Meteor: Can I copy third party login emails to the root emails key in user document? -

i have collaboration app, depends on user having unique username or email.

i planning on using google third party login.

i've tested , notice when login google account email available under services key, no email key or username key exists.

so have done in accounts.oncreateuser function extract email address , manually create emails key address , verified keys user have if signed up.

like this

accounts.oncreateuser (options,user) ->    unless user.emails?      emaildata =        address: determineemail(user) * gets [user.services.google.email]       verified: false      user.emails = []     user.emails.push emaildata    if options.profile?     if options.profile.name?       namearr = options.profile.name.split(" ")       firstname = namearr[0]       lastname = namearr[1]        options.profile.firstname = firstname       options.profile.lastname = lastname      user.profile = options.profile    user 

so extracting email google services , make email available @ meteor.user().emails[0].address

this because use meteor.user().emails[0].address throughout app.

will cause issues though? i've tested in limited fashion , seems ok, there concerns have not considered?

if accounts-password package ever gets added app (either directly or dependency of package add), then:

1. accounts.createuser() fail email address. if want allow user login either google or password, might confusing user, since ui treat them they'd forgotten password never had.
2. an attacker able cause server send "reset password" emails email address.
3. an attacker able check whether user email address has account in app (by calling accounts.createuser() , seeing whether fails). seriousness of such privacy violation app dependent.

if of things matter you, might want check out splendido:accounts-emails-field mark uretsky mentioned.