Merge commit from fork

* fix: ensure external user's email is verified before auto-linking

* fix linking

apps/login/src/lib/server/idp-intent.test.ts

@@ -101,6 +101,10 @@ describe("processIDPCallback", () => {
       },
       email: {
         email: "[email protected]",
+        verification: {
+          case: "isVerified",
+          value: true
+        }
       },
     },
     updateHumanUser: {
@@ -112,6 +116,10 @@ describe("processIDPCallback", () => {
       },
       email: {
         email: "[email protected]",
+        verification: {
+          case: "isVerified",
+          value: true
+        }
       },
     },
   };

apps/login/src/lib/server/idp-intent.ts

@@ -359,8 +359,9 @@ async function handleAutoLinking(ctx: IDPHandlerContext): Promise<IDPHandlerResu
   if (options?.autoLinking) {
     let foundUser;
     const email = addHumanUser?.email?.email;
+    const emailVerified = addHumanUser?.email?.verification?.case === "isVerified" && addHumanUser?.email?.verification?.value;
 
-    if (options.autoLinking === AutoLinkingOption.EMAIL && email) {
+    if (options.autoLinking === AutoLinkingOption.EMAIL && email && emailVerified) {
       foundUser = await listUsers({ serviceConfig, email, organizationId: organization }).then((response) => {
         return response.result ? response.result[0] : null;
       });
@@ -372,15 +373,6 @@ async function handleAutoLinking(ctx: IDPHandlerContext): Promise<IDPHandlerResu
       }).then((response) => {
         return response.result ? response.result[0] : null;
       });
-    } else {
-      foundUser = await listUsers({
-        serviceConfig,
-        userName: idpInformation!.userName,
-        email,
-        organizationId: organization,
-      }).then((response) => {
-        return response.result ? response.result[0] : null;
-      });
     }
 
     if (foundUser) {

internal/api/ui/login/external_provider_handler.go

@@ -551,7 +551,11 @@ func (l *Login) checkAutoLinking(r *http.Request, authReq *domain.AuthRequest, p
 		}
 		queries = append(queries, usernameQuery)
 	case domain.AutoLinkingOptionEmail:
-		// Email will always be checked against verified email addresses.
+		// When checking for email matches, we need to make sure that both (the one from the IdP and the one in Zitadel)
+		// are verified to prevent potential account takeovers.
+		if !externalUser.IsEmailVerified {
+			return false, nil
+		}
 		emailQuery, err := query.NewUserVerifiedEmailSearchQuery(string(externalUser.Email))
 		if err != nil {
 			return false, nil