OAuth2 /oauth/userinfo response does not match committed OpenAPI UserInfo schema

Summary

The committed OpenAPI spec documents a UserInfo schema for GET /oauth/userinfo, but the live handler returns a different field set and naming convention.

Expected (OpenAPI)

docs/openapi.json — components.schemas.UserInfo:

• id (string)
• email (string)
• name (string)
• picture (string, uri)

GET /oauth/userinfo response is documented as #/components/schemas/UserInfo.

Actual (runtime)

apps/webapp/app/routes/oauth.userinfo.tsx calls oauth2Service.getUserInfo(), which returns:

{
  "sub": "<user id>",
  "email": "<email>",
  "name": "<name>",
  "display_name": "<displayName>",
  "avatar_url": "<avatarUrl>",
  "email_verified": true
}

(apps/webapp/app/services/oauth2.server.ts, getUserInfo)

Notes

• Avatar data exists on the user model as User.avatarUrl (apps/webapp/prisma/schema.prisma), not picture.
• ID tokens can include a picture claim (mapped from avatarUrl when profile scope is granted), but the userinfo endpoint does not return picture or id.
• OAuth2/OIDC clients generated from the committed spec will expect fields the endpoint does not provide.

Suggested fix

Either:

1. Update getUserInfo() to match the OpenAPI schema (id, picture, etc.), or
2. Update docs/openapi.json to document the actual response (sub, avatar_url, display_name, email_verified, …).

Impact

Contract/documentation drift for OAuth2 integrators; SDKs and conformance tests built from the spec will not match production behavior.

Detected via cross-layer static analysis (DriftLens) against a shallow clone; please verify on current main.

Verify the current behavior in apps/webapp/app/routes/oauth.userinfo.tsx and apps/webapp/app/services/oauth2.server.ts, then compare it with components.schemas.UserInfo in docs/openapi.json and User.avatarUrl in apps/webapp/prisma/schema.prisma. Decide which contract is authoritative with the maintainer, then update the implementation or specification so the documented and live response fields match.