Fix Auth: GitHub and Facebook sign-in for existing users

Merged
ND
1mo ago
+207-5

Fixes #10664

GitHub and Facebook sign-in always sent existing users to the register page, because the OAuth email check skips any address without a verified flag and neither strategy set one. GitHub now keeps its own per-address verified flag, with the primary address tried first, and Facebook marks its /me email as verified, as the token sign-in already does. Addresses GitHub reports as unverified are still refused and the shared email check is untouched. A GitHub account with no display name also stops failing before the email check.

Summary by cubic

Fixes #10664 by making GitHub and Facebook sign-in recognize existing users. Both strategies omitted the verified flag on OAuth emails, so the shared email check treated every address as unverified and existing users always landed on the register page.

  • GitHub keeps its own verified and primary flags per address via allRawEmails and offers only the primary address, matching the token sign-in; addresses GitHub reports as unverified are still refused.
  • Facebook marks its /me email as verified, matching the token sign-in, and never marks an empty value as verified.
  • A GitHub account with no display name no longer fails before the email check.