Return username and avatar URL in OAuth callback responses

[Copilot]

OAuth callbacks now return the provider's username and avatar URL alongside existing identifiers, eliminating the need for downstream systems to make additional API calls to fetch user profile data.

Changes

• UserInfo model: Added Username and AvatarURL fields
• GitHub provider: Fetch login and avatar_url from GitHub Users API
• Response types: Extended LoginByOAuthResponse and BindUserByOAuthResponse with optional username and avatar_url fields
• Service layer: Pass through provider data without persistence

Example Response

{
  "token": { ... },
  "username": "octocat",
  "avatar_url": "https://avatars.githubusercontent.com/u/583231"
}

Fields are empty strings when provider doesn't return them. No breaking changes - new fields are optional and additive.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• buf.build
  • Triggering command: /home/REDACTED/go/bin/buf buf generate /home/REDACTED/go/pkg/mod/github.com/bufbuild/protocompile@v0.14.2-0.2026011416050-c=4 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Enhance OAuth callback to return username and avatar URL to client</issue_title>
<issue_description>## Summary
Update the OAuth callback logic so that, in addition to the fixed identifiers (userID/sub, provider ID, and email), the server also returns the user's display name (username) and avatar URL if available from the third-party provider (e.g., GitHub).

Acceptance Criteria

• The LoginByOAuth and/or OAuth callback now returns the upstream user's display name (e.g., GitHub login name) and avatar URL in the response object, when available.
• Update the internal UserInfo model and related provider logic to capture username and avatar_url from at least GitHub.
• API response schema and documentation updated accordingly.
• Caller can access these values on successful login or binding (no requirement to persist them in Identra, just return them in the response if available).
• If upstream does not return avatar/name, these fields are absent or empty, not an error.

Notes

• There is no need to persist username or avatar in Identra storage; only forward them in the callback payload when available.
• Consider extensibility for other providers if possible.
• Add/update test coverage for this behavior.

Motivation

Upstream systems frequently need to create or present user accounts immediately following OAuth sign-in, so being able to get username and avatar in the callback simplifies implementation and removes the need for additional API calls.
</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Enhance OAuth callback to return username and avatar URL to client #7

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.