Function canDisconnect

apps/api/src/lib/oauth/oauth.utils.ts:184–220

(
  providers: readonly IProviderRow[],
  providerName: string,
  emailProviderKey: string
)

 * disconnecting an OAuth provider deletes the link row outright.
 */
export const canDisconnect = (
  providers: readonly IProviderRow[],
  providerName: string,
  emailProviderKey: string
): DisconnectDecision => {
  if (providers.length === 0) {
    return { ok: false, reason: NOT_FOUND_REASON };
  }

  const target = providers.find((row) => row.provider === providerName);

  if (target === undefined) {
    return { ok: false, reason: NOT_FOUND_REASON };
  }

  const hasPassword = providers.some(
    (row) => row.provider === emailProviderKey && row.passwordHash !== ""
  );

  const oauthCount = providers.filter(
    (row) => row.provider !== emailProviderKey
  ).length;

  if (providerName === emailProviderKey) {
    if (oauthCount === 0) {
      return { ok: false, reason: KEEP_ONE_METHOD_REASON };
    }

    return { ok: true, action: "clear-password" };
  }

  if (!hasPassword && oauthCount <= 1) {
    return { ok: false, reason: KEEP_ONE_METHOD_REASON };
  }

  return { ok: true, action: "delete" };
};