Function parseSignInRedirectContext

apps/web/src/lib/user/server.ts:377–399

(
  callbackUrlCookieValue: string | undefined
)

    (profile.given_name && profile.family_name
      ? `${profile.given_name} ${profile.family_name}`.trim()
      : profile.given_name || profile.family_name || 'LinkedIn User')
  );
}

/**
 * An OAuth/OIDC sign-in proves ownership of its email only when the provider
 * asserts the `email_verified` claim in the raw profile. Apple delivers the
 * claim as the string "true"; treat that as verified. Providers without the
 * claim (GitHub, GitLab, Discord) never prove the email here.
 */
export function profileProvesEmailOwnership(profile: unknown): boolean {
  const emailVerified = (profile as { email_verified?: unknown } | undefined)?.email_verified;
  return emailVerified === true || emailVerified === 'true';
}

function createEmailAccountInfo(
  account: Account,
  user: NextUser | AdapterUser
): CreateOrUpdateUserArgs | null {
  if (account.provider !== 'email') return null;
  assert(user.email, 'User email is required for email auth');

  // Extract the actual domain from the email address
  // This ensures admin detection works correctly for @kilocode.ai emails
  const emailDomain = user.email.split('@')[1];
  const hosted_domain = emailDomain || hosted_domain_specials.email;