $user = Account::model()::query()->find($row->user_id);
+        // Connected to an account that is gone: the connection goes too, so it can be made again.
+        if ($user === null) {
+            DB::table(self::TABLE)->where('id', $row->id)->delete();
+        }
+
+        return $user;
+    }
+
+    /**
+     * Connect a provider account to this one. False when it is connected to another account,
+     * as when two requests raced to connect it.
+     *
+     * @param  array{id: string, email: string|null, verified: bool, name: string|null}  $profile
+     */
+    private function link(string $provider, array $profile, mixed $user): bool
+    {
+        if (! Schema::hasTable(self::TABLE)) {
+            return true; // not migrated yet: matched by address every time until it is
+        }
+        $id = (string) $user->getAuthIdentifier();
+        DB::table(self::TABLE)->insertOrIgnore([
+            'id' => (string) Str::uuid(),
+            'user_id' => $id,
+            'provider' => $provider,
+            'provider_id' => $profile['id'],
+            'email' => $profile['email'],
+            'created_at' => now(),
+            'updated_at' => now(),
+        ]);
+
+        // Whichever row is there now is the answer.
+        return DB::table(self::TABLE)->where('provider', $provider)->where('provider_id', $profile['id'])->value('user_id') === $id;
+    }
+
+    /**
+     * The provider has just proved this address belongs to whoever is signing in. Nobody had
+     * proved it before: the account may have been made by someone else, in their name, with a
+     * password of their own. So that password stops working and every device is signed out.
+     * The owner signs in with the provider from here, or sets a password with "Forgot password".
+     */
+    private function reclaim(mixed $user): void
+    {
+        Account::revokeTokens($user);
+        $user->forceFill(['password' => Hash::make(Str::random(48))])->save();
+    }
+
+    /** @param array{id: string, email: string|null, verified: bool, name: string|null} $profile */
+    private function connect(string $provider, array $profile, string $userId, string $next): JsonResponse
+    {
+        $user = Account::model()::query()->find($userId);
+        if ($user === null) {
+            return $this->refuse('UNAUTHENTICATED', 'Sign in again, then connect it.', 401, ['next' => $next]);
+        }
+        $holder = $this->linked($provider, $profile['id']);
+        if (($holder !== null && (string) $holder->getAuthIdentifier() !== $userId) || ! $this->link($provider, $profile, $user)) {
+            return $this->refuse('ALREADY_LINKED', 'That '.Social::LABELS[$provider].' account is connected to another account here.', 409, ['next' => $next]);
+        }
+
+        return response()->json(['linked' => true, 'provider' => $provider, 'next' => $next]);
+    }
+
+    /**
+     * A new account, where people may make their own: as `register` makes one, with the
+     * address already proved and a password nobody knows. Its owner signs in with the
+     * provider, or sets a password with "Forgot password".
+     *
+     * @param  array{id: string, email: string|null, verified: bool, name: string|null}  $profile
+     */
+    private function register(array $profile): mixed
+    {
+        if (! config('nevela.auth.registration', false)) {
+            return $this->refuse('NO_ACCOUNT', "There's no account here for {$profile['email']}. Ask an administrator for one.", 403);
+        }
+        $standing = ClosedAccounts::standing((string) $profile['email']);
+        if ($standing === 'closed') {
+            return $this->refuse('ACCOUNT_CLOSED', 'An account with this email was closed. Ask an administrator to restore it.', 403);
+        }
+        if ($standing === 'blocked') {
+            return $this->refuse('EMAIL_BLOCKED', "This email can't be used for a new account. Ask an administrator.", 403);
+        }
+
+        $model = Account::model();
+        $user = new $model;
+        $attributes = [
+            'name' => $profile['name'] ?: Str::before((string) $profile['email'], '@'),
+            'email' => $profile['email'],
+            'password' => Hash::make(Str::random(48)),
+            'email_verified_at' => now(),
+        ];
+        $role = config('nevela.auth.default_role', 'USER');
+        if ($role !== null && Schema::hasColumn($user->getTable(), 'role')) {
+            $attributes['role'] = $role;
+        }
+        $user->forceFill($attributes)->save();
+        if (is_string($role) && $role !== '') {
+            Access::grant($user, $role);
+        }
+
+        return $user;
+    }
+}

package/template/laravel/src/Nevela.php

@@ -22,7 +22,7 @@ use Nevela\Laravel\Support\Naming;
 final class Nevela
 {
     /** Written by `pnpm release`; the same number as the repository's git tag. */
-    public const VERSION = '0.9.2';
+    public const VERSION = '0.10.0';
 
