Repository: freeCodeCamp/freeCodeCamp
File: api/src/routes/helpers/auth-helpers.test.ts (TypeScript)

Code before:

    const ids = [user1.id, user2.id];

    await findOrCreateUser(fastify, email);

    expect(captureException).toHaveBeenCalledTimes(1);
    expect(captureException).toHaveBeenCalledWith(
      new Error(`Multiple user records found for: ${ids.join(', ')}`)
    );
  });

  it('should NOT send a message if there is only one user with the email', async () => {
    await fastify.prisma.user.create({ data: createUserInput(email) });

    await findOrCreateUser(fastify, email);

    expect(captureException).not.toHaveBeenCalled();
  });

  it('should NOT send a message if there are no users with the email', async () => {
    await findOrCreateUser(fastify, email);

    expect(captureException).not.toHaveBeenCalled();
  });

  it('should NOT create a user if there is an account with case-insensitive email matches', async () => {
    const upperCaseEmail = email.toUpperCase();

    // Create a user with uppercase email
    const existingUser = await fastify.prisma.user.create({
      data: createUserInput(email)
    });

    // Try to find or create with lowercase email
    const result = await findOrCreateUser(fastify, upperCaseEmail);

    // Should return the existing user, not create a new one
    expect(result.id).toBe(existingUser.id);

    // Verify only one user exists in the database
    const allUsers = await fastify.prisma.user.findMany({
      where: {
        email: {
          in: [upperCaseEmail, email]
        }
      }
    });
    expect(allUsers).toHaveLength(1);
  });
});


Review comment (security):
```suggestion
  it("should NOT create a user if there is already an account with the lowercase version of the user's email", async () => {
```
It's a little wordy, but case-insensitive is misleading. It's just lowercase.

Code after:

    const ids = [user1.id, user2.id];

    await findOrCreateUser(fastify, email);

    expect(captureException).toHaveBeenCalledTimes(1);
    expect(captureException).toHaveBeenCalledWith(
      new Error(`Multiple user records found for: ${ids.join(', ')}`)
    );
  });

  it('should NOT send a message if there is only one user with the email', async () => {
    await fastify.prisma.user.create({ data: createUserInput(email) });

    await findOrCreateUser(fastify, email);

    expect(captureException).not.toHaveBeenCalled();
  });

  it('should NOT send a message if there are no users with the email', async () => {
    await findOrCreateUser(fastify, email);

    expect(captureException).not.toHaveBeenCalled();
  });

  it("should NOT create a user if there is already an account with the lowercase version of the user's email", async () => {
    const upperCaseEmail = email.toUpperCase();

    // Create a user with lowercase email
    const existingUser = await fastify.prisma.user.create({
      data: createUserInput(email)
    });

    // Try to find or create with uppercase email
    const result = await findOrCreateUser(fastify, upperCaseEmail);

    // Should return the existing user, not create a new one
    expect(result.id).toBe(existingUser.id);

    // Verify only one user exists in the database
    const allUsers = await fastify.prisma.user.findMany({
      where: {
        email: {
          in: [upperCaseEmail, email]
        }
      }
    });
    expect(allUsers).toHaveLength(1);
  });
});