fix case-insensitive local auth user lookup

server/models/User.js

@@ -348,11 +348,13 @@ class User extends Model {
   static async getUserByUsername(username) {
     if (!username) return null
 
-    const cachedUser = userCache.getByUsername(username)
+    const normalizedUsername = username.toLowerCase()
+
+    const cachedUser = userCache.getByUsername(normalizedUsername)
     if (cachedUser) return cachedUser
 
     const user = await this.findOne({
-      where: sequelize.where(sequelize.fn('lower', sequelize.col('username')), username.toLowerCase()),
+      where: sequelize.where(sequelize.fn('LOWER', sequelize.col('username')), normalizedUsername),
       include: this.sequelize.models.mediaProgress
     })
 
@@ -369,11 +371,13 @@ class User extends Model {
   static async getUserByEmail(email) {
     if (!email) return null
 
-    const cachedUser = userCache.getByEmail(email)
+    const normalizedEmail = email.toLowerCase()
+
+    const cachedUser = userCache.getByEmail(normalizedEmail)
     if (cachedUser) return cachedUser
 
     const user = await this.findOne({
-      where: sequelize.where(sequelize.fn('lower', sequelize.col('email')), email.toLowerCase()),
+      where: sequelize.where(sequelize.fn('LOWER', sequelize.col('email')), normalizedEmail),
       include: this.sequelize.models.mediaProgress
     })
 

test/server/models/User.test.js

@@ -3,6 +3,48 @@ const sinon = require('sinon')
 const User = require('../../../server/models/User')
 
 describe('User model', () => {
+  describe('case-insensitive lookup helpers', () => {
+    afterEach(() => {
+      sinon.restore()
+    })
+
+    it('should query usernames case-insensitively', async () => {
+      User.sequelize = {
+        models: {
+          mediaProgress: {}
+        }
+      }
+
+      const findOneStub = sinon.stub(User, 'findOne').resolves(null)
+
+      await User.getUserByUsername('Madison')
+
+      expect(findOneStub.calledOnce).to.equal(true)
+      const options = findOneStub.firstCall.args[0]
+      expect(options.where.attribute.fn).to.equal('LOWER')
+      expect(options.where.attribute.args[0].col).to.equal('username')
+      expect(options.where.logic).to.equal('madison')
+    })
+
+    it('should query emails case-insensitively', async () => {
+      User.sequelize = {
+        models: {
+          mediaProgress: {}
+        }
+      }
+
+      const findOneStub = sinon.stub(User, 'findOne').resolves(null)
+
+      await User.getUserByEmail('Example.User@Example.com')
+
+      expect(findOneStub.calledOnce).to.equal(true)
+      const options = findOneStub.firstCall.args[0]
+      expect(options.where.attribute.fn).to.equal('LOWER')
+      expect(options.where.attribute.args[0].col).to.equal('email')
+      expect(options.where.logic).to.equal('example.user@example.com')
+    })
+  })
+
   describe('getUserByIdOrOldId', () => {
     let originalSequelize