     /** @var array<string, Descriptor> */
     private static array $descriptors = [];

package/template/laravel/src/NevelaServiceProvider.php

@@ -36,6 +36,7 @@ use Nevela\Laravel\Http\FormsController;
 use Nevela\Laravel\Http\Auth\AccountController;
 use Nevela\Laravel\Http\Auth\SecurityController;
 use Nevela\Laravel\Http\Auth\SignInController;
+use Nevela\Laravel\Http\Auth\SocialController;
 use Nevela\Laravel\Http\PublicThrottle;
 use Nevela\Laravel\Http\TokenController;
 use Nevela\Laravel\Http\ActionController;
@@ -139,6 +140,9 @@ final class NevelaServiceProvider extends ServiceProvider
                     Route::post('email-code/verify', [SignInController::class, 'code'])->name('email-code.verify');
                     Route::post('passkey/options', [SignInController::class, 'passkeyOptions'])->name('passkey.options');
                     Route::post('passkey', [SignInController::class, 'passkey'])->name('passkey.verify');
+                    // Google and GitHub: called by the dashboard's server, on the way out and on the way back.
+                    Route::post('oauth/{provider}/start', [SocialController::class, 'start'])->name('oauth.start');
+                    Route::post('oauth/{provider}/callback', [SocialController::class, 'callback'])->name('oauth.callback');
                     Route::post('register', [AccountController::class, 'register'])->name('register');
                     Route::post('email/send', [AccountController::class, 'resendVerification'])->name('email.send');
                     Route::post('email/verify', [AccountController::class, 'verifyEmail'])->name('email.verify');
@@ -165,6 +169,9 @@ final class NevelaServiceProvider extends ServiceProvider
                         Route::post('two-factor/backup-codes', [SecurityController::class, 'regenerateBackupCodes'])->name('two-factor.backup-codes');
                     });
 
+                    Route::get('social', [SocialController::class, 'accounts'])->name('social');
+                    Route::delete('social/{id}', [SocialController::class, 'disconnect'])->name('social.disconnect');
+
                     Route::get('passkeys', [SecurityController::class, 'passkeys'])->name('passkeys');
                     Route::post('passkeys/options', [SecurityController::class, 'passkeyOptions'])->name('passkeys.options');
                     Route::post('passkeys', [SecurityController::class, 'addPasskey'])->name('passkeys.add');

package/template/web/app/api/auth/[...action]/route.ts

@@ -86,6 +86,69 @@ async function callLaravel(request: NextRequest, method: string, path: string, b
   return { status: response.status, body: parsed };
 }
 
