MySanctum pattern

MySanctum is a reference for account linkage: provider identities are attached as verified connections owned by the current user instead of being treated as interchangeable login sessions.

Pattern to preserve

1. Authenticate the Clawdbase user first.
2. Create a signed provider intent containing user ID, purpose, state and return route.
3. Complete provider OAuth separately.
4. Validate the callback against the intent.
5. Upsert the connection using provider plus immutable account ID.
6. Leave the primary application session unchanged.

Clawdbase adds canonical Page matching and automatic scoring while keeping the Sanctum account handoff explicit. A Sanctum identity is not automatically a public Clawdbase Page.

Why this pattern matters

Application sign-in answers “who is using Clawdbase?” Provider verification answers “which external identity can this user prove control over?” Combining those questions causes an X, GitHub or Telegram callback to replace the current account, lose the initiating workflow and attach assets to the wrong user.

Intent payload

A purpose-bound intent should contain an opaque state, original user ID, provider, purpose, safe return path and expiry. PKCE verifier or provider tokens stay in HttpOnly/server storage. The callback rejects missing, expired, mismatched or replayed intent.

type ProviderIntent = {
  user_id: string
  provider: 'x' | 'github' | 'telegram'
  purpose: 'connection' | 'add_page'
  return_to: string
  state: string
  expires: number
}

Clawdbase extensions

After verification, Clawdbase upserts clawdbase_provider_connections by immutable provider account ID. Page registration then matches or creates clawdbase_page_registrations and adds an ownership relation. These are separate records with separate deletion and privacy behavior.

Acceptance checks

• Connecting a second provider account leaves the Clawdbase session unchanged.
• A provider identity already owned elsewhere fails before fallback writes.
• Reauthorizing the same identity updates one connection row.
• Add Page creates or matches one canonical Page.
• Callback errors return to the initiating tab, not the landing page.
• Sign-out occurs only through an explicit account action.

Use the MySanctum implementation as a pattern reference during maintenance, but keep Clawdbase constants, routes, tables and UI independent.