Secure cross-platform account linking #16

Context

Tiers are tied to Discord IDs. For Pixel to recognise a member on Telegram (#17) or any future interactive platform, they have to prove that the new account belongs to the same person as a trusted Discord account. This is the most security-sensitive feature in the roadmap.

The identity doc sketches the flow:

1. The person asks for a one-time link code from their (trusted) Discord account. The code is shown only to them.
2. They redeem it in a private chat on the new platform.
3. Codes:
   • are high-entropy, short-lived and single-use
   • are stored only as a hash
   • are rate-limited
   • are redeemed safely even if two attempts race
4. Both accounts are notified when a link happens, with an easy way to undo it.

Depends on #15 (database).

Goal

People can securely link and unlink accounts across platforms. Linked accounts share one identity and tier.

Scope

• An identity model: a person with one or more platform accounts
• Commands: request a link code, redeem it, unlink, and show linked accounts in /whoami
• Tiers: identity resolution works through linked accounts, so a member's Telegram account resolves to their tier
• Audit: an audit record for every link and unlink, plus notifications to both accounts
• Abuse limits: rate limits per user, per code, and overall

Acceptance criteria

• Threat cases have tests:
  • expired, reused and wrong codes
  • redemption attempted in a group chat
  • brute-force attempts
  • two concurrent redemptions of the same code
  • unlinking
• The plaintext code is never stored or logged
• A link never grants more than the trusted account's tier
• docs/identity-and-access.md is updated, plus an ADR
• Security review by a second person before merge

Considerations

• The direction of trust: codes always go from an already-trusted account to the new one, never the reverse
• Should every person get a database identity when they first interact, or only when they link? Minimise stored data
• /forget-me: deleting a person and their links (GDPR, Privacy notice and data retention (GDPR) #7)
• Tiers come from Pixel's own data (the access store, Writable access store: members, friends and capabilities managed by admin commands #25), not from Discord roles, so a linked account simply shares that record. There's no role-freshness problem for people who only use Telegram. (This replaces the earlier idea of reading Discord roles, Discord role sync tier source #14, which was closed.)
• The access store is keyed by platform ID today (Discord). Linking is what lets other platforms' accounts point at the same person

References

• docs/identity-and-access.md: Later phases