{"record":{"id":"e44253286fe5a328","repo":"vxcontrol/pentagi","slug":"no-verified-primary-email-found","errorCode":null,"errorMessage":"no verified primary email found","messagePattern":"no verified primary email found","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/pkg/server/oauth/github.go","lineNumber":56,"sourceCode":"\n\temails := []githubEmail{}\n\tif err := json.Unmarshal(body, &emails); err != nil {\n\t\treturn \"\", false, err\n\t}\n\n\tfor _, email := range emails {\n\t\tif email.Verified && email.Primary {\n\t\t\treturn email.Email, true, nil\n\t\t}\n\t}\n\n\tfor _, email := range emails {\n\t\tif email.Verified {\n\t\t\treturn email.Email, true, nil\n\t\t}\n\t}\n\n\treturn \"\", false, fmt.Errorf(\"no verified primary email found\")\n}\n\nfunc NewGithubOAuthClient(clientID, clientSecret, redirectURL string) OAuthClient {\n\treturn NewOAuthClient(\"github\", &oauth2.Config{\n\t\tClientID:     clientID,\n\t\tClientSecret: clientSecret,\n\t\tRedirectURL:  redirectURL,\n\t\tScopes: []string{\n\t\t\t\"user:email\",\n\t\t\t\"openid\",\n\t\t},\n\t\tEndpoint: github.Endpoint,\n\t}, githubEmailResolver)\n}\n","sourceCodeStart":38,"sourceCodeEnd":71,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/server/oauth/github.go#L38-L71","documentation":"githubEmailResolver (backend/pkg/server/oauth/github.go:56) fetches the authenticated user's emails from the GitHub API and only succeeds when at least one email has Verified=true. If none is verified, the OAuth login flow aborts with this error because the platform requires a confirmed email address to identify the account.","triggerScenarios":"Completing GitHub OAuth where the account's /user/emails endpoint returns only unverified addresses, or the token lacks access to verified emails, causing the resolver to fall through the loop and return this error.","commonSituations":"Users signing in with GitHub accounts that never confirmed their email address; freshly created or bot/service GitHub accounts; enterprise instances with unverified contact addresses; tokens missing the user:email scope so only limited data is visible.","solutions":["Ask the user to verify their email on GitHub (Settings → Emails) and retry the login.","Confirm the OAuth app requests the user:email scope so the /user/emails endpoint returns full data.","If no verified email exists, fall back to the GitHub noreply address (email.Primary) or prompt the user for an email instead of failing.","Return a user-friendly message telling them which account is missing a verified email."],"exampleFix":"// before\nreturn \"\", false, fmt.Errorf(\"no verified primary email found\")\n\n// after\nfor _, email := range emails {\n    if email.Primary && email.Verified {\n        return email.Email, true, nil\n    }\n}\nfor _, email := range emails { // fallback: primary noreply address\n    if email.Primary {\n        return email.Email, false, nil\n    }\n}\nreturn \"\", false, fmt.Errorf(\"no verified primary email found\")","handlingStrategy":"validation","validationCode":"req, _ := http.NewRequestWithContext(ctx, \"GET\", \"https://api.github.com/user/emails\", nil)\nreq.Header.Set(\"Authorization\", \"Bearer \"+ghToken)\nresp, err := http.DefaultClient.Do(req)\nif err != nil {\n    return err\n}\nvar emails []struct {\n    Email    string `json:\"email\"`\n    Verified bool   `json:\"verified\"`\n    Primary  bool   `json:\"primary\"`\n}\njson.NewDecoder(resp.Body).Decode(&emails)\nresp.Body.Close()\nhasVerified := false\nfor _, e := range emails {\n    if e.Verified {\n        hasVerified = true\n    }\n}\nif !hasVerified {\n    return fmt.Errorf(\"GitHub account has no verified email; verify it on github.com before signing in\")\n}","typeGuard":null,"tryCatchPattern":"email, verified, err := githubEmailResolver(ctx, nonce, token)\nif err != nil {\n    if strings.Contains(err.Error(), \"no verified primary email\") {\n        // guidance path, not a 500\n        return nil, fmt.Errorf(\"sign-in failed: your GitHub account has no verified email; verify it at https://github.com/settings/emails and retry\")\n    }\n    return nil, err\n}","preventionTips":["Require the user:email scope in the GitHub OAuth app configuration.","Show a clear message telling users to verify their GitHub email before OAuth login.","Consider accepting GitHub noreply primary addresses as a fallback identity.","Monitor this error rate — spikes indicate GitHub-side or scope regressions."],"tags":["oauth","github","email","authentication"],"backgroundTag":"unverified-email-oauth","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}