Social login Apple private-relay email handling with stable pseudonym mapping

[thlpkee20-wq]

Description

Apple's "Hide My Email" changes the address per app installation but preserves the stable sub. Ensure account lookup keys on sub, not email, and store the private-relay address only as a transient contact. Add tests covering re-installations.

Requirements and context

• Must be secure, tested, and documented
• Should be efficient and easy to review
• Relevant code: src/auth/social/socialAuthService.ts, src/auth/social/providerVerifiers.ts
• Private-relay email flagged in DB schema

Suggested execution

• Fork the repo and create a branch
• git checkout -b feat/social-apple-private-relay
• Implement changes
  • Update lookup to use sub
  • Add relay flag to contact schema
  • Cover with reinstall test
• Validate security and correctness assumptions

Test and commit

• Run tests
  • npm test
• Cover edge cases
  • Multiple relays across installs merged safely
• Include test output and notes

Example commit message

feat: Apple private-relay email handling

Guidelines

• Minimum 95 percent test coverage
• Clear documentation
• Timeframe: 96 hours