From b32370177442539efa32c5284555f759ed08e89c Mon Sep 17 00:00:00 2001 From: Mocha Date: Mon, 27 Jul 2026 01:51:42 +0200 Subject: [PATCH] fix(sso): trust absent email_verified claim and relax auth code length limit (#1493) --- fluxer_api/src/api/auth/services/SsoService.ts | 2 +- packages/schema/src/domains/auth/AuthSchemas.ts | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/fluxer_api/src/api/auth/services/SsoService.ts b/fluxer_api/src/api/auth/services/SsoService.ts index 737c8b9e2..815c2eb3a 100644 --- a/fluxer_api/src/api/auth/services/SsoService.ts +++ b/fluxer_api/src/api/auth/services/SsoService.ts @@ -224,7 +224,7 @@ function resolveEmailVerified({ if (values.includes(false)) { return false; } - return values.includes(true); + return values.length === 0 || values.includes(true); } function isJsonWebKeySet(value: unknown): value is JSONWebKeySet { diff --git a/packages/schema/src/domains/auth/AuthSchemas.ts b/packages/schema/src/domains/auth/AuthSchemas.ts index 9c0244042..b64685fc5 100644 --- a/packages/schema/src/domains/auth/AuthSchemas.ts +++ b/packages/schema/src/domains/auth/AuthSchemas.ts @@ -260,8 +260,8 @@ export const SsoStartRequest = z.object({ export type SsoStartRequest = z.infer; export const SsoCompleteRequest = z.object({ - code: createStringType().describe('Authorization code from the SSO provider'), - state: createStringType().describe('State parameter for CSRF protection'), + code: createStringType(1, 4096).describe('Authorization code from the SSO provider'), + state: createStringType(1, 4096).describe('State parameter for CSRF protection'), }); export type SsoCompleteRequest = z.infer;