From 25b3deb19ba6f7e3893ca6ac8fd535f1943820af Mon Sep 17 00:00:00 2001
From: Chris Christiansen <chris.christiansen@vauco.no>
Date: Sat, 19 Sep 2026 18:05:59 +0000
Subject: [PATCH] feat(identity): retain verified OIDC subject in web session

---
 opax-web/backend/server.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/opax-web/backend/server.js b/opax-web/backend/server.js
index 951be97..aba9425 100644
--- a/opax-web/backend/server.js
+++ b/opax-web/backend/server.js
@@ -57,7 +57,10 @@ app.get('/auth/callback', async (req, res, next) => {
     let { tokens } = await oauth.getToken(req.query.code);
     let p = (await oauth.verifyIdToken({ idToken: tokens.id_token, audience: process.env.GOOGLE_CLIENT_ID })).getPayload();
     if (!p?.email || !emails.has(p.email)) return res.status(403).send('Not authorised');
-    req.session.user = { email: p.email, name: p.name || p.email };
+    if (typeof p.sub !== "string" || !p.sub.trim()) {
+        return next(new Error('Verified Google ID token missing subject'));
+    }
+    req.session.user = { email: p.email, name: p.name || p.email, sub: p.sub };
     res.redirect('/');
   } catch (e) {
     next(e);