Check email_verified in id_token and user_info

src/sso.rs

@@ -462,14 +462,11 @@ pub async fn exchange_code(wrapped_code: &str, conn: &mut DbConn) -> ApiResult<U
                 }
             };
 
-            let email = match id_claims.email() {
+            let email = match id_claims.email().or(user_info.email()) {
-                Some(email) => email.to_string(),
+                None => err!("Neither id token nor userinfo contained an email"),
-                None => match user_info.email() {
+                Some(e) => e.to_string().to_lowercase(),
-                    None => err!("Neither id token nor userinfo contained an email"),
+            };
-                    Some(email) => email.to_owned().to_string(),
+            let email_verified = id_claims.email_verified().or(user_info.email_verified());
-                },
-            }
-            .to_lowercase();
 
             let user_name = user_info.preferred_username().map(|un| un.to_string());
 
@@ -486,7 +483,7 @@ pub async fn exchange_code(wrapped_code: &str, conn: &mut DbConn) -> ApiResult<U
                 expires_in: token_response.expires_in(),
                 identifier: identifier.clone(),
                 email: email.clone(),
-                email_verified: id_claims.email_verified(),
+                email_verified,
                 user_name: user_name.clone(),
             };
 
@@ -496,7 +493,7 @@ pub async fn exchange_code(wrapped_code: &str, conn: &mut DbConn) -> ApiResult<U
                 state,
                 identifier,
                 email,
-                email_verified: id_claims.email_verified(),
+                email_verified,
                 user_name,
             })
         }