[mattwoberts]

Fixes #1761

Problem

GitHub's GET /user only returns the user's public email. Anyone without a public email signed in with an empty email, so they got no notifications. Fider never called /user/emails, even though it already requests the user:email scope.

Changes

• GitHub: when the public email is empty, use the primary verified address from GET /user/emails. If that call fails (e.g. a GitHub App without the "Email addresses" permission returns 403), log a warning and sign in without an email, as before.
• Google: drop the email when verified_email isn't true.
• Backfill: an existing user with no email gets the provider's email on their next sign-in, unless another user already has it. This fixes accounts created before this change.
• These email fixes only apply to the built-in provider configs (!guard). Custom providers and Facebook are unchanged. Facebook only returns confirmed emails.

Tests

• app/services/oauth/email_internal_test.go: GitHub primary/verified selection, public email skips the extra call, 403 fallback, Google verified/unverified.
• app/handlers/oauth_test.go: backfill on sign-in, and no change when another user has the email.

🤖 Generated with Claude Code

[mattwoberts]

@kevinpapst Want to take a quick look before it comes in?

[Copilot]

🟡 Changes recommended

The OAuth email backfill uses a stale empty-email check and an unconditional update, which can overwrite an email address the user concurrently confirmed in another tab.

1 open issue

• Email backfill can overwrite a concurrently updated address · New

What changed in this PR

This PR addresses #1761 by retrieving private GitHub email addresses for OAuth sign-ins, helping affected users receive notifications.

Changes:

• Fetches the primary verified GitHub email when the public email is absent, with a non-blocking fallback on failure.
• Removes unverified Google emails from built-in provider profiles.
• Backfills missing user emails on sign-in when the address is available, with tests for backfill and provider behavior.

File	Description
app/​services/​oauth/​oauth.go	Adds GitHub email retrieval and Google email verification filtering.
app/​services/​oauth/​email_internal_test.go	Tests provider email selection, filtering, and fallback behavior.
app/​handlers/​oauth.go	Adds email backfill for existing users during sign-in.
app/​handlers/​oauth_test.go	Tests successful backfill and skipping addresses already in use.

_{Review effort: Balanced}

[kevinpapst]

As I am not a Go dev, I tested the branch instead of doing a code review (Copilot is better anyway) like this:

• Created a new Github OAuth app
• Ran the branch locally on a database that didn't knew my account yet
• Logged in with Github => the account was created including the Email

Then I set an empty string via update users set email = '' where id = 2; as if it was an existing account and logged in a second time: the email was backfilled correctly.

So the logic works as expected, thanks for the quick fix 👍