fix: unlink OIDC providers when user updates email address (#3307)

Author: MrBobertus

src/backend/controllers/auth/AuthController.ts

@@ -2038,6 +2038,8 @@ export class AuthController extends PuterController {
             requires_email_confirmation: 0,
         });
 
+        await this.stores.oidc.unlinkAllByUserId(user.id);
+
         try {
             this.clients.event?.emit(
                 'user.email-changed' as never,

src/backend/stores/oidc/OIDCStore.js

@@ -87,4 +87,11 @@ export class OIDCStore extends PuterStore {
             [userId, provider],
         );
     }
+
+    async unlinkAllByUserId(userId) {
+        await this.clients.db.write(
+            'DELETE FROM `user_oidc_providers` WHERE `user_id` = ?',
+            [userId],
+        );
+    }
 }