Fix PostgreSQL boolean casting vulnerability in DatabaseUserRepository

[Copilot]

PostgreSQL returns 'f' for boolean false, which PHP casts to true via (bool)'f', causing unverified accounts to bypass email verification checks.

Changes

• Replace naive (bool) cast with explicit normalization in mapRowToUser()
• Check if value is already boolean, otherwise test against truthy string list: ['1', 'true', 't', 'yes', 'on']
• Default to false for all other values including PostgreSQL's 'f'

// Before - vulnerable to PostgreSQL 'f' strings
'email_verified' => (bool)$row['email_verified'],

// After - explicit normalization
$emailVerifiedRaw = $row['email_verified'] ?? null;
$emailVerified = is_bool($emailVerifiedRaw)
    ? $emailVerifiedRaw
    : in_array(strtolower((string)$emailVerifiedRaw), ['1', 'true', 't', 'yes', 'on'], true);

Handles SQLite/MySQL integers (0/1), PostgreSQL booleans ('t'/'f'), and native PHP booleans.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}