From fbbd20a5a6dd929293a3a3ba322fe277b6ed5ed8 Mon Sep 17 00:00:00 2001
From: dongmucat <1127093059@qq.com>
Date: Tue, 28 Apr 2026 16:31:52 +0800
Subject: [PATCH] fix(auth): require verified email for domain access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

变更摘要：

- 修复 EMAIL_DOMAIN 准入策略，未验证邮箱不再因域名匹配被放行

- 新增回归测试，覆盖 OIDC 场景下 email_verified=false 的拒绝行为

- 保持修复范围收敛，仅调整策略判定与对应测试

关键文件：

- server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/EmailDomainAccessPolicy.java

- server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/AccessPolicyTest.java
---
 .../skillhub/auth/policy/EmailDomainAccessPolicy.java      | 2 +-
 .../com/iflytek/skillhub/auth/policy/AccessPolicyTest.java | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/EmailDomainAccessPolicy.java b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/EmailDomainAccessPolicy.java
index d688f2a2..b65a738d 100644
--- a/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/EmailDomainAccessPolicy.java
+++ b/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/policy/EmailDomainAccessPolicy.java
@@ -15,7 +15,7 @@ public class EmailDomainAccessPolicy implements AccessPolicy {
 
     @Override
     public AccessDecision evaluate(OAuthClaims claims) {
-        if (claims.email() == null) return AccessDecision.DENY;
+        if (claims.email() == null || !claims.emailVerified()) return AccessDecision.DENY;
         String domain = claims.email().substring(claims.email().indexOf('@') + 1);
         return allowedDomains.contains(domain.toLowerCase())
             ? AccessDecision.ALLOW : AccessDecision.DENY;
diff --git a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/AccessPolicyTest.java b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/AccessPolicyTest.java
index df7f1c52..65f12528 100644
--- a/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/AccessPolicyTest.java
+++ b/server/skillhub-auth/src/test/java/com/iflytek/skillhub/auth/policy/AccessPolicyTest.java
@@ -36,6 +36,13 @@ class AccessPolicyTest {
         assertThat(policy.evaluate(claims)).isEqualTo(AccessDecision.DENY);
     }
 
+    @Test
+    void emailDomainPolicy_deniesUnverifiedEmail() {
+        var policy = new EmailDomainAccessPolicy(Set.of("company.com"));
+        var claims = new OAuthClaims("oidc", "123", "user@company.com", false, "user", Map.of());
+        assertThat(policy.evaluate(claims)).isEqualTo(AccessDecision.DENY);
+    }
+
     @Test
     void providerAllowlistPolicy_allowsMatchingProvider() {
         var policy = new ProviderAllowlistAccessPolicy(Set.of("github"));