feat(auth): Fix OAuth Domain casing

[justin-tahara]

Description

[Provide a brief description of the changes in this PR]
We had an issue with a customer domain returning a non lowercase domain thus failing the casing issues when there were uppercase domains being returned by the IdP.

This PR aims to fix this to ensure that we can handle all types of domains that are returned by any IdP.

How Has This Been Tested?

[Describe the tests you ran to verify your changes]
Ran the local unit tests by running:
pytest -s backend/tests/unit/onyx/auth/test_verify_email_domain.py

Backporting (check the box to trigger backport action)

Note: You have to check that the action passes, otherwise resolve the conflicts manually and tag the patches.

• This PR should be backported (make sure to check that the backport attempt succeeds)
• [Optional] Override Linear Check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
internal-search	Ready	Preview	Comment	Aug 19, 2025 4:53pm

[greptile-apps]

Greptile Summary

This PR fixes a case sensitivity issue in OAuth domain validation where Identity Providers (IdPs) returning email domains with uppercase letters were causing authentication failures. The solution involves three coordinated changes:

1. Configuration normalization (app_configs.py): The VALID_EMAIL_DOMAINS list is now processed to convert all configured domains to lowercase during initialization, with empty domains filtered out.

2. Runtime validation enhancement (users.py): The verify_email_domain function now converts the extracted email domain to lowercase before comparing against the whitelist, ensuring case-insensitive matching.

3. Comprehensive test coverage (test_verify_email_domain.py): New unit tests validate the case-insensitive functionality across multiple scenarios including uppercase domains, invalid domains, and malformed emails.

This change addresses a real customer issue where their IdP was returning domains like 'EXAMPLE.COM' which failed validation against lowercase entries in the whitelist. The fix follows standard email domain handling practices where domains are case-insensitive per RFC specifications. The solution maintains the existing security validation logic while making it more robust for various IdP implementations that may return domains in different cases.

Confidence score: 5/5

• This PR is safe to merge with minimal risk
• Score reflects simple, well-tested changes that follow email standards and address a specific customer issue
• No files require special attention

_{3 files reviewed, no comments}

_{Edit Code Review Bot Settings | Greptile}

[cubic-dev-ai]

No issues found across 3 files