fix(auth): remove Facebook email permission

src/data/schemas/auth/facebook_user_data.ts

@@ -12,7 +12,6 @@ export const FacebookUserDataSchema = z
   .object({
     id: stringOrNull,
     name: stringOrNull,
-    email: stringOrNull,
     pictureUrl: stringOrNull,
   })
   .readonly();

src/data/services/__tests__/facebook-graph.test.ts

@@ -0,0 +1,47 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { fetchFacebookUserData } from "../facebook-graph";
+
+describe("fetchFacebookUserData", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("requests profile data without requesting or returning email", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          id: "facebook-1",
+          name: "Elio",
+          email: "should-not-be-used@example.com",
+          picture: {
+            data: { url: "https://example.com/avatar.jpg" },
+          },
+        }),
+        {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        },
+      ),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await fetchFacebookUserData("access-token");
+    const requestUrl = new URL(String(fetchMock.mock.calls[0]?.[0]));
+
+    expect(requestUrl.searchParams.get("fields")).toBe(
+      "id,name,picture.type(large)",
+    );
+    expect(requestUrl.searchParams.get("fields")).not.toContain("email");
+    expect(requestUrl.searchParams.get("access_token")).toBe("access-token");
+    expect(result).toEqual({
+      success: true,
+      data: {
+        id: "facebook-1",
+        name: "Elio",
+        pictureUrl: "https://example.com/avatar.jpg",
+      },
+    });
+    if (result.success) expect(result.data).not.toHaveProperty("email");
+  });
+});

src/data/services/facebook-graph.ts

@@ -3,15 +3,16 @@
  *
  * 在 OAuth callback 之后、auth state machine 的 `syncingFacebookBackend` actor
  * 成功换取业务 token 之后调用 —— 用 accessToken 调 `/me` 拉用户资料（id / name
- * / email / picture），把 pictureUrl 写入 `UserStorage.setAvatarUrl()`、
+ * / picture），把 pictureUrl 写入 `UserStorage.setAvatarUrl()`、
  * id 写入 `AuthStorage.setAsid()`。
  *
- * 端点：`https://graph.facebook.com/me?fields=id,name,email,picture.type(large)&access_token=...`
+ * 端点：`https://graph.facebook.com/me?fields=id,name,picture.type(large)&access_token=...`
  *   - `picture.type(large)` 返回 ~200px 头像 URL（默认 square 50px 太小）
  *   - 不指定 version 走最新稳定版
  *   - 不需要 appId / appSecret（accessToken 自身就是凭证）
  */
 import { FacebookUserData, FacebookUserDataSchema } from "@/data/schemas/auth";
+import { FACEBOOK_PROFILE_FIELDS } from "@/lib/auth/facebook_provider";
 import { Logger } from "@/utils/logger";
 import { Result, toError } from "@/utils/result";
 
@@ -22,10 +23,9 @@ const GRAPH_ME_URL = "https://graph.facebook.com/me";
 
 /**
  * 拉取字段集合：
- *   - id / name / email —— 给本地 FacebookUserData 数据类
+ *   - id / name —— 给本地 FacebookUserData 数据类
  *   - picture.type(large) —— 头像 URL（默认 square 50px 太小）
  */
-const FIELDS = "id,name,email,picture.type(large)";
 
 /**
  * 用 accessToken 调 Facebook Graph `/me` 拉用户资料。
@@ -41,7 +41,7 @@ export async function fetchFacebookUserData(
     return Result.err(new Error("fetchFacebookUserData: accessToken is empty"));
   }
 
-  const url = `${GRAPH_ME_URL}?fields=${encodeURIComponent(FIELDS)}&access_token=${encodeURIComponent(accessToken)}`;
+  const url = `${GRAPH_ME_URL}?fields=${encodeURIComponent(FACEBOOK_PROFILE_FIELDS)}&access_token=${encodeURIComponent(accessToken)}`;
 
   log.debug(
     { url: url.replace(accessToken, "<redacted>") },
@@ -72,7 +72,6 @@ export async function fetchFacebookUserData(
     const data = FacebookUserDataSchema.parse({
       id: typeof json.id === "string" ? json.id : null,
       name: typeof json.name === "string" ? json.name : null,
-      email: typeof json.email === "string" ? json.email : null,
       pictureUrl,
     });
 
@@ -80,7 +79,6 @@ export async function fetchFacebookUserData(
       {
         hasId: !!data.id,
         hasName: !!data.name,
-        hasEmail: !!data.email,
         hasPicture: !!data.pictureUrl,
       },
       "fetchFacebookUserData SUCCESS",