Add check to verify if webAuthUser is email address

[prajith-nair]

Description: There are scenarios where application accepts X-WEBAUTH-USER as email address. We need to get login name from the email, if REVERSE_PROXY_AUTHENTICATION_USER is empty.

Issue : https://github.com/go-gitea/gitea/issues/20433

[prajith-nair]

@lunny Please let us know if this request will be considered in 1.18.0, as its critical for our ecosystem to allow Gitea authentication based on X-WEBAUTH-USER header as email address.

[codecov-commenter]

Codecov Report

:exclamation: No coverage uploaded for pull request base (main@3f9e323). Click here to learn what that means. The diff coverage is 0.00%.

@@           Coverage Diff           @@
##             main   #20435   +/-   ##
=======================================
  Coverage        ?   47.10%           
=======================================
  Files           ?     1016           
  Lines           ?   138049           
  Branches        ?        0           
=======================================
  Hits            ?    65032           
  Misses          ?    65078           
  Partials        ?     7939           

Impacted Files	Coverage Δ
services/auth/reverseproxy.go	0.00% <0.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[KN4CK3R]

I think it would be better to use a different logic.

1. Extract the username header
2. Does it look like an email? Search for the user by email
3. Does it not look like an email? Search for the user by name
4. Empty username header? Extract the email header
5. Not empty? Search for the user by email

[wxiaoguang]

TBH, I do not think there should be too many "implicit logic" in the auth code.

Email is email, username is username, it seems fragile to keep "guessing" the values.

• https://github.com/go-gitea/gitea/issues/20433#issuecomment-1541468646

[wxiaoguang]

I think this pr/issue can be closed, feel free to reopen if there are new thoughts.