# `MishkaCmsCore.Accounts.SocialSignIn`
[🔗](https://github.com/mishka-group/mishka_cms_core/blob/v0.0.1/lib/mishka_cms_core/accounts/_social_sign_in.ex#L5)

What a sign-in with a provider — Google, GitHub, any `SignInProvider` plugin — may do, on each provider's register
action on `MishkaCmsCore.Accounts.User`, beside AshAuthentication's own rules
(`AshAuthentication.Strategy.OAuth2.IdentityChange`):

  * **The email has to be verified by the provider**, or nothing happens: an account is found, made
    and confirmed by that email, so one the provider did not vouch for proves nothing.
  * **A site's account**: the provider's identity, else the email, finds it. With none, one is
    made only while the site makes accounts this way (`SignInProvider.register?/1`), takes
    registrations (`AuthGate` `:register`) and is not offline. An account found is held to the
    site's sign-in gate (`AuthGate` `:sign_in`).
  * **A master** — the master site's sign-in page with `?master_user=true`, which leaves the
    request with no tenant: only a master's own identity, else a master's email, signs in. A
    master is never made this way, and the lookups never reach a site's accounts.
  * **An account nobody confirmed** is claimed by the provider's verified email: confirmed, its
    password, authenticator and recovery codes removed, and every session of it signed out
    (`:claim_unconfirmed`), before the sign-in. Whoever made it without confirming the email, with
    a password of their choosing, keeps nothing.

An account made by a provider has no password; it can set one later (`:set_password`). Every
account made or found here is confirmed: the provider's verified email is the confirmation.

**The provider's tokens are not kept.** Nothing here calls the provider after the sign-in, so the
identity row holds the provider and its user id and no access or refresh token that a leaked
database would hand over. The provider's answer arrives as claims — `sub`, `email`,
`email_verified` — as Assent reads each provider's own, and its identity is named after the
provider the request ran (`"provider/<id>"`, `MishkaCmsCore.Accounts.ProviderStrategy`).

Refusals are `MishkaCmsCore.Accounts.SocialSignIn.Refused`, or the gate's own
`MishkaCmsCore.Accounts.AuthGate.Closed`.

# `describe`

```elixir
@spec describe(atom()) :: %{title: String.t(), text: String.t()}
```

What to tell whoever was refused, in their language.

# `refusal`

```elixir
@spec refusal(term()) :: %{reason: atom()} | nil
```

The refusal anywhere inside `reason` — an error, an error class, or AshAuthentication's
`AuthenticationFailed` around one — or `nil`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*