Módulo más que un social login

v1.0.02026/09/29

First version.

• Access and registration with Google through the authorization code flow, with state and nonce of random_bytes() and PKCE S256 .
• Google One Tap with FedCM ( data-use_fedcm_for_prompt ), by data-callback and not by data-login_uri : the token arrives at our JavaScript and is sent by the store, with the nonce that generated that same page.
• Full identity token verification : mandatory RS256 algorithm, signature against Google's JWKS with cache and key rotation retry, iss , aud , exp , iat and nonce .
• TLS verified without the possibility of turning it off on all outgoing calls, using PrestaShop's own authority package and without following redirects.
• Table of links with unique key (supplier, identifier, store) .
• A deactivated or deleted client cannot log in and cannot be reactivated .
• The email address must be verified by the provider. Without it, it won't be paired with any account, no matter what.
• Those who registered using the standard form can log in with Google without further steps , and the two access methods are linked: this is what Decathlon and Zalando do. This is possible because the email is verified—anyone who proves to Google that they own that email address could already log in with "forgot your password," so asking for the password again creates a barrier, not added security. Merchants who prefer this barrier can configure it in a setting.
• The first time this happens, the "your accounts are already linked" screen appears , so the customer doesn't miss out on knowing if they have one account or two.
• Full-width buttons with the legal notice below , linking to the store's terms and conditions and privacy policy. The entire phrase is translated, with the two links as blanks, so each language can place them where appropriate.
• Confirmation screen with genuine consent before creating an account, with a link to the privacy policy and an optional newsletter checkbox. It comes unlit : the legal notice is already next to the buttons, which is where it's read.
• Screen of linked accounts in the client area, with unlinking by POST and witness.
• GDPR hooks implemented : export and deletion of links.
• Limit of attempts per IP on public endpoints, with the saved IP summarized.
• The return address goes through a sanitizer that only returns addresses from the store itself.
• Return URI set to default language : a single one to register with Google. The visitor's language is included in the attempt.
• Spanish and English.