[pintu544]

Closes #13495
Supersedes #12667 (idle since Feb 2025, no reviews)

Problem

When GitHub's /user/emails endpoint returns 200 with an empty array — which happens for bot accounts, service accounts, and org-restricted accounts — the GitHub provider crashes during sign-in with:

TypeError: Cannot read properties of undefined (reading 'email')

The email fallback assumed there is always at least one email:

profile.email = (emails.find((e) => e.primary) ?? emails[0]).email

With [], both find() and emails[0] are undefined, so reading .email throws.

Fix

Guard the lookup — if there is no primary email and no first email, leave profile.email unset instead of throwing:

const primary = emails.find((e) => e.primary) ?? emails[0]
if (primary) profile.email = primary.email

Kept deliberately minimal: the res.ok handling, the primary-first preference, and the emails[0] fallback are all untouched. The scope-check idea from the issue (skipping the /user/emails call entirely when user:email wasn't granted) would be a behavior change, so I'm noting it here as a possible follow-up rather than bundling it in.

Tests

New: packages/core/test/providers/github.test.ts (4 tests, vitest, fetch stubbed):

• empty /user/emails array → no throw, email stays unset (this one failed pre-fix with the exact TypeError from the issue)
• primary email present → used (pins existing behavior)
• no primary → falls back to first email (pins existing behavior)
• profile already has a public email → /user/emails is never called

test/providers/: 5/5 passing. ESLint and Prettier are clean on the changed files. tsc --noEmit reports only the 3 pre-existing errors that also appear on the untouched tree (missing build-generated type files), nothing new from this change.

Manual verification

Reproduced it with a small script driving userinfo.request directly against stubbed fetch: pre-fix threw TypeError: Cannot read properties of undefined (reading 'email') on []; post-fix returns the profile with the email unset, and the primary/fallback cases behave exactly as before.

[vercel]

@pintu544 is attempting to deploy a commit to the authjs Team on Vercel.

A member of the Team first needs to authorize it.