feat(api|runtime): add an AuthenticateProvider registry

[flaviofernandes004]

No description provided.

[Copilot]

Pull request overview

Adds an AuthenticateProvider registry with provider-agnostic authentication, identity linking, persistence, runtime integrations, and console support.

Changes:

• Adds provider registration, hooks, and runtime APIs.
• Adds provider identity authentication, linking, unlinking, and account exposure.
• Updates migrations, protobufs, generated bindings, dependencies, documentation, and console assets.

Reviewed changes

Copilot reviewed 33 out of 53 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Final review
vendor/modules.txt	No final findings.
vendor/github.com/heroiclabs/nakama-common/runtime/runtime.go	No final findings.
vendor/github.com/heroiclabs/nakama-common/api/api.proto	No final findings.
server/runtime.go	No final findings.
server/runtime_lua.go	No final findings.
server/runtime_lua_nakama.go	No final findings.
server/runtime_lua_match_core.go	No final findings.
server/runtime_javascript.go	No final findings.
server/runtime_javascript_nakama.go	No final findings.
server/runtime_javascript_match_core.go	No final findings.
server/runtime_javascript_init.go	No final findings.
server/runtime_go.go	No final findings.
server/runtime_go_nakama.go	No final findings.
server/core_wallet_test.go	No final findings.
server/core_unlink.go	No final findings.
server/core_link.go	No final findings.
server/core_authenticate.go	No final findings.
server/core_account.go	No final findings.
server/console_unlink.go	No final findings.
server/console_runtime.go	No final findings.
server/console_config.go	No final findings.
server/console_audit.go	No final findings.
server/console_account.go	No final findings.
server/authenticate_provider_registry.go	No final findings.
server/api.go	No final findings.
server/api_unlink.go	No final findings.
server/api_link.go	No final findings.
server/api_authenticate.go	No final findings.
migrate/sql/20260819141500-add-user-provider.sql	No final findings.
go.sum	No final findings.
go.mod	No final findings.
console/ui/dist/index.html	No final findings.
console/console.swagger.json	No final findings.
console/console.proto	No final findings.
console/console_grpc.pb.go	No final findings.
console/acl/acl.go	No final findings.
CHANGELOG.md	No final findings.
apigrpc/apigrpc.swagger.json	Moderate (2 votes): Regenerate the schema to include apiAccount.providers and apiAccountProviderIdentity.
apigrpc/apigrpc.proto	No final findings.
apigrpc/apigrpc.pb.go	No final findings.
apigrpc/apigrpc_grpc.pb.go	No final findings.

Files not reviewed (3)

• apigrpc/apigrpc.pb.go: Generated file
• apigrpc/apigrpc_grpc.pb.go: Generated file
• console/console_grpc.pb.go: Generated file

Suppressed comments (5)

apigrpc/apigrpc.swagger.json:4133

• The generated OpenAPI description still says this payload is used only with authenticate, but LinkProvider and UnlinkProvider also accept api.AccountProvider. This makes the public API documentation contradict both the proto comment and the newly exposed endpoints; regenerate or update the schema description to mention all three operations.

      "description": "Send credentials for a runtime-registered authentication provider. Used with authenticate."

server/core_link.go:114

• LinkProvider does not reject an empty provider name before lowercasing and looking it up. A malformed link request therefore returns NotFound (or reaches an empty-name lookup) instead of the InvalidArgument validation used by AuthenticateProvider and UnlinkProvider, making bad input indistinguishable from an unregistered provider. Validate the required name before the registry lookup.
  server/runtime.go:373
• These fields advertise Lua/JavaScript provider registries, but registration is exposed only through the Go Initializer.RegisterAuthenticateProvider implementation and only GoAuthenticateProviders is populated (runtime.go:2906-2910). Consequently every RuntimeInfo response reports empty Lua/JavaScript provider lists; remove those fields or add the corresponding registration and population plumbing before exposing them.
  server/runtime_javascript_nakama.go:1898
• GetAccount, GetAccounts, and account import now return provider identities, but the shared accountToJsObject conversion still omits account.Providers. Therefore JavaScript runtime account APIs and imports silently drop the linked identities introduced by this feature. Include the providers array (with the corresponding provider user ID field) in this conversion.
  server/runtime_lua_nakama.go:2181
• The new provider identities are loaded into api.Account, but the Lua account serializers (accountGetId, accountsGetId, and account import) still only copy devices, custom IDs, and the legacy fields; they never emit account.Providers. As a result Lua code cannot observe identities linked through this provider API. Add a providers table containing each provider and provider user ID in all of those account conversions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 33 out of 53 changed files in this pull request and generated 3 comments.

Files not reviewed (3)

• apigrpc/apigrpc.pb.go: Generated file
• apigrpc/apigrpc_grpc.pb.go: Generated file
• console/console_grpc.pb.go: Generated file

Suppressed comments (4)

apigrpc/apigrpc.swagger.json:4133

• The generated OpenAPI schema is incomplete for the new account field: apiAccount has no providers property and there is no apiAccountProviderIdentity definition, even though the API now returns linked provider identities. Clients generated from this spec will not discover that response data; regenerate the artifact from the updated common API proto. The description here also incorrectly says this request is used only with authenticate, while the new link and unlink routes use it too.

      "description": "Send credentials for a runtime-registered authentication provider. Used with authenticate."

server/core_account.go:164

• Although GetAccount now fills the public api.Account.Providers field, the Lua and JavaScript account adapters still omit this field (accountGetId, accountsGetId, and import results). Scripts using those APIs therefore see no linked provider identities, while Go/API/console consumers do. Add the provider arrays to each adapter using its existing snake_case/camelCase conversion conventions.
  server/runtime_javascript_nakama.go:2599
• GetAccount and GetAccounts now populate Account.Providers, but the JavaScript account conversion used by accountGetId, accountsGetId, and accountImportId never copies that field. JavaScript runtime callers consequently cannot see linked provider identities; add the provider array to this conversion using the JavaScript field names.
  server/runtime_lua_nakama.go:3314
• The Lua account serializers for account_get_id, accounts_get_id, and account_import_id omit account.Providers, even though the underlying account lookups now populate it. Lua callers therefore cannot inspect linked provider identities, unlike Go and the public account API; add a providers table to each account conversion.