coerceEmailVerified attempts to convert an OIDC email_verified claim to a boolean. Some IdPs (e.g. SAML-to-OIDC bridges, certain Azure AD B2C configurations) return email_verified as a string ("true"/"false") or a number (1/0) rather than a native JSON boolean. This function handles those variants s
(v interface{})
| 2287 | // Returns (value, true) on successful coercion, or (false, false) if the |
| 2288 | // value is nil or an unrecognized type. |
| 2289 | func coerceEmailVerified(v interface{}) (verified bool, ok bool) { |
| 2290 | switch val := v.(type) { |
| 2291 | case bool: |
| 2292 | return val, true |
| 2293 | case string: |
| 2294 | b, err := strconv.ParseBool(val) |
| 2295 | if err != nil { |
| 2296 | return false, false |
| 2297 | } |
| 2298 | return b, true |
| 2299 | case json.Number: |
| 2300 | n, err := val.Int64() |
| 2301 | if err != nil { |
| 2302 | return false, false |
| 2303 | } |
| 2304 | return n != 0, true |
| 2305 | case float64: |
| 2306 | return val != 0, true |
| 2307 | case int64: |
| 2308 | return val != 0, true |
| 2309 | case int: |
| 2310 | return val != 0, true |
| 2311 | default: |
| 2312 | return false, false |
| 2313 | } |
| 2314 | } |