25421111866
84%

Ran 06 May 2026 07:02AM UTC

Jobs 1

Files 24

Run time 1min

Badge

Embed ▾

Committed 06 May 2026 06:59AM UTC coverage: 84.247%. Remained the same

Build # 25421111866

Build Type

push

github

Committed by

umputun

Commit Message

docs(verify): caveat that email proves control, not stable identity

The verify provider derives the local user id from the verified address
(ProviderName + "_" + HashID(address)). The confirmation round-trip
proves current control of the address at login time, but does not
guarantee a stable+unique identity over time -- the owner of an address
can change without the address changing (employer offboarding, recycled
free-mail handles, recycled domains). Any application that keys its own
records directly on the returned id will treat the new owner of an
address as the original user.

This is inherent to email-as-identity, not a bug in this library: the
verify flow has no upstream identifier (such as an OIDC sub) to fall
back on. The right place to address it is integrator-side -- map the
verified address to a server-side immutable user id at first verify --
but the property is non-obvious and easy to miss, so this commit calls
it out where readers will look:

  - VerifyHandler doc comment in provider/verify.go (v1)
  - VerifyHandler doc comment in v2/provider/verify.go
  - new "Email-as-identity caveat" subsection under "Verified
    authentication" in the root README

Documentation only; no behaviour change.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Coverage Stats

2706 of 3212 relevant lines covered (84.25%)

7.31 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	25421111866.1	06 May 2026 07:02AM UTC	24	84.25	GitHub Action Run

go-pkgz / auth / 25421111866
84%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 25421111866

go-pkgz / auth / 25421111866 84%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 25421111866

go-pkgz / auth / 25421111866
84%

README BADGES
x