# Social Account Binding Closure

Date: 2026-03-26

## Scope

Closed the PRD social-account-management gap at product implementation level:

- backend now supports authenticated social binding start, bind callback completion, sanitized bound-account listing, and guarded unbind
- frontend security page now exposes a real social account management section under `/profile/security`
- unbind now requires password or TOTP when such factors exist and refuses removal when no login method would remain

## Validation

Executed and passed:

```powershell
go test ./... -count=1
go build ./cmd/server

cd D:\project\frontend\admin
npm.cmd run lint
npm.cmd run test:run -- src/services/auth.test.ts src/services/social-accounts.test.ts src/pages/admin/ProfileSecurityPage/ProfileSecurityPage.social.test.tsx
npm.cmd run build
powershell -ExecutionPolicy Bypass -File .\scripts\run-playwright-auth-e2e.ps1
```

Observed browser-regression result:

- `PASS login-surface`
- `PASS auth-workflow`
- `PASS responsive-login`
- `PASS desktop-mobile-navigation`
- `Playwright CDP E2E completed successfully`

## Real Remaining Gap

This closes the product-side PRD gap for social account management, but it does **not** create live third-party OAuth evidence.

Still missing:

- real provider credentials under controlled test environment
- live browser proof for third-party authorize -> callback -> bind -> unbind on GitHub/WeChat/etc.

Current closure level is therefore:

- product implementation: closed
- unit/integration/regression validation: closed
- third-party live-provider browser evidence: still open
