The last post built a password + Google sign-in MVP with brkpt-auth. This one makes two changes to that same project, the kind that come up naturally as a product grows, and checks what moved.
Adding a unique username, without giving up email sign-in
Say the product now needs a public, unique handle, something people can share and search for, that isn't tied to an email address they might change later. username is that field: unique, and usable for sign-in alongside email, which stays unique too and stays valid for signing in as well.
Worth being upfront here: credentials is meant to be a plain username-and-password flow, it was only using email as the identifier earlier in this series for convenience. It still collects email in this signup form, for the same reason, keeping the focus on the identifier and OAuth changes below. That does leave a real gap: nothing here verifies a user actually owns the email they typed in. On its own, that's harmless. Combined with OAuth, it isn't: register with a stranger's email through credentials, and when the real owner later signs in with Google using that same address, OAuth attaches their identity to the account someone else created. brkpt-auth's verify-email feature closes this by restricting access until the address is confirmed; another option is collecting email through otp instead, verified before it's ever attached to an account. Neither is added here, to stay focused on the changes below.
