[idp] Guarantee stable email address for IDP token for organization-bound users

[geropl]

Description

This mirrors the mechanism we use on the TS side into Go (filtering and sorting by lastSigninTime), and uses it in the identiyprovider.

Related Issue(s)

Relates to: ENT-764
Fixes: EXP-202

How to test

• join my SSO org: https://gpl-764-sso-email.preview.gitpod-dev.com/login/supercorp
• start a workspace, and run eval echo $(gp idp token --audience=a --scope=s --decode | jq .Payload.email)
• it will always return your Google email, taken from the SSO provider ✔️

Documentation

Preview status

gitpod:summary

Build Options

Build

• /werft with-werft
  Run the build with werft instead of GHA
• leeway-no-cache
• /werft no-test
  Run Leeway with --dont-test

Publish

• /werft publish-to-npm
• /werft publish-to-jb-marketplace

Installer

• analytics=segment
• with-dedicated-emulation
• workspace-feature-flags
  Add desired feature flags to the end of the line above, space separated

Preview Environment / Integration Tests

• /werft with-local-preview
  If enabled this will build install/preview
• /werft with-preview
• /werft with-large-vm
• /werft with-gce-vm
  If enabled this will create the environment on GCE infra
• /werft preemptible
  Saves cost. Untick this only if you're really sure you need a non-preemtible machine.
• with-integration-tests=all
  Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh. If enabled, with-preview and with-large-vm will be enabled.
• with-monitoring

/hold

[kylos101]

@geropl tests are failing with:

[components/public-api-server:app] --- FAIL: TestGetIDToken (3.43s)
[components/public-api-server:app]     --- FAIL: TestGetIDToken/org-owned_user (0.67s)
[components/public-api-server:app]     --- PASS: TestGetIDToken/none_org-owned_user (0.49s)
[components/public-api-server:app]     --- PASS: TestGetIDToken/workspace_not_found (0.30s)
[components/public-api-server:app]     --- PASS: TestGetIDToken/no_logged_in_user (0.38s)
[components/public-api-server:app]     --- PASS: TestGetIDToken/no_audience (0.80s)
[components/public-api-server:app]     --- FAIL: TestGetIDToken/include_scope (0.37s)
[components/public-api-server:app]     --- PASS: TestGetIDToken/token_source_error (0.42s)

[geropl]

Should be fixed now.
Re-deploying preview env again... 👀

[geropl]

/unhold

[geropl]

Thank you @iQQBot ! 🙏