About the behavior of email checking during SSO login

[RaphaelRoumezin]

vaultwarden/src/api/identity.rs

Lines 341 to 346 in 660faee

	if user.email != user_infos.email {
	if CONFIG.mail_enabled() {
	mail::send_sso_change_email(&user_infos.email).await?;
	}
	info!("User {} email changed in SSO provider from {} to {}", user.uuid, user.email, user_infos.email);
	}

When a user logs in with SSO, and the email returned by the IdP differs from the one in its account, it will just log about it and inform the user by email that they should change the email in their user settings.

A few questions:

1. Why do the user have to be warned about this every time they log in ? Does it really make a difference if the user email match or not, since this does not affect login when the sso user association already exists ? Why can't the email just be corrected automatically in this check, instead of mailing the user ?
2. This seems to not take into the account the config EMAIL_CHANGE_ALLOWED, so the user may be asked by email to change the email in their settings when they just can't.