[waleedlatif1]

Summary

• SSO keeps trustEmailVerified: false, so Better Auth stores every SSO-created user as unverified, and SCIM provisioning does the same. Nothing ever flipped the flag, so users who only sign in through their IdP were refused when connecting accounts ("Verify your email address before connecting an account").
• SSO admission now marks the user verified once it has proven the same things account linking relies on: the provider's domain is DNS-verified, the account is linked to that provider, and the user's email is on that domain.
• trustEmailVerified stays off; the IdP's email_verified claim is still never trusted.

Type of Change

• Bug fix

Testing

• admit-sso-user.integration.ts against real Postgres: the new directory-provisioned member case fails on the pre-fix code and passes with the fix; added guards that an off-domain address and an unverified provider domain stay unverified (7/7 pass)
• bun run test lib/auth/sso (97 pass), biome on changed files; type-check and audits in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Nov 2, 2026 11:51pm UTC

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge.

Summary

Marks SSO users’ email addresses verified after checking the provider’s verified domain, linked account, and matching email domain.

• A verified-domain SSO sign-in marks the user's email as verified.

_{Reviews (2) · Last reviewed commit: "fix(sso): only verify the email the doma..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}