fix: validateEmail should normalise emails

internal/api/mail.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/didip/tollbooth/v5"
@@ -559,7 +560,7 @@ func (a *API) validateEmail(email string) (string, error) {
 		return "", badRequestError(ErrorCodeValidationFailed, "Unable to validate email address: "+err.Error())
 	}
 
-	return email, nil
+	return strings.ToLower(email), nil
 }
 
 func validateSentWithinFrequencyLimit(sentAt *time.Time, frequency time.Duration) error {

internal/api/mail_test.go

@@ -48,6 +48,49 @@ func (ts *MailTestSuite) SetupTest() {
 	require.NoError(ts.T(), ts.API.db.Create(u), "Error saving new user")
 }
 
+func (ts *MailTestSuite) TestValidateEmail() {
+	cases := []struct {
+		desc          string
+		email         string
+		expectedEmail string
+		expectedError error
+	}{
+		{
+			desc:          "valid email",
+			email:         "test@example.com",
+			expectedEmail: "test@example.com",
+			expectedError: nil,
+		},
+		{
+			desc:          "email should be normalized",
+			email:         "TEST@EXAMPLE.COM",
+			expectedEmail: "test@example.com",
+			expectedError: nil,
+		},
+		{
+			desc:          "empty email should return error",
+			email:         "",
+			expectedEmail: "",
+			expectedError: badRequestError(ErrorCodeValidationFailed, "An email address is required"),
+		},
+		{
+			desc: "email length exceeds 255 characters",
+			// email has 256 characters
+			email:         "testtesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttesttest@example.com",
+			expectedEmail: "",
+			expectedError: badRequestError(ErrorCodeValidationFailed, "An email address is too long"),
+		},
+	}
+
+	for _, c := range cases {
+		ts.Run(c.desc, func() {
+			email, err := ts.API.validateEmail(c.email)
+			require.Equal(ts.T(), c.expectedError, err)
+			require.Equal(ts.T(), c.expectedEmail, email)
+		})
+	}
+}
+
 func (ts *MailTestSuite) TestGenerateLink() {
 	// create admin jwt
 	claims := &AccessTokenClaims{

internal/api/verify_test.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"strings"
 	"testing"
 	"time"
 
@@ -900,6 +901,19 @@ func (ts *VerifyTestSuite) TestVerifyValidOtp() {
 				tokenHash: crypto.GenerateTokenHash(u.GetEmail(), "123456"),
 			},
 		},
+		{
+			desc:     "Valid Email OTP (email casing shouldn't matter)",
+			sentTime: time.Now(),
+			body: map[string]interface{}{
+				"type":  mail.EmailOTPVerification,
+				"token": "123456",
+				"email": strings.ToUpper(u.GetEmail()),
+			},
+			expected: expected{
+				code:      http.StatusOK,
+				tokenHash: crypto.GenerateTokenHash(u.GetEmail(), "123456"),
+			},
+		},
 		{
 			desc:     "Valid Email Change OTP",
 			sentTime: time.Now(),