Connect logins that share a verified email, after the owner confirms

[guohai]

Why

A person who signs in with Google one day and GitHub the next, using the same email, should end up as one Agora.Build user. Until now, signing in with a second provider created a second account unless the person had first connected it from the Account page.

What changes

• Verified emails per login:
  • GitHub: the primary email, and only when /user/emails marks it verified. This adds the user:email scope.
  • Google, Apple and Agora OIDC: email_verified.
  • Agora OAuth: none, until Agora SSO returns a stable user ID.
  • Only plain ASCII addresses match.
  • The email is refreshed at each sign-in; if GitHub's lookup fails, the stored email is kept.
• Confirm, then link. A new login whose verified email already belongs to an account gets no session and creates no account. It is held for 10 minutes, and the browser can:
  1. sign in with one of the existing account's logins, then confirm "Connect Google (a***@example.com) to this account?", which is a same-origin POST;
  2. create a separate account instead; or
  3. discard it.
• Hardening:
  • The hold cookie is __Host-house_link over HTTPS, so a sibling subdomain can't plant one.
  • A confirming sign-in started from another site is refused.
  • Only the very session that confirmed can connect.
  • Signing in to a different account discards the hold.
  • An account can't take two logins from the same provider.
• Privacy: emails are visible only to their owner in a browser session (/api/me, Account page). Apps never see them: not through /oauth/userinfo, not through an app token reading /api/me, and not through identity lookup, which now returns only provider, issuer and subject.
• Docs: README and docs/platform.md describe the flow.

Accounts that already share an email are not merged. This only prevents new duplicates.

Verification

• npm test: 66 pass, 0 fail, 1 skipped (PostgreSQL, which needs a database). The new tests cover:
  • the hold, ready, connect, separate, discard, lapse and mismatch paths
  • a provider conflict, and another session or account trying to connect
  • a cross-site confirm and a forged-origin POST
  • the __Host- cookie, and no emails in identity lookup or app reads
  • GitHub email edge cases
• Merged with feat/stoa-world (PR Add the Stoa: walkable spaces with live presence, rooms, and calls #2): 294 pass. Deployed locally with PostgreSQL and checked: pages load, and the pending-link endpoint answers.
• Both dialogs checked in headless Chromium at 1280 and 390 px with no page errors.
• Two security reviews:
  • The first found an email leak through identity lookup, plus a confirm step that wasn't enforced server-side. Both are fixed.
  • The second rated it safe to ship, and its minor hardening points are included.

Known limits

• Someone who controls a person's email at another provider can, on a shared computer, leave the confirm dialog open for them. The dialog shows the held login's name and masked email to make that visible.
• If GitHub's email lookup fails during a brand-new sign-in, that login gets its own account. This fails safe.

Generated with SMT smt@agora.build