From c25548ea05085ff35b322c1674ca72b9219ed047 Mon Sep 17 00:00:00 2001
From: Livio Spring <livio.a@gmail.com>
Date: Mon, 19 May 2025 11:25:17 +0200
Subject: [PATCH] fix: idp user information mapping (#9892)

# Which Problems Are Solved

When retrieving the information of an IdP intent, depending on the IdP
type (e.g. Apple), there was issue when mapping the stored (event)
information back to the specific IdP type, potentially leading to a
panic.

# How the Problems Are Solved

- Correctly initialize the user struct to map the information to.

# Additional Changes

none

# Additional Context

- reported by a support request
- needs backport to 3.x and 2.x

(cherry picked from commit 1b2fd23e0b6fe21e144df85e449cf45b59bb4ed9)
---
 internal/api/grpc/user/v2/intent.go     | 8 ++++----
 internal/idp/providers/apple/session.go | 4 ++++
 internal/idp/providers/google/google.go | 4 ++++
 internal/idp/providers/oidc/session.go  | 4 ++++
 4 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/internal/api/grpc/user/v2/intent.go b/internal/api/grpc/user/v2/intent.go
index 8043a9bdae..afb34deb83 100644
--- a/internal/api/grpc/user/v2/intent.go
+++ b/internal/api/grpc/user/v2/intent.go
@@ -167,11 +167,11 @@ func (s *Server) RetrieveIdentityProviderIntent(ctx context.Context, req *user.R
 		var idpUser idp.User
 		switch p := provider.(type) {
 		case *apple.Provider:
-			idpUser, err = unmarshalIdpUser(intent.IDPUser, &apple.User{})
+			idpUser, err = unmarshalIdpUser(intent.IDPUser, apple.InitUser())
 		case *oauth.Provider:
 			idpUser, err = unmarshalRawIdpUser(intent.IDPUser, p.User())
 		case *oidc.Provider:
-			idpUser, err = unmarshalIdpUser(intent.IDPUser, &oidc.User{UserInfo: &oidc_pkg.UserInfo{}})
+			idpUser, err = unmarshalIdpUser(intent.IDPUser, oidc.InitUser())
 		case *jwt.Provider:
 			idpUser, err = unmarshalIdpUser(intent.IDPUser, &jwt.User{})
 		case *azuread.Provider:
@@ -179,9 +179,9 @@ func (s *Server) RetrieveIdentityProviderIntent(ctx context.Context, req *user.R
 		case *github.Provider:
 			idpUser, err = unmarshalIdpUser(intent.IDPUser, &github.User{})
 		case *gitlab.Provider:
-			idpUser, err = unmarshalIdpUser(intent.IDPUser, &oidc.User{UserInfo: &oidc_pkg.UserInfo{}})
+			idpUser, err = unmarshalIdpUser(intent.IDPUser, oidc.InitUser())
 		case *google.Provider:
-			idpUser, err = unmarshalIdpUser(intent.IDPUser, &google.User{User: &oidc.User{UserInfo: &oidc_pkg.UserInfo{}}})
+			idpUser, err = unmarshalIdpUser(intent.IDPUser, google.InitUser())
 		case *saml.Provider:
 			idpUser, err = unmarshalIdpUser(intent.IDPUser, &saml.UserMapper{})
 		case *ldap.Provider:
diff --git a/internal/idp/providers/apple/session.go b/internal/idp/providers/apple/session.go
index 9395d84b2b..99794d18a2 100644
--- a/internal/idp/providers/apple/session.go
+++ b/internal/idp/providers/apple/session.go
@@ -60,6 +60,10 @@ func NewUser(info *openid.UserInfo, names userNamesFormValue) *User {
 	return &User{User: user}
 }
 
+func InitUser() idp.User {
+	return &User{User: oidc.InitUser()}
+}
+
 // User extends the [oidc.User] by returning the email as preferred_username, since Apple does not return the latter.
 type User struct {
 	*oidc.User
diff --git a/internal/idp/providers/google/google.go b/internal/idp/providers/google/google.go
index 221f2b61ae..083d4aef62 100644
--- a/internal/idp/providers/google/google.go
+++ b/internal/idp/providers/google/google.go
@@ -34,6 +34,10 @@ var userMapper = func(info *openid.UserInfo) idp.User {
 	return &User{oidc.DefaultMapper(info)}
 }
 
+func InitUser() idp.User {
+	return &User{oidc.InitUser()}
+}
+
 // User is a representation of the authenticated Google and implements the [idp.User] interface
 // by wrapping an [idp.User] (implemented by [oidc.User]). It overwrites the [GetPreferredUsername] to use the `email` claim.
 type User struct {
diff --git a/internal/idp/providers/oidc/session.go b/internal/idp/providers/oidc/session.go
index 430a14e5bb..9e1e55baf5 100644
--- a/internal/idp/providers/oidc/session.go
+++ b/internal/idp/providers/oidc/session.go
@@ -96,6 +96,10 @@ func NewUser(info *oidc.UserInfo) *User {
 	return &User{UserInfo: info}
 }
 
+func InitUser() *User {
+	return &User{UserInfo: &oidc.UserInfo{}}
+}
+
 type User struct {
 	*oidc.UserInfo
 }