screenshots for admin MFA PR (#738)

backend/__tests__/utils/emailNormalization.test.js

@@ -0,0 +1,57 @@
+/**
+ * Regression coverage for the identity-preserving email normalization
+ * options (#574).
+ *
+ * express-validator's `.normalizeEmail()` applies provider-specific
+ * canonicalization by default — Gmail dot-stripping, +tag stripping,
+ * googlemail → gmail folding, etc. That breaks identity because login
+ * lookups expect the address as the user was invited with, not the
+ * canonicalized form.
+ *
+ * The tests below run validator.js's `normalizeEmail` (the same
+ * implementation express-validator delegates to) through the
+ * `IDENTITY_PRESERVING_NORMALIZE_EMAIL` options object and pin the
+ * behaviour we depend on:
+ *   - dots preserved on Gmail
+ *   - +tags preserved on Gmail / Outlook / Yahoo / iCloud
+ *   - googlemail.com domain preserved (not folded to gmail.com)
+ *   - local-part lowercased (still the default — safe and consistent)
+ */
+const validator = require('validator');
+const { IDENTITY_PRESERVING_NORMALIZE_EMAIL } = require('../../src/utils/emailNormalization');
+
+const norm = (email) => validator.normalizeEmail(email, IDENTITY_PRESERVING_NORMALIZE_EMAIL);
+
+describe('IDENTITY_PRESERVING_NORMALIZE_EMAIL', () => {
+  it('preserves dots in the Gmail local-part (the #574 root cause)', () => {
+    expect(norm('[email protected]')).toBe('[email protected]');
+    expect(norm('[email protected]')).toBe('[email protected]');
+  });
+
+  it('preserves Gmail +tags (subaddresses)', () => {
+    expect(norm('[email protected]')).toBe('[email protected]');
+  });
+
+  it('does not fold googlemail.com to gmail.com', () => {
+    expect(norm('[email protected]')).toBe('[email protected]');
+  });
+
+  it('preserves Outlook +tags', () => {
+    expect(norm('[email protected]')).toBe('[email protected]');
+  });
+
+  it('preserves Yahoo -tags', () => {
+    expect(norm('[email protected]')).toBe('[email protected]');
+  });
+
+  it('preserves iCloud +tags', () => {
+    expect(norm('[email protected]')).toBe('[email protected]');
+  });
+
+  it('lowercases the local-part (default behaviour we keep)', () => {
+    // all_lowercase defaults true in validator.js. Local-parts are
+    // case-insensitive in practice on every major provider, and
+    // lowercasing keeps login lookup consistent.
+    expect(norm('[email protected]')).toBe('[email protected]');
+  });
+});