fix(security): block OAuth account takeover via pending exchange

[puppywang]

Summary

Fixes a critical account-takeover vulnerability (0day) in the pending OAuth flow: an attacker who only knows a victim's email address can bind their own LinuxDo / OIDC / WeChat / DingTalk identity to the victim's account and log in as them.

Attack chain

1. Attacker logs in with their own OAuth account (intent=login) and lands on the email-completion step.
2. Attacker submits the victim's email via POST /auth/oauth/pending/create-account with an arbitrary password. Because the email already exists, the handler transitions the pending session into the choice state with TargetUserID = victim, existing_account_bindable = true — no password, no email verification code, no captcha, no proof of ownership is ever checked on this path (the captcha check is skipped when the email exists).
3. Attacker calls POST /auth/oauth/pending/exchange with an adoption decision (adopt_display_name / adopt_avatar — pure booleans unrelated to account ownership). ExchangePendingOAuthCompletion only guarded against email_completion / bind_login_required steps, so the request falls through to applyPendingOAuthAdoption → applyPendingOAuthBinding, and shouldBindPendingOAuthIdentity returns true unconditionally for intent=login.
4. The attacker's OAuth identity is now bound to the victim's account. On the next OAuth login, findOAuthIdentityUser resolves the attacker to the victim and the exchange endpoint issues the victim's token pair.

Fix

ExchangePendingOAuthCompletion now only performs adoption/binding for:

1. Terminal login sessions (canIssueTokenPair == true) — the identity was already safely bound to that user during a completed login;
2. bind_current_user sessions — initiated by an authenticated user whose binding target comes from the login-session cookie.

Every other state (including choose_account_action_required) returns the payload without binding the identity and without consuming the session, so the attacker cannot proceed to the next step either.

Testing

• New regression test TestExchangePendingOAuthCompletionChoiceStateDoesNotBindIdentity reproduces the exact attack (choice-state session + adoption decision → identity not bound, session not consumed, no token issued).
• All existing TestExchangePendingOAuthCompletion*, TestCreateOIDCOAuthAccount*, TestSendPendingOAuthVerifyCode*, and the full internal/handler package tests pass.

Recommendation for follow-up (not included)

Defense in depth: when create-account / send-verify-code discovers an existing email, the session should transition to a password/2FA-required state (bind_login_required semantics) instead of a choice state that implies bindability. Please also audit existing auth_identities rows for bindings whose upstream email does not match the owning user.

[github-actions]

Thank you for your contribution! Before we can merge this PR, we need you to sign our Contributor License Agreement (CLA).

To sign, please reply with the following comment:

I have read the CLA Document and I hereby sign the CLA

You only need to sign once — it will be valid for all your future contributions to this project.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[puppywang]

I have read the CLA Document and I hereby sign the CLA github-actions[bot] ***@***.***> 于2026年8月7日周五 03:41写道：

…

*github-actions[bot]* left a comment (Wei-Shaw/sub2api#5345) <#5345 (comment)> Thank you for your contribution! Before we can merge this PR, we need you to sign our Contributor License Agreement (CLA) <https://github.com/Wei-Shaw/sub2api/blob/main/CLA.md>. *To sign*, please reply with the following comment: I have read the CLA Document and I hereby sign the CLA You only need to sign once — it will be valid for all your future contributions to this project. ------------------------------ I have read the CLA Document and I hereby sign the CLA ------------------------------ You can retrigger this bot by commenting *recheck* in this Pull Request. Posted by the *CLA Assistant Lite bot*. — Reply to this email directly, view it on GitHub <#5345?email_source=notifications&email_token=AAVFRBSWHPHHZV32LKDJUFD5ITNPJA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRQHA3DIMJXHE42M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-5208641799>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAVFRBQSPOOUZ7KZZJ2STIL5ITNPJAVCNFSNUABGKJSXA33TNF2G64TZHMYTCMJYGYYDCNJRHA5US43TOVSTWNJQHA2DCMRSHA2TRILWAI> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/AAVFRBQQ5EOOXIW36FJRXRL5ITNPJA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRQHA3DIMJXHE42M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/AAVFRBXENAUW2TCEOVJ3Z7D5ITNPJA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMRQHA3DIMJXHE42M4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>

[puppywang]

recheck