From ff7615ecd9cc2a1a89a84fcecf46607269dedc7c Mon Sep 17 00:00:00 2001 From: Fredrik Ekre Date: Fri, 24 Jul 2026 00:51:44 +0200 Subject: [PATCH] SSO: Backfill verified_at when associating an existing account When an existing non-SSO account is associated with an SSO login via `SSO_SIGNUPS_MATCH_EMAIL`, the user's `verified_at` is never set, even though the provider vouches for the address on every SSO login. Such users keep seeing the "verify your email" nudge unless they go through the manual email verification flow. Now `verified_at` is set on SSO login when the provider email matches the locally stored one, mirroring the existing behavior for new SSO users which get `verified_at` set on signup under the same conditions. Co-Authored-By: Claude Fable 5 --- src/api/identity.rs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/api/identity.rs b/src/api/identity.rs index 23411dc7..68359a94 100644 --- a/src/api/identity.rs +++ b/src/api/identity.rs @@ -336,6 +336,13 @@ async fn sso_login( user.name = user_name.clone(); } + user.save(conn).await?; + } else if user.verified_at.is_none() + && user.email == user_infos.email + && user_infos.email_verified.unwrap_or(CONFIG.sso_allow_unknown_email_verification()) + { + // The email verification is handled by the provider, backfill for accounts created before SSO + user.verified_at = Some(now); user.save(conn).await?; }