OIDC 登录成功但没有邮箱：如何排查

1
export async function inspectOidcEmail(
2
    accessToken: string,
3
    expectedSubject: string,
4
) {
5
    const issuer = "https://oidc.sudomimus.com";
6
    const discoveryResponse = await fetch(
7
        `${issuer}/.well-known/openid-configuration`,
8
    );
9
    if (!discoveryResponse.ok) {
10
        throw new Error(`Discovery failed (${discoveryResponse.status})`);
11
    }
12
    const metadata = await discoveryResponse.json();
13
    if (metadata.issuer !== issuer || !metadata.claim_state_endpoint) {
14
        throw new Error("Unexpected issuer or missing claim-state endpoint");
15
    }
16

17
    const headers = { Authorization: `Bearer ${accessToken}` };
18
    const userInfoResponse = await fetch(metadata.userinfo_endpoint, {
19
        headers,
20
        cache: "no-store",
21
    });
22
    if (!userInfoResponse.ok) {
23
        throw new Error(`UserInfo failed (${userInfoResponse.status})`);
24
    }
25
    if (!userInfoResponse.headers.get("content-type")?.includes("application/json")) {
26
        throw new Error("Use an OIDC library to validate signed UserInfo");
27
    }
28
    const userInfo = await userInfoResponse.json();
29

30
    const stateResponse = await fetch(metadata.claim_state_endpoint, {
31
        headers,
32
        cache: "no-store",
33
    });
34
    if (!stateResponse.ok) {
35
        throw new Error(`Claim state failed (${stateResponse.status})`);
36
    }
37
    const state = await stateResponse.json();
38
    if (userInfo.sub !== expectedSubject || state.sub !== expectedSubject) {
39
        throw new Error("UserInfo or claim-state subject mismatch");
40
    }
41

42
    return {
43
        emailPresent: typeof userInfo.email === "string",
44
        emailVerified: userInfo.email_verified === true,
45
        requirement: state.claims.email?.requirement ?? null,
46
        grant: state.claims.email?.state ?? null,
47
    };
48
}