fix: parse OIDC account linking flag as boolean

[joshtgl]

Description

Parse OIDC_ALLOW_DANGEROUS_EMAIL_LINKING as a JSON boolean so "false" does not enable dangerous account linking.

Checklist

• I have read CONTRIBUTING.md in its entirety
• I have performed a self-review of my own code
• I have added unit tests to cover my changes
• The last commit successfully passed pre-commit checks
• Any AI code was thoroughly reviewed by me

Summary by CodeRabbit

• Bug Fixes
  • Improved handling of the dangerous email-linking configuration setting.
  • The setting now defaults to disabled when not explicitly configured.
  • Configuration values are interpreted consistently, with invalid values safely falling back to disabled.
  • This reduces the risk of unintended email account linking caused by ambiguous environment values.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d9081dda-ba92-431f-95a5-4f0311e048c9

📥 Commits

Reviewing files that changed from the base of the PR and between 2a6bfe0 and 794049c.

📒 Files selected for processing (1)

• src/env.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/env.ts

---

📝 Walkthrough

Walkthrough

OIDC_ALLOW_DANGEROUS_EMAIL_LINKING now defaults to false in the server schema and parses its runtime value as JSON before boolean conversion.

Changes

OIDC email linking configuration

Layer / File(s)	Summary
Define and parse OIDC email linking flag src/env.ts	The server schema defaults OIDC_ALLOW_DANGEROUS_EMAIL_LINKING to false. Runtime parsing uses JSON parsing with a false fallback.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the change to parse the OIDC account-linking flag as a boolean.
Description check	✅ Passed	The description explains the change and includes the checklist, but it omits the optional Demo section and issue reference.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/env.ts`:
- Around line 142-144: Update OIDC_ALLOW_DANGEROUS_EMAIL_LINKING to pass the
parsed JSON value directly instead of wrapping it with Boolean(...), allowing
the existing z.boolean() validation to reject non-boolean configuration values
while preserving the false default.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f0a87e66-3fdf-4e13-b7a9-b2eda7ce763d

📥 Commits

Reviewing files that changed from the base of the PR and between 7e6a401 and 2a6bfe0.

📒 Files selected for processing (1)

• src/env.ts

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Require an exact JSON boolean before enabling account linking.

Boolean(JSON.parse(...)) converts non-boolean JSON values to booleans. For example, 1, the JSON string "false", and {} become true. This can enable allowDangerousEmailAccountLinking in src/server/auth.ts with an invalid configuration value.

Parse the JSON value without Boolean(...) and let z.boolean() reject non-boolean values.

Proposed fix

-    OIDC_ALLOW_DANGEROUS_EMAIL_LINKING: Boolean(
-      JSON.parse(process.env.OIDC_ALLOW_DANGEROUS_EMAIL_LINKING || 'false'),
-    ),
+    OIDC_ALLOW_DANGEROUS_EMAIL_LINKING: JSON.parse(
+      process.env.OIDC_ALLOW_DANGEROUS_EMAIL_LINKING || 'false',
+    ),

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	OIDC_ALLOW_DANGEROUS_EMAIL_LINKING: Boolean(
	JSON.parse(process.env.OIDC_ALLOW_DANGEROUS_EMAIL_LINKING || 'false'),
	),
	OIDC_ALLOW_DANGEROUS_EMAIL_LINKING: JSON.parse(
	process.env.OIDC_ALLOW_DANGEROUS_EMAIL_LINKING || 'false',
	),

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/env.ts` around lines 142 - 144, Update OIDC_ALLOW_DANGEROUS_EMAIL_LINKING
to pass the parsed JSON value directly instead of wrapping it with Boolean(...),
allowing the existing z.boolean() validation to reject non-boolean configuration
values while preserving the false default.

[joshtgl]

Boolean handling is currently inconsistent and confusing with the JSON.parse wrapping and certain values can unexpectedly resolve to true. What would you think about a PR that updated all of the env boolean parsing logic to call a function such as:

const parseEnvBoolean = (value: string | undefined): boolean => {
    return '1' === value || 'true' === value?.toLowerCase();
  };

[krokosik]

Certainly! That was an oversight on my part, thanks for cleaning it up :)