Type the GitHub userinfo responses via the catalog generic

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: erquhart

packages/core/src/oauth/component/github.test.ts

@@ -1,12 +1,19 @@
 import { describe, expect, test } from "vitest";
 import { normalizeGithubProfile } from "./github";
 
-/** Call the mapping with the userinfo responses the callback would pass. */
+type GithubUserInfo = NonNullable<Parameters<typeof normalizeGithubProfile>[1]>;
+
+/**
+ * Call the mapping with the userinfo responses the callback would pass. The
+ * cast lets tests feed loose and partial responses: the mapping's declared
+ * shape is trusted typing, and these tests exercise the defensive paths
+ * behind it.
+ */
 function normalize(
   user: Record<string, unknown>,
   emails?: Array<{ email: string; primary: boolean; verified: boolean }>,
 ) {
-  return normalizeGithubProfile(undefined, { user, emails });
+  return normalizeGithubProfile(undefined, { user, emails } as GithubUserInfo);
 }
 
 describe("normalizeGithubProfile", () => {
@@ -57,8 +64,8 @@ describe("normalizeGithubProfile", () => {
   });
 
   test("throws when the user response is missing", () => {
-    expect(() => normalizeGithubProfile(undefined, {})).toThrow(
-      /missing the `user` entry/,
-    );
+    expect(() =>
+      normalizeGithubProfile(undefined, {} as GithubUserInfo),
+    ).toThrow(/missing the `user` entry/);
   });
 });

packages/core/src/oauth/component/github.ts

@@ -36,22 +36,29 @@ type GithubUser = {
   avatar_url?: string;
 };
 
+/**
+ * The userinfo responses the catalog's endpoints produce, keyed like its
+ * `userInfoEndpoints`. Trusted typing over what GitHub returns, not runtime
+ * validation (see {@link OauthProfile}).
+ */
+type GithubUserInfo = { user: GithubUser; emails: GithubEmail[] };
+
 /**
  * Map GitHub's userinfo responses to {@link GithubProfile}. `user` comes from
  * `/user` and `emails` from `/user/emails` (the endpoints the catalog fetches).
  * Email prefers the primary verified address, then any verified one, then
  * whatever `/user` returned — `emailVerified` reports whether the chosen
  * address came from a verified entry; `name` falls back to the login handle.
  */
-export const normalizeGithubProfile: OauthProfile = (
+export const normalizeGithubProfile: OauthProfile<GithubUserInfo> = (
   _claims,
   userInfoResponses,
 ) => {
-  const user = userInfoResponses?.user as GithubUser | undefined;
+  const user = userInfoResponses?.user;
   if (user === undefined) {
     throw new Error("GitHub userinfo response is missing the `user` entry");
   }
-  const emails = (userInfoResponses?.emails ?? []) as GithubEmail[];
+  const emails = userInfoResponses?.emails ?? [];
   const best =
     emails.find((entry) => entry.primary && entry.verified) ??
     emails.find((entry) => entry.verified);