+/**
+ * Which browser started a sign-in with Google or GitHub. The provider's answer is taken
+ * only in the browser that asked for it, so nobody can sign someone else in to their own
+ * account by sending them a link.
+ */
+const OAUTH_COOKIE = "nevela_oauth";
+const OAUTH_PATH = "/api/auth/oauth";
+
+const redirectTo = (request: NextRequest, path: string) => Response.redirect(new URL(path, request.url), 303);
+
+/** A path with something added to its query: "/dashboard/account/security" + social=linked. */
+function withQuery(path: string, name: string, value: string): string {
+  return `${path}${path.includes("?") ? "&" : "?"}${name}=${encodeURIComponent(value)}`;
+}
+
+/** The button: ask Laravel where the provider's page is, and send the browser there. */
+async function oauthStart(request: NextRequest, provider: string): Promise<Response> {
+  const params = request.nextUrl.searchParams;
+  const linking = params.get("link") === "1";
+  const next = safeRedirectPath(params.get("next"), linking ? "/dashboard/account/security" : "/dashboard");
+  const result = await callLaravel(request, "POST", `oauth/${provider}/start`, { next, link: linking });
+  const { url, state } = result.body;
+  if (result.status !== 200 || typeof url !== "string" || typeof state !== "string") {
+    const code = typeof result.body.code === "string" ? result.body.code : "OAUTH_FAILED";
+    return redirectTo(request, linking ? withQuery(next, "social", code) : `/sign-in?error=oauth&reason=${code}`);
+  }
+  (await cookies()).set(OAUTH_COOKIE, state, { ...cookieOptions(60 * 10), path: OAUTH_PATH });
+  return Response.redirect(url, 303);
+}
+
+/** Back from the provider: hand Laravel the code, and sign in as any other way does. */
+async function oauthCallback(request: NextRequest, provider: string): Promise<Response> {
+  const params = request.nextUrl.searchParams;
+  const jar = await cookies();
+  const state = params.get("state") ?? "";
+  const started = jar.get(OAUTH_COOKIE)?.value;
+  jar.set(OAUTH_COOKIE, "", { ...cookieOptions(0), path: OAUTH_PATH });
+  if (!started || started !== state) return redirectTo(request, "/sign-in?error=oauth&reason=OAUTH_STATE");
+
+  const result = await callLaravel(request, "POST", `oauth/${provider}/callback`, {
+    state,
+    code: params.get("code") ?? "",
+    ...(params.get("error") ? { error: params.get("error") } : {}),
+  });
+  const next = safeRedirectPath(result.body.next);
+  // Connected to the account that asked, from the Account page.
+  if (result.body.linked === true) return redirectTo(request, withQuery(next, "social", "linked"));
+
+  const waiting = result.status === 200 ? secondStep(result.body) : null;
+  if (waiting) {
+    jar.set(PENDING_COOKIE, encodePending(waiting), cookieOptions(PENDING_MAX_AGE));
+    return redirectTo(request, `/two-factor?next=${encodeURIComponent(next)}`);
+  }
+  const token = result.body.token;
+  if (result.status >= 400 || typeof token !== "string") {
+    const code = typeof result.body.code === "string" ? result.body.code : "OAUTH_FAILED";
+    return redirectTo(request, next.startsWith("/dashboard/account") ? withQuery(next, "social", code) : `/sign-in?error=oauth&reason=${code}&next=${encodeURIComponent(next)}`);
+  }
+  jar.set(TOKEN_COOKIE, token, cookieOptions(TOKEN_MAX_AGE));
+  jar.set(PENDING_COOKIE, "", cookieOptions(0));
+  return redirectTo(request, next);
+}
+
 /** A sign-in that needs its second step: Laravel answered with a challenge instead of a token. */
 function secondStep(body: Body): { challenge: string; methods: SecondStepMethod[] } | null {
   if (body.twoFactor !== true || typeof body.challenge !== "string") return null;
@@ -136,6 +199,10 @@ async function handle(request: NextRequest, context: Context, method: string): P
     return Response.redirect(destination.origin === new URL(request.url).origin ? destination : new URL("/dashboard", request.url), 303);
   }
 
+  // Google and GitHub: the button opens the first, and the provider sends the browser back to the second.
+  const oauth = /^oauth\/([a-z]+)(\/callback)?$/.exec(action);
+  if (method === "GET" && oauth) return oauth[2] ? oauthCallback(request, oauth[1]) : oauthStart(request, oauth[1]);
+
   if (method !== "GET" && !fromThisSite(request)) {
     return Response.json({ error: "That request didn't come from this site.", code: "CROSS_SITE" }, { status: 403 });
   }

package/template/web/app/dashboard/account/layout.tsx

@@ -1,12 +1,13 @@
 import { AccountNav } from "@/components/account/account-nav";
 import { PageHeader } from "@/components/dashboard/page-header";
-import { authConfig, enabledSocialProviders, twoFactorAvailable } from "@/lib/auth-config";
+import { authConfig, twoFactorAvailable } from "@/lib/auth-config";
+import { enabledSocialProviders } from "@/lib/social";
 import { requireSession } from "@/lib/session";
 
