Skip to content

Commit

Permalink
case insensitive user emails (#62)
Browse files Browse the repository at this point in the history
For now create user endpoint can create user with user sensitive email,
this PR fixes that and also handles the case if we'll get case-sensitive
email from firebase token as we cannot control them.

SQL to convert existing users into lowercase:
```
UPDATE users SET email = lower(email) WHERE lower(email) != email AND email != id;
```
  • Loading branch information
ice-cronus authored Oct 17, 2023
1 parent 074d922 commit 538a4be
Show file tree
Hide file tree
Showing 3 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion auth/email_link/users.go
Original file line number Diff line number Diff line change
Expand Up @@ -264,7 +264,7 @@ func (c *client) Metadata(ctx context.Context, userID, tokenEmail string) (strin
}
if md.Email != nil {
emailEmpty := *md.Email == "" || *md.Email == *md.UserID
if tokenEmail != "" && !emailEmpty && tokenEmail != *md.Email { //nolint:gosec // .
if tokenEmail != "" && !emailEmpty && !strings.EqualFold(tokenEmail, *md.Email) { //nolint:gosec // .
return "", nil, terror.New(ErrUserDataMismatch, map[string]any{"email": *md.Email})
}
}
Expand Down
2 changes: 1 addition & 1 deletion cmd/eskimo-hut/auth.go
Original file line number Diff line number Diff line change
Expand Up @@ -261,7 +261,7 @@ func (s *service) findMetadataUsingIceID(ctx context.Context, loggedInUser *serv
) {
var md string
var mdFields *users.JSON
iceID, iErr := s.authEmailLinkClient.IceUserID(ctx, loggedInUser.Email)
iceID, iErr := s.authEmailLinkClient.IceUserID(ctx, strings.ToLower(loggedInUser.Email))
if iErr != nil {
return nil, server.NotFound(multierror.Append(
errors.Wrapf(err, "metadata for user with id `%v` was not found", loggedInUser.UserID),
Expand Down
2 changes: 1 addition & 1 deletion cmd/eskimo-hut/users.go
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ func (s *service) CreateUser( //nolint:funlen,gocritic // .
func buildUserForCreation(req *server.Request[CreateUserRequestBody, User]) *users.User {
usr := new(users.User)
usr.ID = req.AuthenticatedUser.UserID
usr.Email = req.Data.Email
usr.Email = strings.ToLower(req.Data.Email)
usr.PhoneNumber = req.Data.PhoneNumber
usr.PhoneNumberHash = req.Data.PhoneNumberHash
usr.FirstName = &req.Data.FirstName
Expand Down

0 comments on commit 538a4be

Please sign in to comment.