Merge commit from fork

* fix: ensure external user's email is verified before auto-linking

* fix linking

apps/login/src/lib/server/idp-intent.test.ts

@@ -101,6 +101,10 @@ describe("processIDPCallback", () => {
       },
       email: {
         email: "[email protected]",
+        verification: {
+          case: "isVerified",
+          value: true
+        }
       },
     },
     updateHumanUser: {
@@ -112,6 +116,10 @@ describe("processIDPCallback", () => {
       },
       email: {
         email: "[email protected]",
+        verification: {
+          case: "isVerified",
+          value: true
+        }
       },
     },
   };

apps/login/src/lib/server/idp-intent.ts

@@ -359,8 +359,9 @@ async function handleAutoLinking(ctx: IDPHandlerContext): Promise<IDPHandlerResu
   if (options?.autoLinking) {
     let foundUser;
     const email = addHumanUser?.email?.email;
+    const emailVerified = addHumanUser?.email?.verification?.case === "isVerified" && addHumanUser?.email?.verification?.value;
 
-    if (options.autoLinking === AutoLinkingOption.EMAIL && email) {
+    if (options.autoLinking === AutoLinkingOption.EMAIL && email && emailVerified) {
       foundUser = await listUsers({ serviceConfig, email, organizationId: organization }).then((response) => {
         return response.result ? response.result[0] : null;
       });
@@ -372,15 +373,6 @@ async function handleAutoLinking(ctx: IDPHandlerContext): Promise<IDPHandlerResu
       }).then((response) => {
         return response.result ? response.result[0] : null;
       });
-    } else {
-      foundUser = await listUsers({
-        serviceConfig,
-        userName: idpInformation!.userName,
-        email,
-        organizationId: organization,
-      }).then((response) => {
-        return response.result ? response.result[0] : null;
-      });
     }
 
     if (foundUser) {