Stage 11: account linking & merge (email + Telegram Login Widget) (#12)

backend/internal/server/handlers.go

@@ -10,6 +10,7 @@ import (
 	"go.uber.org/zap"
 
 	"scrabble/backend/internal/account"
+	"scrabble/backend/internal/accountmerge"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/lobby"
@@ -42,9 +43,15 @@ func (s *Server) registerRoutes() {
 		u.PUT("/profile", s.handleUpdateProfile)
 		u.GET("/stats", s.handleStats)
 	}
-	if s.emails != nil {
-		u.POST("/email/request", s.handleEmailBindRequest)
-		u.POST("/email/confirm", s.handleEmailBindConfirm)
+	if s.links != nil {
+		// Account linking & merge (Stage 11). The request step always mails a code;
+		// a required merge is revealed only after the code is verified, and the
+		// irreversible merge is an explicit second step.
+		u.POST("/link/email/request", s.handleLinkEmailRequest)
+		u.POST("/link/email/confirm", s.handleLinkEmailConfirm)
+		u.POST("/link/email/merge", s.handleLinkEmailMerge)
+		u.POST("/link/telegram", s.handleLinkTelegram)
+		u.POST("/link/telegram/merge", s.handleLinkTelegramMerge)
 	}
 	if s.games != nil {
 		u.GET("/games", s.handleListGames)
@@ -179,8 +186,10 @@ func statusForError(err error) (int, string) {
 		return http.StatusConflict, "hint_unavailable"
 	case errors.Is(err, engine.ErrIllegalPlay), errors.Is(err, engine.ErrTilesNotOnRack), errors.Is(err, engine.ErrGameOver):
 		return http.StatusUnprocessableEntity, "illegal_play"
-	case errors.Is(err, account.ErrEmailTaken):
+	case errors.Is(err, account.ErrEmailTaken), errors.Is(err, account.ErrIdentityTaken):
 		return http.StatusConflict, "email_taken"
+	case errors.Is(err, accountmerge.ErrActiveGameConflict):
+		return http.StatusConflict, "merge_active_game_conflict"
 	case errors.Is(err, account.ErrInvalidEmail):
 		return http.StatusBadRequest, "invalid_email"
 	case errors.Is(err, account.ErrCodeMismatch), errors.Is(err, account.ErrCodeExpired),