fix(integration-github): fetch primary email from /user/emails

[gvieira18]

Summary

• GitHub's /user endpoint only returns a public email, so accounts with a private email yield null. On "Sign in with GitHub" (OAuthIntent::Login), FindOrCreateUserByProvider can't match an existing user by email and forks a duplicate user (observed: a Discord-linked user got a second …-2 account on GitHub login).
• Adds a GetUserEmails request (GET /user/emails, covered by the existing user:email scope) and falls back to it when /user returns null, selecting the single primary + verified address — requiring both flags so secondary verified emails (work/school/noreply) can't match the wrong account.

Closes #366

Test plan

• pest --filter=GitHubOAuthClient — 4 cases: public email used as-is; private → primary-verified fallback; verified-but-not-primary → null; primary-but-not-verified → null.
• Manual: with a private GitHub email, sign in with GitHub and confirm it links to the existing account (matching primary verified email) instead of creating a new user.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 92360ded-8cb4-48bd-b4d3-cc461a0e5726

📥 Commits

Reviewing files that changed from the base of the PR and between 897e838 and fdec0c4.

📒 Files selected for processing (5)

• app-modules/identity/src/Auth/Exceptions/OAuthFlowException.php
• app-modules/identity/tests/Feature/Auth/HandleOAuthCallbackActionTest.php
• app-modules/integration-github/src/OAuth/GitHubOAuthClient.php
• app-modules/integration-github/src/Transport/Requests/Users/GetUserEmails.php
• app-modules/integration-github/tests/Feature/GitHubOAuthClientTest.php

🚧 Files skipped from review as they are similar to previous changes (2)

• app-modules/integration-github/src/OAuth/GitHubOAuthClient.php
• app-modules/integration-github/src/Transport/Requests/Users/GetUserEmails.php

---

📝 Walkthrough

Walkthrough

GitHubOAuthClient now resolves a fallback email from GET /user/emails when /user returns email: null, and throws OAuthFlowException::emailUnavailable('github') when no primary verified email is available. A new GetUserEmails request class is added. Feature tests cover GitHub email selection and HandleOAuthCallbackAction link versus login behavior with differing emails.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: fetching GitHub email from /user/emails when /user lacks it.
Description check	✅ Passed	The description matches the changes and explains the private-email fallback and duplicate-user fix.
Linked Issues check	✅ Passed	The changes implement #366 by falling back to /user/emails and selecting the primary verified email.
Out of Scope Changes check	✅ Passed	All added code and tests support the GitHub email fallback and duplicate-user fix; no unrelated changes stand out.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@app-modules/integration-github/src/OAuth/GitHubOAuthClient.php`:
- Around line 82-84: The GitHubOAuthClient currently returns null when the
/user/emails API response fails (the if (!$response->ok()) check), allowing the
login flow to continue with incomplete identity data and risking duplicate
account creation. Replace this silent failure with explicit fail-closed behavior
by throwing an exception instead of returning null, ensuring the application
explicitly fails when email recovery fails rather than silently proceeding with
unresolved identity information.

In `@app-modules/integration-github/tests/Feature/GitHubOAuthClientTest.php`:
- Around line 56-93: The test file is missing coverage for the scenario when the
/user/emails endpoint returns a non-OK response. Add a new test case that mocks
a failed response from the GetUserEmails class (using MockResponse or similar to
simulate an error) in the githubOAuthClient helper, then verify the expected
behavior of the getAuthenticatedUser method in the GitHubOAuthAccessDTO context.
This ensures the resolvePrimaryEmail method properly handles and recovers from
failed email endpoint requests.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 31d4b997-b735-48ac-b6fa-c1e591aa4204

📥 Commits

Reviewing files that changed from the base of the PR and between bc6c29e and 897e838.

📒 Files selected for processing (3)

• app-modules/integration-github/src/OAuth/GitHubOAuthClient.php
• app-modules/integration-github/src/Transport/Requests/Users/GetUserEmails.php
• app-modules/integration-github/tests/Feature/GitHubOAuthClientTest.php

[gvieira18]

Kept as a draft intentionally — the minimal fix here closes the realistic private-email case, but there are unresolved edge cases (no verified email / failed /user/emails / scope misconfig) still under discussion in #366.

cc @danielhe4rt — please validate the approach and weigh in on the open edge cases in this comment before we mark ready.