Accounts and sign-in

Decision (owner, round 6): players sign in with one tap using their Google account, on the website and in the game. One Zoen account per Google account; the same account works on every platform. Status: proposed design, built in M6 (gateway) and M11 (site + store builds). Data: web-account.json → auth.

◆Flows per platform

• iOS rule: Apple's App Review Guidelines require an equivalent privacy-focused login option when an app uses a third-party login such as Google; Sign in with Apple satisfies it. Re-check the current guideline wording at M11.
• An Apple-only player gets a normal Zoen account; they can link Google later (and the other way round).

◆Server side (gateway)

1. Verify every Google ID token on the server: signature against Google's published keys (cached), iss is Google, aud is one of our client IDs, exp not passed, and the nonce we issued. Never trust a token the client only decoded.
2. Look up the account by the provider's stable subject id (sub), not by email. Store the email only for account recovery notices (never shown publicly, never in the public API).
3. Issue Zoen's own session: a short-lived access token (15 min) and a rotating refresh token bound to the device; "Sign out everywhere" revokes every refresh token. Google tokens are not stored after verification.
4. First sign-in creates the account and asks only for a display name (character names are separate).
5. Rate-limit sign-in attempts per IP and per account; log every sign-in for the security system (Security & auto-ban).

◆Linking, recovery, deletion

• Settings → Account: link/unlink Google and Apple (at least one must stay linked).
• Lost Google access → support form on the site (not automated; identity checked by staff).
• Account deletion from the site and in-game (store requirement), with a 14-day grace period; ranking entries are anonymised, receipts kept only as long as the law requires.

◆Website one-tap details

• Use GIS One Tap (which uses the browser's FedCM support where available) plus the standard button. Show One Tap on the home page and on "Play in browser"; never on top of video or on checkout.
• Redirect mode must check the g_csrf_token cookie/body pair; popup mode uses the nonce.
• Signed-in pages: Caravan Ledger, Redeem key, Account, the inventory playground's "load my character".

◆Owner setup (agents never create accounts)

1. A Google Cloud project for Zoen (free) → OAuth consent screen (app name, logo, privacy policy and terms URLs).
2. OAuth client IDs: Web (site origins), Android (package name + signing-certificate SHA-1), iOS (bundle id), Desktop (Windows launcher, loopback).
3. Apple Developer account (OPEN-5) for Sign in with Apple and the iOS build.
4. Give the client IDs to the agent as configuration (they are not secrets); any client secret goes into the server's secret store, never into the repo.

◆Tests

• Gateway: verification rejects wrong aud, expired, bad signature, missing nonce; a replayed token fails.
• Site: Playwright with a mocked GIS script (no real Google login in CI).
• Clients: PlayMode test with a stubbed provider returns a gateway session; the Windows flow is tested against a local fake authorization server.