fix(auth): normalize user emails to lowercase on write #333
Loading…
Reference in a new issue
No description provided.
Delete branch "fix/BUNYIP-325-normalize-email-lowercase"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Signing up with a mixed-case email ("Nice.Guy@Example.COM") stored the address verbatim. Lookups already compared with LOWER(email) so login kept working, but the stored address (and the OIDC email claim and the address outbound verification / welcome mail is sent to) diverged in case from what case-sensitive downstream consumers expect, so the verification mail was never reconciled and the account stayed stuck unverified.
Funnel every write to users.email through a new normalize_email() helper (lowercase only, matching the untrimmed LOWER($1) read side) at the two and only write paths: UserRepository::create (the single INSERT choke point that every signup surface inherits) and UserRepository::update_email (the email-change path). Back the stored value with a one-shot backfill migration that lowercases pre-existing rows; it is collision-safe because the BUNYIP-330 users_email_unique index is already on LOWER(email), and idempotent via a WHERE email <> LOWER(email) guard.
Unit-test the helper (mixed-case lowercased, idempotent on already-lowercase). The other three INSERT INTO users sites are non-production e2e/test-only with lowercase-by-construction emails, so the invariant holds workspace-wide.
#BUNYIP-325
Signing up with a mixed-case email ("Nice.Guy@Example.COM") stored the address verbatim. Lookups already compared with LOWER(email) so login kept working, but the stored address (and the OIDC email claim and the address outbound verification / welcome mail is sent to) diverged in case from what case-sensitive downstream consumers expect, so the verification mail was never reconciled and the account stayed stuck unverified. Funnel every write to users.email through a new normalize_email() helper (lowercase only, matching the untrimmed LOWER($1) read side) at the two and only write paths: UserRepository::create (the single INSERT choke point that every signup surface inherits) and UserRepository::update_email (the email-change path). Back the stored value with a one-shot backfill migration that lowercases pre-existing rows; it is collision-safe because the BUNYIP-330 users_email_unique index is already on LOWER(email), and idempotent via a WHERE email <> LOWER(email) guard. Unit-test the helper (mixed-case lowercased, idempotent on already-lowercase). The other three INSERT INTO users sites are non-production e2e/test-only with lowercase-by-construction emails, so the invariant holds workspace-wide. #BUNYIP-325