Use only verified email address to prevent fake email address

Co-authored-by: David Taylor <david@taylorhq.com>

lib/omniauth/strategies/apple.rb

@@ -104,7 +104,7 @@ def user_info
       end
 
       def email
-        user_info['email'] || id_info['email']
+        id_info['email']
       end
 
       def first_name

spec/omniauth/strategies/apple_spec.rb

@@ -252,6 +252,21 @@
       end
     end
 
+    context 'with a spoofed email in the user payload' do
+      before do
+        request.params['user'] = {
+          name: {
+            firstName: 'first',
+            lastName: 'last'
+          },
+          email: "spoofed@example.com"
+        }.to_json
+      end
+
+      it 'should return the true email' do
+        expect(subject.info[:email]).to eq('something@privatrerelay.appleid.com')
+      end
+    end
   end
 
   describe '#extra' do