 /** The frame the account's pages share: one header, one set of links. */
 export default async function AccountLayout({ children }: { children: React.ReactNode }) {
   await requireSession("/dashboard/account");
-  const security = twoFactorAvailable || authConfig.passkeys || enabledSocialProviders().length > 0;
+  const security = twoFactorAvailable || authConfig.passkeys || (await enabledSocialProviders()).length > 0;
 
   return (
     <>

package/template/web/app/dashboard/account/security/page.tsx

@@ -1,19 +1,31 @@
 import { ConnectedAccounts, Passkeys, TwoFactor } from "@/components/account/sections";
-import { authConfig, enabledSocialProviders, twoFactorAvailable } from "@/lib/auth-config";
+import { authConfig, twoFactorAvailable } from "@/lib/auth-config";
 import { requireSession } from "@/lib/session";
+import { enabledSocialProviders } from "@/lib/social";
+
+/** What became of connecting a provider, by what Laravel answered: the provider sends the browser back here. */
+const CONNECTING: Record<string, string> = {
+  ALREADY_LINKED: "That account is connected to another account here.",
+  NO_EMAIL: "That account didn't share an email address.",
+  OAUTH_DENIED: "Connecting it was cancelled.",
+  OAUTH_STATE: "That took too long. Try again.",
+  NOT_ENABLED: "Signing in with that provider isn't switched on.",
+};
 
 export const metadata = { title: "Security" };
 
 /** Two-factor, passkeys and the accounts you can sign in with. */
-export default async function SecurityPage() {
+export default async function SecurityPage({ searchParams }: { searchParams: Promise<{ social?: string }> }) {
   const { user } = await requireSession("/dashboard/account/security");
-  const providers = enabledSocialProviders();
+  const providers = await enabledSocialProviders();
+  const { social } = await searchParams;
+  const connecting = social === undefined || social === "linked" ? null : (CONNECTING[social] ?? "Connecting it didn't finish. Try again.");
 
   return (
     <>
       {twoFactorAvailable && <TwoFactor enabled={user.twoFactorEnabled} hasPassword methods={authConfig.twoFactor} />}
       {authConfig.passkeys && <Passkeys />}
-      {providers.length > 0 && <ConnectedAccounts providers={providers} />}
+      {providers.length > 0 && <ConnectedAccounts providers={providers} initialError={connecting} />}
     </>
   );
 }

package/template/web/app/sign-in/page.tsx

@@ -2,7 +2,8 @@ import Link from "next/link";
 import { redirect } from "next/navigation";
 import { AuthShell } from "@/components/auth/auth-shell";
 import { SignInFlow } from "@/components/auth/sign-in-flow";
-import { authConfig, enabledSocialProviders } from "@/lib/auth-config";
+import { authConfig } from "@/lib/auth-config";
+import { enabledSocialProviders } from "@/lib/social";
 import { getSession, safeRedirectPath } from "@/lib/session";
 import { site } from "@/lib/site";
 import { theme } from "@/lib/theme";
@@ -14,7 +15,20 @@ const ERRORS: Record<string, string> = {
   link: "That sign-in link has expired or was already used. Ask for a new one.",
 };
 
-export default async function SignInPage({ searchParams }: { searchParams: Promise<{ next?: string; error?: string; reset?: string; closed?: string }> }) {
+/** Why a sign-in with Google or GitHub didn't finish, as Laravel names it. */
+const OAUTH_REASONS: Record<string, string> = {
+  NO_ACCOUNT: "There's no account here for that address. Ask an administrator for one.",
+  NO_EMAIL: "That account didn't share an email address, so it can't be matched to an account here.",
+  EMAIL_NOT_VERIFIED: "Verify your email address with the provider first, then try again.",
+  ACCOUNT_CLOSED: "This account was closed. Ask an administrator to restore it.",
+  ACCOUNT_DISABLED: "This account has been switched off. Ask an administrator.",
+  EMAIL_BLOCKED: "This email can't be used for a new account. Ask an administrator.",
+  OAUTH_DENIED: "Sign-in was cancelled.",
+  OAUTH_STATE: "That sign-in took too long or was started in another browser. Try again.",
+  NOT_ENABLED: "Signing in with that provider isn't switched on.",
+};
+
+export default async function SignInPage({ searchParams }: { searchParams: Promise<{ next?: string; error?: string; reason?: string; reset?: string; closed?: string }> }) {
   const params = await searchParams;
   const next = safeRedirectPath(params.next);
   if (await getSession()) redirect(next);
@@ -38,12 +52,14 @@ export default async function SignInPage({ searchParams }: { searchParams: Promi
       }
     >
       <SignInFlow
-        providers={enabledSocialProviders()}
+        providers={await enabledSocialProviders()}
         socialPlacement={theme.social}
         socialStyle={theme.socialStyle}
         methods={{ magicLink: authConfig.magicLink, emailOtp: authConfig.emailOtp, passkeys: authConfig.passkeys }}
         next={next}
-        initialError={params.error ? (ERRORS[params.error] ?? "Sign-in didn't finish. Try again.") : null}
+        initialError={
+          params.error ? ((params.error === "oauth" && params.reason ? OAUTH_REASONS[params.reason] : undefined) ?? ERRORS[params.error] ?? "Sign-in didn't finish. Try again.") : null
+        }
         initialNotice={
           params.reset
             ? "Your password is changed. Sign in with the new one."

