Function createSSOAccountInfo

apps/web/src/lib/user/server.ts:274–292

(
  account: Account,
  user: NextUser | AdapterUser,
  _profile: Profile | undefined
)

  assert(user.email, 'User email is required for OpenAI auth');

  const sub = (profile as { sub?: unknown } | undefined)?.sub;
  if (typeof sub !== 'string' || sub.trim() === '') {
    throw new Error('OpenAI auth profile is missing the subject');
  }

  return {
    google_user_email: user.email,
    google_user_name: user.name || user.email.split('@')[0],
    google_user_image_url: user.image || '',
    hosted_domain: hosted_domain_specials.openai,
    provider: account.provider,
    // Issuer-qualified subject: a `sub` from any other issuer or client can
    // never collide with an OpenAI account.
    provider_account_id: `${OPENAI_ISSUER}#${sub}`,
    display_name: null,
  };
}

/**
 * Persists the delegated tokens a completed ChatGPT authorization issued, so
 * the same consent that signs a person in also connects OpenAI BYOK. Only a
 * grant that carries the delegated scopes is stored: a plain identity-only