Backfill missing emails when existing users sign in
Invited or waitlisted users, and anyone whose first sign-in dropped the provider email, now get a users_emails row on the next sign-in.
From the changelog: Fixed missing email records for existing users
Authdog Team
Authdog stores a user's emails on users_emails, separate from the core user row. Some accounts were created through invite or waitlist, or their first OAuth sign-in failed to persist the provider address. Later sign-ins skipped the insert path used for new users, so the email row never appeared. Directory views, messaging, and anything that reads users_emails looked empty even though the person could sign in.
Sign-in now reconciles the primary email on every successful OAuth callback.
This is the longer note behind the August 25 changelog entry.
How it works
After the existing user is resolved, the identity service calls reconcileUserEmails with the emails from the provider user map.
- No user id or empty email list → no-op
- A matching
users_emailsrow already present → no-op - A row exists with a different value → update to the provider primary
- No row → insert a primary email
Safe to run on every sign-in. It does not create a second user and it does not invent an address the IdP did not send.
Who this helps
- Users created by invite or waitlist who never got a
users_emailsrow - Users whose first provider sign-in failed partway through persistence
- Any later sign-in that should have backfilled the address
Password and OTP directory users that already have an email row are unchanged.
Trust boundaries
The source of truth for the backfill is the IdP assertion on that sign-in. Authdog writes the primary value the provider returned. If the IdP later sends a different primary, the row is updated. This is not an email-verification step; verification remains its own flow.
Try it
Sign in an invited user through SSO and confirm the email appears on the user record. The original release note is in the changelog.