Prevent Google account pre-hijacking and unsafe email-based identity merging by persisting the provider subject, indexing it independently, rejecting unverified password-account collisions and email races, reconciling only identical Google identities, and covering both service-level concurrency and the protected external-auth callback path.

2026-09-10T09:02:26+00:00

progmaweb/apps/api-tests/AccountServiceTests.cs, branch docs/api-and-web-reference