Verified email attribute

[sea-snake]

Support new identity attributes verified_email that are certified by II only upon evidence that the email address is actually controlled by the authenticated user.

Changes

• Added VerifiedEmail variant to the AttributeName enum for certifying verified email addresses
• Introduced OpenIdEmailVerificationScheme enum with Google and Microsoft variants, along with corresponding Candid types
• Implemented provider-specific email verification logic: Google uses email_verified claim, Microsoft validates personal account tenant IDs
• Refactored attribute preparation to use dedicated getter methods with improved maintainability

Tests

Verified email attribute tests (verified_email_tests)

Sets up real Google and Microsoft providers via openid::setup so config_issuer(), get_verified_email(), and scope matching all work end-to-end through prepare_openid_attributes.

Google (email_verified claim, case-insensitive):

• Returns verified email when email_verified is "true"
• Returns nothing when email_verified is "false"
• Returns nothing when email_verified metadata is absent
• Returns nothing when email metadata is absent (even if email_verified is "true")
• Accepts case variations ("True") — verifies case-insensitive check
• Returns nothing when email_verified is stored as Bytes instead of String

Microsoft (tid-based personal account check):

• Returns verified email when tid matches the personal account tenant ID
• Returns nothing for enterprise (non-personal) tenant IDs
• Skips credential entirely when tid is missing (provider can't resolve {tid} placeholder)
• Returns nothing when email metadata is absent

Combined / cross-cutting:

• Both Google and Microsoft verified emails returned in a single multi-credential anchor
• Verified email returned alongside email and name attributes in one request
• Credential with unknown issuer (no matching provider) is skipped entirely

All tests also assert that requested is properly drained (empty after call) when the scope was consumed, or remains non-empty when the credential was skipped.

[aterga]

LGTM, just needs some tests

[Copilot]

Pull request overview

This pull request adds support for verified email attributes in the Internet Identity OpenID integration. The feature allows certification of email addresses that have been verified by identity providers (Google and Microsoft), ensuring that the authenticated user actually controls the email address.

Changes:

• Added VerifiedEmail variant to the AttributeName enum for certifying verified email addresses
• Introduced OpenIdEmailVerificationScheme enum with Google and Microsoft variants, along with corresponding Candid types
• Implemented provider-specific email verification logic: Google uses email_verified claim, Microsoft validates personal account tenant IDs
• Refactored attribute preparation to use dedicated getter methods with improved maintainability

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/internet_identity_interface/src/internet_identity/types/attributes.rs	Adds VerifiedEmail to AttributeName enum with string conversions
src/internet_identity_interface/src/internet_identity/types.rs	Defines OpenIdEmailVerificationScheme enum and adds email_verification field to OpenIdConfig
src/internet_identity/src/openid/generic.rs	Implements email_verified claim parsing (supporting both bool and string types), validation, and metadata storage
src/internet_identity/src/openid.rs	Adds email verification methods for Google and Microsoft, extends OpenIdProvider trait with email_verification_schema method
src/internet_identity/src/attributes.rs	Refactors attribute preparation to use getter methods and adds comprehensive unit tests for verified email scenarios
src/internet_identity/internet_identity.did	Adds OpenIdEmailVerification variant type to Candid interface
src/internet_identity/tests/integration/*.rs	Updates all OpenIdConfig instantiations to include email_verification field (set to None)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.