fix: always emit email and name claims in the planner id_token

better-auth 1.7 stopped including the user-record email and name claims
in the id_token for sessions not created by a social provider. The
planner resolves members by the id_token email claim and falls back to
sub (the better-auth user id) when the claim is absent, which silently
created duplicate planner members keyed by an opaque 32-character id.

Emit email and name explicitly in customIdTokenClaims for every session
type. Also align the test suite with production: the test instance now
declares the email scope, the flow helpers request it, and the
integration test asserts the claims for a magic-link-only user.

Author: mroderick

src/auth.js

@@ -84,8 +84,9 @@ export const auth = betterAuth({
       validAudiences: ["planner"],
       allowDynamicClientRegistration: false,
       customIdTokenClaims: async ({ user }) => {
+        const claims = { email: user.email, name: user.name };
         const githubId = await getGithubAccountId(db, user.id);
-        return githubId ? { github_id: String(githubId) } : {};
+        return githubId ? { ...claims, github_id: String(githubId) } : claims;
       },
     }),
     magicLink({

test/helpers/oauth-flow.js

@@ -9,7 +9,7 @@ export function authorizeParams(overrides = {}) {
     client_id: "planner",
     redirect_uri: REDIRECT_URI,
     response_type: "code",
-    scope: "openid profile",
+    scope: "openid profile email",
     code_challenge: CODE_CHALLENGE,
     code_challenge_method: "S256",
     ...overrides,

test/helpers/test-instance.js

@@ -92,13 +92,14 @@ export async function getTestInstance(t) {
       }),
       oauthProvider({
         loginPage: "/login",
-        scopes: ["openid", "profile"],
+        scopes: ["openid", "profile", "email"],
         accessTokenExpiresIn: 900,
         validAudiences: ["planner"],
         allowDynamicClientRegistration: false,
         customIdTokenClaims: async ({ user }) => {
+          const claims = { email: user.email, name: user.name };
           const githubId = await getGithubAccountId(pool, user.id);
-          return githubId ? { github_id: String(githubId) } : {};
+          return githubId ? { ...claims, github_id: String(githubId) } : claims;
         },
       }),
       magicLink({

test/integration/oauth-flow.test.js

@@ -21,7 +21,7 @@ test("end-to-end OAuth 2.1 flow", async (t) => {
     redirect_uri: "http://localhost:3000/auth/codebar/callback",
     response_type: "code",
     state: "integration-state",
-    scope: "openid profile",
+    scope: "openid profile email",
     code_challenge: codeChallenge,
     code_challenge_method: "S256",
   });
@@ -98,6 +98,25 @@ test("end-to-end OAuth 2.1 flow", async (t) => {
   t.ok(payload.iat, "payload has issued-at");
   t.ok(payload.exp, "payload has expiration");
 
+  // The planner resolves members by the id_token email claim. When the claim
+  // is missing it falls back to `sub` (the better-auth user id), which creates
+  // a duplicate planner member keyed by an opaque id.
+  const userRow = await testInstance.pool.query(
+    'SELECT email, name FROM "user" WHERE email = $1',
+    [email],
+  );
+  t.equal(userRow.rows.length, 1, "test user exists");
+  t.equal(
+    payload.email,
+    userRow.rows[0].email,
+    "payload carries the user's email claim",
+  );
+  t.equal(
+    payload.name,
+    userRow.rows[0].name,
+    "payload carries the user's name claim",
+  );
+
   // Step 5: Verify the access token is usable (e.g., for userinfo if we had one)
   // Note: introspection requires client authentication, which is skipped here
   // since the core flow (authorize -> code -> token -> JWT) is fully validated.