test(auth): cover non-string email claims and email-less stubs

Sourcery review follow-ups: a JWT whose "email" claim is an int or
list must parse to email=None without erroring, and an email-only
allowlist must gracefully deny a user object lacking the email
attribute entirely — pinning _email_of's getattr fallback.

Author: Zingzy

tests/unit/services/test_feature_flag_service.py

@@ -170,6 +170,20 @@ async def test_no_email_attribute_falls_back_to_user_id(self):
         # _user() with no email omits the attribute; getattr returns None.
         assert await service.is_enabled("test_flag", _user(USER_A)) is True
 
+    @pytest.mark.asyncio
+    async def test_email_only_allowlist_denies_stub_without_email_attribute(self):
+        # Pins _email_of's getattr fallback: a user object with NO email
+        # attribute at all (not CurrentUser with email=None) against an
+        # email-ONLY allowlist → graceful deny, no AttributeError.
+        flag = _flag(
+            rollout_type=RolloutType.ALLOWLIST,
+            allowlist_emails=["alice@example.com"],
+        )
+        service, _, _ = make_service(flag=flag)
+        stub = _user(USER_A)  # SimpleNamespace; email attribute omitted
+        assert not hasattr(stub, "email")
+        assert await service.is_enabled("test_flag", stub) is False
+
     @pytest.mark.asyncio
     async def test_current_user_email_field_flows_through(self):
         """CurrentUser.email (JWT "email" claim / UserDoc email) satisfies

tests/unit/test_auth_deps.py

@@ -235,6 +235,21 @@ async def test_jwt_blank_email_claim_yields_none_email(self):
         assert result is not None
         assert result.email is None
 
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("bad_email", [42, ["alice@example.com"]])
+    async def test_jwt_non_string_email_claim_yields_none_email(self, bad_email):
+        # A token whose "email" claim is not a string (int, list, …) must
+        # still authenticate — the claim parses to None, never an error.
+        token = make_jwt_token(email=bad_email)
+        req = make_request(auth_header=f"Bearer {token}")
+
+        with patch("dependencies.auth.get_settings", return_value=make_settings()):
+            result = await get_current_user(req, db=MagicMock())
+
+        assert result is not None
+        assert result.user_id == USER_OID
+        assert result.email is None
+
     @pytest.mark.asyncio
     async def test_token_factory_round_trip_populates_email(self):
         # Mint with the real TokenFactory → resolve via get_current_user: