[lipowen]

Summary

Removes the scope guard that #3 (4fc4906) added to OmniAuth::Strategies::Line#email:

return nil if scope && !scope.split.include?('email')

LINE's token response never lists email in scope, even when the user granted the email permission. From the LINE Login v2.1 reference: "Even if the email permission is granted, the scope property doesn't include email." The email claim exists only inside the ID token and is read via POST /oauth2/v2.1/verify. With the guard in place every real login skipped the verify call, so info[:email] was always nil on master (ffeb2a4). The gem's suite passed only because the fixture stubbed scope: 'profile openid email', a value LINE does not return; the live E2E noted in #3 predates that commit.

Impact on kaikhq/manekineko is limited: its User.from_omniauth decodes the email from extra[:id_token] itself for LINE and never reads info[:email], and extra[:id_token] is unaffected by the guard. Production also still pins 8efe18d. kaikhq/manekineko#16165 is therefore not broken by ffeb2a4, but should still pick up this fix so info[:email] is correct for every consumer.

Changes

• lib/omniauth/strategies/line.rb: drop the scope check; keep return nil unless id_token. The resulting file is byte-identical to the strategy immediately before 4fc4906.
• spec/omniauth/strategies/line_spec.rb: the shared token fixture uses LINE's real scope string (profile openid) so the happy-path email example fails against the guarded code; the context encoding the wrong scope model is removed; a new context covers the not-granted case (verify answers 200 without an email claim → info[:email] is nil).

Verification

• bundle exec rake: 19 examples, 0 failures, 100% line coverage.
• Restoring master's line.rb under the new spec turns 2 examples red (email nil; the timeout example no longer reaches verify), so the spec does guard the regression.

Follow-ups

• Make configured options reach LINE and harden the outbound calls #4 is rebased onto this branch; its email method carried the same guard and the same fix applies.
• The verify call still has no rescue for non-JSON bodies or connection errors other than ETIMEDOUT — pre-existing (also on 8efe18d), and Make configured options reach LINE and harden the outbound calls #4 adds timeouts plus degradation to nil.

Linear: TEACH-22605

[Copilot]

Pull request overview

This PR fixes LINE email retrieval by ensuring the strategy always verifies the id_token (when present) to decode the email claim, instead of gating the verify call on the token response’s scope field (which LINE doesn’t include email in).

Changes:

• Removes the scope-based early return from OmniAuth::Strategies::Line#email, keeping only the id_token presence guard.
• Updates specs to reflect LINE’s real token scope (profile openid) and adds coverage for the “email permission not granted” verify response shape (200 without an email claim).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
lib/omniauth/strategies/line.rb	Drops scope guard so email verification happens whenever an id_token exists.
spec/omniauth/strategies/line_spec.rb	Updates fixtures to match real scopes and adds a no-email-claim verify response scenario.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.