package/template/web/app/sign-up/page.tsx

@@ -2,7 +2,8 @@ import Link from "next/link";
 import { redirect } from "next/navigation";
 import { AuthShell } from "@/components/auth/auth-shell";
 import { SignUpForm } from "@/components/auth/sign-up-form";
-import { authConfig, enabledSocialProviders } from "@/lib/auth-config";
+import { authConfig } from "@/lib/auth-config";
+import { enabledSocialProviders } from "@/lib/social";
 import { getSession, safeRedirectPath } from "@/lib/session";
 import { site } from "@/lib/site";
 import { theme } from "@/lib/theme";
@@ -32,7 +33,7 @@ export default async function SignUpPage({ searchParams }: { searchParams: Promi
       }
     >
       <SignUpForm
-        providers={enabledSocialProviders()}
+        providers={await enabledSocialProviders()}
         socialPlacement={theme.social}
         socialStyle={theme.socialStyle}
         next={next}

package/template/web/components/account/sections.tsx

@@ -524,9 +524,9 @@ export function Passkeys() {
   );
 }
 
-export function ConnectedAccounts({ providers }: { providers: SocialProvider[] }) {
+export function ConnectedAccounts({ providers, initialError = null }: { providers: SocialProvider[]; initialError?: string | null }) {
   const [linked, setLinked] = useState<{ providerId: string; accountId: string }[] | null>(null);
-  const [error, setError] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(initialError);
 
   const load = useCallback(async () => {
     const { data } = await authClient.listAccounts();
@@ -537,7 +537,7 @@ export function ConnectedAccounts({ providers }: { providers: SocialProvider[] }
   }, [load]);
 
   const connect = async (provider: SocialProvider) => {
-    const { error } = await authClient.linkSocial({ provider, callbackURL: "/dashboard/account" });
+    const { error } = await authClient.linkSocial({ provider, callbackURL: "/dashboard/account/security" });
     if (error) setError(authErrorMessage(error));
   };
   const disconnect = async (provider: SocialProvider) => {

package/template/web/lib/auth-client.ts

@@ -179,7 +179,8 @@ export const authClient = {
     magicLink: ({ email, callbackURL }: { email: string; callbackURL?: string; errorCallbackURL?: string }) => post("magic-link", { email, next: callbackURL }),
     emailOtp: ({ email, otp }: { email: string; otp: string }) => orSecondStep(post<{ twoFactorRedirect?: boolean }>("email-code/verify", { email, code: otp })),
     passkey: signInWithPasskey,
-    social: (_options: { provider: string; callbackURL?: string; errorCallbackURL?: string }) => unsupported("Signing in with that provider"),
+    /** Off to the provider's page: the browser leaves, and comes back signed in. */
+    social: ({ provider, callbackURL }: { provider: string; callbackURL?: string; errorCallbackURL?: string }) => toProvider(provider, callbackURL),
   },
   signUp: {
     email: ({ name, email, password }: { name: string; email: string; password: string; callbackURL?: string }) =>
@@ -247,12 +248,28 @@ export const authClient = {
     deletePasskey: ({ id }: { id: string }) => call("DELETE", `passkeys/${encodeURIComponent(id)}`),
   },
 
