From d08e4c3314c47e335437013ed7a69a6d28c1ee0a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Tue, 28 Jul 2026 10:55:36 +0200 Subject: [PATCH] Expect verified email in OAuth2 ID token e2e MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit E2E owners confirm email during setup so password re-login works, so ID token claim assertions must expect email_verified true. Signed-off-by: Émile Ré --- e2e/console/oauth2_test.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/e2e/console/oauth2_test.go b/e2e/console/oauth2_test.go index d43d7daa2..723dde1b4 100644 --- a/e2e/console/oauth2_test.go +++ b/e2e/console/oauth2_test.go @@ -2515,8 +2515,8 @@ func TestOAuth2_IDTokenClaims(t *testing.T) { "ID token must contain email when email scope is requested") require.NotNil(t, claims.EmailVerified, "ID token must contain email_verified when email scope is requested") - assert.False(t, *claims.EmailVerified, - "email_verified must be false for unverified e2e test identity") + assert.True(t, *claims.EmailVerified, + "email_verified must reflect the verified e2e test identity") assert.NotEmpty(t, claims.Name, "ID token must contain name when profile scope is requested") }, @@ -2607,8 +2607,8 @@ func TestOAuth2_IDTokenClaims(t *testing.T) { "refresh ID token must contain email when email scope is present") require.NotNil(t, claims.EmailVerified, "refresh ID token must contain email_verified when email scope is present") - assert.False(t, *claims.EmailVerified, - "email_verified must be false for unverified e2e test identity") + assert.True(t, *claims.EmailVerified, + "email_verified must reflect the verified e2e test identity") assert.NotEmpty(t, claims.Name, "refresh ID token must contain name when profile scope is present") },