chore: fix

apps/web/modules/ee/sso/lib/tests/sso-handlers.test.ts

@@ -403,6 +403,32 @@ describe("handleSsoCallback", () => {
         isActive: true,
       });
 
+      const githubAccount = { ...mockAccount, provider: "github" };
+
+      await expect(
+        handleSsoCallback({
+          user: mockUser,
+          account: githubAccount,
+          callbackUrl: "http://localhost:3000",
+        })
+      ).rejects.toThrow("OAuthAccountNotLinked");
+      expect(upsertAccount).not.toHaveBeenCalled();
+      expect(updateUser).not.toHaveBeenCalled();
+      expect(createUser).not.toHaveBeenCalled();
+    });
+
+    test("should reject legacy google users when the provider account id does not match the stored legacy link", async () => {
+      vi.mocked(prisma.account.findUnique).mockResolvedValue(null);
+      vi.mocked(prisma.user.findFirst).mockResolvedValue(null);
+      vi.mocked(getUserByEmail).mockResolvedValue({
+        id: "existing-user-id",
+        email: mockUser.email,
+        emailVerified: new Date(),
+        identityProvider: "google",
+        locale: mockUser.locale,
+        isActive: true,
+      });
+
       await expect(
         handleSsoCallback({
           user: mockUser,