feat: fb and google oauth

internal/repository/user_repo.go

@@ -62,6 +62,32 @@ func (r *UserRepo) FindByEmail(ctx context.Context, email string) (*model.User,
 		`WHERE email = $1`, strings.ToLower(strings.TrimSpace(email)))
 }
 
+// CreateOAuth inserts a user with a NULL password_hash — used by the OAuth
+// sign-in flow when there's no matching email yet. Same handle-collision
+// retry contract as Create.
+func (r *UserRepo) CreateOAuth(ctx context.Context, email, name, handle string, avatarURL *string, emailVerified bool) (*model.User, error) {
+	const q = `
+		INSERT INTO users (email, password_hash, name, handle, avatar_url, email_verified_at)
+		VALUES ($1, NULL, $2, $3, $4, CASE WHEN $5::boolean THEN now() ELSE NULL END)
+		RETURNING id, email, handle, password_hash, name, avatar_url, role, plan,
+		          email_verified_at, token_version, created_at, updated_at`
+	u := &model.User{}
+	err := r.pg.Pool.QueryRow(ctx, q,
+		strings.ToLower(strings.TrimSpace(email)), name, handle, avatarURL, emailVerified,
+	).Scan(&u.ID, &u.Email, &u.Handle, &u.PasswordHash, &u.Name, &u.AvatarURL, &u.Role, &u.Plan,
+		&u.EmailVerifiedAt, &u.TokenVersion, &u.CreatedAt, &u.UpdatedAt)
+	if err != nil {
+		if isUniqueViolation(err, "users_handle_key") {
+			return nil, ErrHandleTaken
+		}
+		if isUniqueViolation(err, "users_email_key") {
+			return nil, ErrEmailTaken
+		}
+		return nil, fmt.Errorf("create oauth user: %w", err)
+	}
+	return u, nil
+}
+
 // FindByID returns the user with the given id, or ErrUserNotFound.
 func (r *UserRepo) FindByID(ctx context.Context, id string) (*model.User, error) {
 	return r.findOne(ctx, `WHERE id = $1`, id)