mirror of
https://github.com/vxcontrol/pentagi.git
synced 2026-09-01 16:05:37 +00:00
Sergey KozyrenkoandClaude Opus 4.8
2d2aea5785
The OAuth callback links/creates an account by the email from ResolveEmail, and Google/GitHub only ever return a verified address — but that invariant lived inside each provider and was invisible at the callback. A future OAuth provider that omitted the verified check would let an attacker register a victim's email there (unverified), "sign in", and be linked straight into the victim's account: instant takeover. Make verification part of the contract: ResolveEmail now returns (email, verified, err), and the callback refuses to proceed when !verified. Because Go's bool zero value is false and the compiler forces the new return, a provider that forgets to report verification fails closed (its own login breaks) rather than opening a takeover. Google reports claims.EmailVerified; GitHub only selects verified addresses, so reports true. Added a callback test: a provider reporting an unverified email is rejected (no link, no session) — red before the gate, green after. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>