Secfix/sso takeover

[calexiou]

Mitigates -> GHSA-hp6v-6jw7-gv2f

[readme-ai-writer]

📚 No documentation changes were needed for this PR.

[cubic-dev-ai]

1 issue found and verified against the latest diff

Confidence score: 2/5

• In packages/types/src/documents/global/config.ts, allowUnverifiedEmailLinking is defined in the config types but appears not to be mapped through fetchStrategyConfig, so the runtime strategy may ignore this flag and allow unintended OIDC account-linking behavior if merged as-is. Wire the field through fetchStrategyConfig and add a focused test that verifies persisted config and runtime config stay in sync before merging.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/types/src/documents/global/config.ts">

<violation number="1" location="packages/types/src/documents/global/config.ts:88">
P0: The `allowUnverifiedEmailLinking` field is added to both `OIDCInnerConfig` and `OIDCStrategyConfiguration`, but `fetchStrategyConfig` (the function that maps from the stored config to the runtime strategy config) does not propagate it. The destructuring on the input and the return object both omit this field, so it will be silently dropped at runtime — the feature will have no effect.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 8 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[melohagan]

Just noticed a possible null-pointer, otherwise looks ok