costa-rica: Cody gate c2 — only auto-link Apple identity to existing account when email_verified (account-takeover guard) — TK-10346

0689909dee657a97a8190f34e8120bef2a697c9b · 2026-08-07 10:21:05 -0700 · Steve

Files touched

M routes/app.js

Diff

commit 0689909dee657a97a8190f34e8120bef2a697c9b
Author: Steve <steve@designerwallcoverings.com>
Date:   Fri Aug 7 10:21:05 2026 -0700

    costa-rica: Cody gate c2 — only auto-link Apple identity to existing account when email_verified (account-takeover guard) — TK-10346
---
 routes/app.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/routes/app.js b/routes/app.js
index 8d72120..a5751dd 100644
--- a/routes/app.js
+++ b/routes/app.js
@@ -51,7 +51,10 @@ router.post('/auth/apple', async (req, res) => {
   try {
     // Link by apple_sub first, else by verified email, else create.
     let { rows } = await pool.query(`SELECT * FROM app_users WHERE apple_sub=$1`, [claims.sub]);
-    if (!rows[0] && claims.email) {
+    // Only auto-link to an existing account when Apple says the email is VERIFIED
+    // (prevents account-takeover via an unverified-email token). Otherwise a new
+    // Apple-owned account is created below.
+    if (!rows[0] && claims.email && claims.email_verified) {
       ({ rows } = await pool.query(
         `UPDATE app_users SET apple_sub=$1, auth_provider='apple' WHERE email=$2 RETURNING *`,
         [claims.sub, claims.email.toLowerCase()]));

← 1cc9a07 costa-rica: build/ops dashboard (/build, gated) — integratio · back to Costa Rica · costa-rica: contacts feature (backend) — migration 006, impo a2b80ff →