From cf5e4af2cb2abe0cc5fc0da7eb8077e046f9353d Mon Sep 17 00:00:00 2001
From: Prassanth <80441547+PrassanthVG@users.noreply.github.com>
Date: Fri, 2 Oct 2026 02:08:29 +0530
Subject: [PATCH] Normalize email case on user creation and login

Users created with uppercase letters in their email were stored as-is,
while login lowercased the input, locking them out. Store emails in
lowercase and match case-insensitively so existing users can log in.

Fixes #4983
---
 backend/internal/token.js | 2 +-
 backend/internal/user.js  | 4 ++++
 backend/setup.js          | 2 +-
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/backend/internal/token.js b/backend/internal/token.js
index 67255b21..7ed689b2 100644
--- a/backend/internal/token.js
+++ b/backend/internal/token.js
@@ -29,7 +29,7 @@ export default {
 
 		const user = await userModel
 			.query()
-			.where("email", data.identity.toLowerCase().trim())
+			.whereRaw("LOWER(email) = ?", [data.identity.toLowerCase().trim()])
 			.andWhere("is_deleted", 0)
 			.andWhere("is_disabled", 0)
 			.first();
diff --git a/backend/internal/user.js b/backend/internal/user.js
index 8dd86f46..08aaf1dc 100644
--- a/backend/internal/user.js
+++ b/backend/internal/user.js
@@ -34,6 +34,10 @@ const internalUser = {
 			data.is_disabled = data.is_disabled ? 1 : 0;
 		}
 
+		if (typeof data.email === "string") {
+			data.email = data.email.toLowerCase().trim();
+		}
+
 		await access.can("users:create", data);
 		data.avatar = gravatar.url(data.email, { default: "mm" });
 
diff --git a/backend/setup.js b/backend/setup.js
index 9e8841e1..1750ab34 100644
--- a/backend/setup.js
+++ b/backend/setup.js
@@ -38,7 +38,7 @@ const setupDefaultUser = async () => {
 
 		const data = {
 			is_deleted: 0,
-			email: initialAdminEmail,
+			email: initialAdminEmail.toLowerCase().trim(),
 			name: "Administrator",
 			nickname: "Admin",
 			avatar: "",