fix: return email_address_not_provided for external provider with no email

The OAuth callback rejected a missing provider email with a generic
NewInternalServerError, surfacing as HTTP 500 / unexpected_failure. That
masks a non-server fault and leaves clients without a stable way to detect
the case (only the human-readable message). Use the already-defined but
unused ErrorCodeEmailAddressNotProvided via NewUnprocessableEntityError
(422) so clients can handle it explicitly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: PierreVieira

internal/api/external.go

@@ -173,7 +173,7 @@ func (a *API) internalExternalProviderCallback(w http.ResponseWriter, r *http.Re
 	userData := data.userData
 
 	if len(userData.Emails) == 0 && !emailOptional {
-		return apierrors.NewInternalServerError("Error getting user email from external provider")
+		return apierrors.NewUnprocessableEntityError(apierrors.ErrorCodeEmailAddressNotProvided, "Error getting user email from external provider")
 	}
 
 	userData.Metadata.EmailVerified = false

internal/api/external_google_test.go

@@ -8,6 +8,7 @@ import (
 	"net/url"
 
 	"github.com/stretchr/testify/require"
+	"github.com/supabase/auth/internal/api/apierrors"
 	"github.com/supabase/auth/internal/api/provider"
 )
 
@@ -105,6 +106,10 @@ func (ts *ExternalTestSuite) TestSignupExternalGoogleDisableSignupErrorWhenEmpty
 	u := performAuthorization(ts, "google", code, "")
 
 	assertAuthorizationFailure(ts, u, "Error getting user email from external provider", "server_error", "google@example.com")
+
+	q, err := url.ParseQuery(u.RawQuery)
+	ts.Require().NoError(err)
+	ts.Require().Equal(apierrors.ErrorCodeEmailAddressNotProvided, q.Get("error_code"))
 }
 
 func (ts *ExternalTestSuite) TestSignupExternalGoogleDisableSignupSuccessWithPrimaryEmail() {