@@ -0,0 +1,175 @@
+import Router from 'koa-router'
+import { Strategy as GitHubStrategy } from 'passport-github2'
+import { registerGithub } from '../github'
+import { registerGoogle } from '../google'
+import { handleProviderAuth } from '../utils'
+
+jest.mock('passport-google-oauth20', () => ({ Strategy: jest.fn() }))
+jest.mock('passport-github2', () => ({ Strategy: jest.fn() }))
+jest.mock('../utils', () => ({
+  ...jest.requireActual('../utils'),
+  handleProviderAuth: jest.fn()
+}))
+
+function makeMeasureCtx (): any {
+  return { info: jest.fn(), warn: jest.fn(), error: jest.fn() }
+}
+
+function setupProvider (provider: 'google' | 'github'): { router: Router<any, any> } {
+  const passport: any = { use: jest.fn(), authenticate: jest.fn() }
+  const router = new Router<any, any>()
+  const register = provider === 'google' ? registerGoogle : registerGithub
+  register(
+    makeMeasureCtx(),
+    passport,
+    router,
+    'http://accounts.example.com',
+    Promise.resolve({} as any),
+    'http://front.example.com',
+    {}
+  )
+  return { router }
+}
+
+async function invokeProviderHandler (
+  router: Router<any, any>,
+  provider: 'google' | 'github',
+  user: any
+): Promise<void> {
+  const layer = router.stack.find((entry) => entry.path === `/auth/${provider}/callback`)
+  expect(layer).toBeDefined()
+  await (layer as any).stack[1]({ query: {}, state: { user }, redirect: jest.fn() }, async () => {})
+}
+
+describe('provider email verification', () => {
+  const env = process.env
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    process.env = {
+      ...env,
+      GOOGLE_CLIENT_ID: 'google-client-id',
+      GOOGLE_CLIENT_SECRET: 'google-client-secret',
+      GITHUB_CLIENT_ID: 'github-client-id',
+      GITHUB_CLIENT_SECRET: 'github-client-secret'
+    }
+    ;(handleProviderAuth as jest.Mock).mockResolvedValue('http://front.example.com/login/auth')
+  })
+
+  afterEach(() => {
+    process.env = env
+  })
+
+  test('Google passes an email to handleProviderAuth only when email_verified is true', async () => {
+    const { router } = setupProvider('google')
+
+    await invokeProviderHandler(router, 'google', {
+      emails: [{ value: 'admin@example.com', verified: false }],
+      name: { givenName: 'Ada', familyName: 'Lovelace' }
+    })
+    expect(handleProviderAuth).toHaveBeenLastCalledWith(
+      expect.anything(),
+      expect.anything(),
+      expect.anything(),
+      expect.anything(),
+      'google',
+      undefined,
+      expect.anything(),
+      undefined,
+      'Ada',
+      'Lovelace',
+      expect.anything(),
+      undefined
+    )
+
+    await invokeProviderHandler(router, 'google', {
+      emails: [{ value: 'admin@example.com', verified: true }],
+      name: { givenName: 'Ada', familyName: 'Lovelace' }
+    })
+    expect(handleProviderAuth).toHaveBeenLastCalledWith(
+      expect.anything(),
+      expect.anything(),
+      expect.anything(),
+      expect.anything(),
+      'google',
+      undefined,
+      expect.anything(),
+      'admin@example.com',
+      'Ada',
+      'Lovelace',
+      expect.anything(),
+      undefined
+    )
+  })
+
+  test('GitHub passes only a primary verified email from its fetched emails API response', async () => {
+    const { router } = setupProvider('github')
+
+    expect(GitHubStrategy).toHaveBeenCalledWith(expect.objectContaining({ allRawEmails: true }), expect.any(Function))
+
+    await invokeProviderHandler(router, 'github', {
+      emails: [
+        { value: 'unverified@example.com', primary: true, verified: false },
+        { value: 'non-primary@example.com', primary: false, verified: true }
+      ],
+      username: 'octocat'
+    })
+    expect(handleProviderAuth).toHaveBeenLastCalledWith(
+      expect.anything(),
+      expect.anything(),
+      expect.anything(),
+      expect.anything(),
+      'github',
+      undefined,
+      expect.anything(),
+      undefined,
+      'octocat',
+      '',
+      expect.anything(),
+      undefined
+    )
+
+    await invokeProviderHandler(router, 'github', {
+      emails: [{ value: 'admin@example.com', primary: true, verified: true }],
+      username: 'octocat'
+    })
+    expect(handleProviderAuth).toHaveBeenLastCalledWith(
+      expect.anything(),
+      expect.anything(),
+      expect.anything(),
+      expect.anything(),
+      'github',
+      undefined,
+      expect.anything(),
+      'admin@example.com',
+      'octocat',
+      '',
+      expect.anything(),
+      undefined
+    )
+  })
+
+  test('GitHub treats an email without fetched primary and verification metadata as unverified', async () => {
+    const { router } = setupProvider('github')
+
+    await invokeProviderHandler(router, 'github', {
+      emails: [{ value: 'profile@example.com' }],
+      username: 'octocat'
+    })
+
+    expect(handleProviderAuth).toHaveBeenLastCalledWith(
+      expect.anything(),
+      expect.anything(),
+      expect.anything(),
+      expect.anything(),
+      'github',
+      undefined,
+      expect.anything(),
+      undefined,
+      'octocat',
+      '',
+      expect.anything(),
+      undefined
+    )
+  })
+})
@@ -29,6 +29,9 @@ export function registerGithub (
         clientID: GITHUB_CLIENT_ID,
         clientSecret: GITHUB_CLIENT_SECRET,
         callbackURL: concatLink(accountsUrl, redirectURL),
+        // passport-github2 otherwise keeps only the primary address and drops
+        // the verification metadata returned by GitHub's emails API.
+        allRawEmails: true,
         passReqToCallback: true
       },
       function (req: any, accessToken: string, refreshToken: string, profile: any, done: any) {
@@ -56,7 +59,9 @@ export function registerGithub (
       })(ctx, next)
     },
     async (ctx, next) => {
-      const email = ctx.state.user.emails?.[0]?.value
+      const verifiedEmail = ctx.state.user.emails?.find(
+        (candidate: any) => candidate.primary === true && candidate.verified === true
+      )?.value
       const nameParts = (ctx.state.user.displayName ?? ctx.state.user.username ?? '').split(' ')
       const first: string = nameParts[0] ?? ''
       const last: string = nameParts.slice(1).join(' ')
@@ -70,7 +75,7 @@ export function registerGithub (
         'github',
         ctx.query?.state,
         ctx.state?.user,
-        email,
+        verifiedEmail,
         first,
         last,
         { type: SocialIdType.GITHUB, value: ctx.state.user.username },
 
@@ -60,7 +60,9 @@ export function registerGoogle (
     },
     async (ctx, next) => {
       measureCtx.info('Provider auth success', { type: 'google', user: ctx.state?.user })
+      // passport-google-oauth20 maps Google's email_verified claim to this field.
       const email = ctx.state.user.emails?.[0]?.value
+      const verifiedEmail = ctx.state.user.emails?.[0]?.verified === true ? email : undefined
       const first = ctx.state.user.name.givenName
       const last = ctx.state.user.name.familyName
       const db = await dbPromise
@@ -73,7 +75,7 @@ export function registerGoogle (
         'google',
         ctx.query?.state,
         ctx.state?.user,
-        email,
+        verifiedEmail,
         first,
         last,
         { type: SocialIdType.GOOGLE, value: email },
 
@@ -20,7 +20,8 @@ export type AuthProvider = (
   db: Promise<AccountDB>,
   frontUrl: string,
   brandings: BrandingMap,
-  signUpDisabled?: boolean
+  signUpDisabled?: boolean,
+  shutdownSignal?: AbortSignal
 ) => ProviderInfo | undefined
 
 export function registerProviders (
@@ -31,7 +32,8 @@ export function registerProviders (
   serverSecret: string,
   frontUrl: string | undefined,
   brandings: BrandingMap,
-  signUpDisabled: boolean = false
+  signUpDisabled: boolean = false,
+  shutdownSignal?: AbortSignal
 ): void {
   const accountsUrl = process.env.ACCOUNTS_URL
   if (accountsUrl === undefined) {
@@ -66,7 +68,7 @@ export function registerProviders (
   const res: ProviderInfo[] = []
   const providers: AuthProvider[] = [registerGoogle, registerGithub, registerOpenid]
   for (const provider of providers) {
-    const value = provider(ctx, passport, router, accountsUrl, db, frontUrl, brandings, signUpDisabled)
+    const value = provider(ctx, passport, router, accountsUrl, db, frontUrl, brandings, signUpDisabled, shutdownSignal)
     if (value !== undefined) res.push(value)
   }