@spfn/auth 0.2.0-beta.83 → 0.2.0-beta.84

package/README.md

@@ -268,10 +268,13 @@ no Google account is linked or no refresh token is available).
 Kakao's `is_email_valid` and `is_email_verified` claims are both required before its email can
 link an existing SPFN account. GitHub uses the primary email from `/user/emails` (needs the
 `user:email` scope) and treats it as verified only when GitHub marks it verified; without that
-scope it falls back to the public profile email, unverified. Naver provides an email address but no verified-email claim, so
-Naver login never links an existing account by email; new Naver users can verify and add their
-email through the application's normal onboarding flow. Until then, the OAuth account is identified
-by its provider and provider user ID, so its user row may have both email and phone unset.
+scope it falls back to the public profile email, unverified. Naver's profile email is either the
+Naver account email or a contact email that passed Naver's own verification, so a present email
+is treated as verified — it is stored on the user row and may link an existing account by email,
+the same trust level as Kakao. Accounts created before this policy (user row with `email` null)
+are backfilled on their next login: if the provider reports a verified email and no other account
+owns it, `email` and `emailVerifiedAt` are filled in (best-effort; a conflict skips the backfill
+and the login continues).
 
 ### Provider-initiated unlink notifications (`unlink-notify`)
 

package/dist/server.js

@@ -10097,8 +10097,9 @@ var naverProvider = {
     return {
       providerUserId: profile.id,
       email: typeof profile.email === "string" ? profile.email : null,
-      // Naver returns an email address but no independently verified-email claim.
-      emailVerified: false,
+      // 네이버 프로필 이메일은 네이버 계정 이메일이거나 인증 절차를 거친 연락처
+      // 이메일이다 — 존재하면 검증된 것으로 취급한다(카카오와 같은 신뢰 수준).
+      emailVerified: typeof profile.email === "string",
       name: typeof profile.name === "string" ? profile.name : typeof profile.nickname === "string" ? profile.nickname : void 0,
       avatar: typeof profile.profile_image === "string" ? profile.profile_image : void 0
     };
@@ -10223,6 +10224,7 @@ async function oauthCallbackService(params) {
       refreshToken: tokens.refreshToken ?? existingSocialAccount.refreshToken,
       tokenExpiresAt: tokenExpiryDate(tokens.expiresIn)
     });
+    await backfillVerifiedEmail(userId, identity);
   } else {
     const result = await createOrLinkUser(provider, identity, tokens, stateData.metadata);
     userId = result.userId;
@@ -10280,6 +10282,30 @@ async function assertActiveForOAuthSession(userId) {
   }
   throw new AccountDisabledError2({ status: user.status });
 }
+async function backfillVerifiedEmail(userId, identity) {
+  if (!identity.email || !identity.emailVerified) {
+    return;
+  }
+  const user = await usersRepository.findById(userId);
+  if (!user || user.email) {
+    return;
+  }
+  const emailOwner = await usersRepository.findByEmail(identity.email);
+  if (emailOwner && emailOwner.id !== userId) {
+    return;
+  }
+  try {
+    await usersRepository.updateById(userId, {
+      email: identity.email,
+      emailVerifiedAt: /* @__PURE__ */ new Date()
+    });
+  } catch (error) {
+    authLogger.service.warn("Verified-email backfill failed; continuing login", {
+      userId: String(userId),
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
 async function createOrLinkUser(provider, identity, tokens, metadata) {
   const existingUser = identity.email ? await usersRepository.findByEmail(identity.email) : null;
   let userId;
@@ -10425,6 +10451,7 @@ async function persistNativeLogin(identity, params) {
     let isNewUser = false;
     if (existing) {
       userId = existing.userId;
+      await backfillVerifiedEmail(userId, identity);
     } else {
       const result = await createOrLinkUser(params.provider, identity, void 0, params.metadata);
       userId = result.userId;