storage: allow filtering upstream OAuth links by subject

crates/storage-pg/src/upstream_oauth2/link.rs

@@ -101,6 +101,9 @@ impl Filter for UpstreamOAuthLinkFilter<'_> {
                         .take(),
                 ))
             }))
+            .add_option(self.subject().map(|subject| {
+                Expr::col((UpstreamOAuthLinks::Table, UpstreamOAuthLinks::Subject)).eq(subject)
+            }))
     }
 }
 

crates/storage-pg/src/upstream_oauth2/mod.rs

@@ -192,6 +192,7 @@ mod tests {
         let filter = UpstreamOAuthLinkFilter::new()
             .for_user(&user)
             .for_provider(&provider)
+            .for_subject("a-subject")
             .enabled_providers_only();
 
         let links = repo

crates/storage/src/upstream_oauth2/link.rs

@@ -18,6 +18,7 @@ pub struct UpstreamOAuthLinkFilter<'a> {
     user: Option<&'a User>,
     provider: Option<&'a UpstreamOAuthProvider>,
     provider_enabled: Option<bool>,
+    subject: Option<&'a str>,
 }
 
 impl<'a> UpstreamOAuthLinkFilter<'a> {
@@ -76,6 +77,19 @@ impl<'a> UpstreamOAuthLinkFilter<'a> {
     pub const fn provider_enabled(&self) -> Option<bool> {
         self.provider_enabled
     }
+
+    /// Set the subject filter
+    #[must_use]
+    pub const fn for_subject(mut self, subject: &'a str) -> Self {
+        self.subject = Some(subject);
+        self
+    }
+
+    /// Get the subject filter
+    #[must_use]
+    pub const fn subject(&self) -> Option<&str> {
+        self.subject
+    }
 }
 
 /// An [`UpstreamOAuthLinkRepository`] helps interacting with