-  // Signing in with Google, GitHub and the like isn't part of Nevela yet.
-  listAccounts: async (): Promise<AuthResult<{ id: string; providerId: string; accountId: string }[]>> => ({ data: [], error: null }),
-  linkSocial: (_options: { provider: string; callbackURL?: string }) => unsupported("Connecting that provider"),
-  unlinkAccount: (_options: { providerId?: string; accountId?: string }) => unsupported("Disconnecting that provider"),
+  /** The providers connected to this account. */
+  listAccounts: async (): Promise<AuthResult<{ id: string; providerId: string; accountId: string }[]>> => {
+    const result = await call<{ data?: { id: string; provider: string }[] }>("GET", "social");
+    if (result.error) return { data: null, error: result.error };
+    return { data: (result.data?.data ?? []).map((row) => ({ id: row.id, providerId: row.provider, accountId: row.id })), error: null };
+  },
+  /** Off to the provider's page, to come back connected to this account. */
+  linkSocial: ({ provider, callbackURL }: { provider: string; callbackURL?: string }) => toProvider(provider, callbackURL ?? "/dashboard/account/security", true),
+  unlinkAccount: ({ accountId }: { providerId?: string; accountId?: string }) => call("DELETE", `social/${encodeURIComponent(accountId ?? "")}`),
 };
 
+/**
+ * Leave for Google or GitHub. The browser goes to this app's own route, which asks Laravel
+ * where the provider's page is: nothing about the sign-in passes through the page's script.
+ */
+async function toProvider(provider: string, next?: string, link = false): Promise<AuthResult<never>> {
+  const query = new URLSearchParams({ next: next ?? "/dashboard", ...(link ? { link: "1" } : {}) });
+  window.location.assign(`/api/auth/oauth/${encodeURIComponent(provider)}?${query}`);
+  // The page is going; nothing more happens here.
+  return new Promise(() => {});
+}
+
 /**
  * Upload a profile picture. It is the request body, so the browser can report progress,
  * and Laravel optimises it like any image field: a 400×400 square with a small thumbnail.

package/template/web/lib/auth-config.ts

@@ -9,7 +9,7 @@
  */
 export type SocialProvider = "google" | "github" | "apple" | "microsoft";
 
-// nevela:generated:start hash=68b0e3641ced
+// nevela:generated:start hash=f61dde748946
 export const authConfig = {
   /** People can create their own account at /sign-up. */
   registration: false,
@@ -31,7 +31,10 @@ export const authConfig = {
   checkBreachedPasswords: true,
   /** People can close their own account, from the Account page. */
   closeAccount: true,
-  /** Signing in with Google, GitHub and the like isn't part of Nevela yet. */
+  /**
+   * Always empty here. Which of Google and GitHub show is asked of Laravel on each
+   * page, so SOCIAL_AUTH_ENABLED needs no generate or rebuild: see lib/social.ts.
+   */
   social: [] as SocialProvider[],
 };
 // nevela:generated:end

package/template/web/lib/social.ts

@@ -0,0 +1,22 @@
+import type { SocialProvider } from "@/lib/auth-config";
+import { laravel } from "@/lib/laravel";
+
+const KNOWN: SocialProvider[] = ["google", "github", "apple", "microsoft"];
+
+/**
+ * The providers people can sign in with: switched on in the Laravel app
+ * (SOCIAL_AUTH_ENABLED) and given their keys there.
+ *
+ * Asked of Laravel each time a page needs it, so turning the switch on or off takes effect
+ * with no `nevela generate` and no rebuild. None when Laravel can't be reached: a button
+ * that can't work isn't shown. For a server component; the browser never asks.
+ */
+export async function enabledSocialProviders(): Promise<SocialProvider[]> {
+  try {
+    const { ok, body } = await laravel("auth/config", { token: null });
+    const listed = ok ? (body as { social?: unknown }).social : [];
+    return Array.isArray(listed) ? KNOWN.filter((provider) => listed.includes(provider)) : [];
+  } catch {
+    return [];
+  }
+}

package/template/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nevela-web",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "private": true,
   "type": "module",
   "scripts": {