normalize all emails

Author: pierre-b

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 All notable changes to this project will be documented in this file.
 
+## [26.15] - 2026-01-31
+
+- **Contacts**: Emails are now normalized to lowercase on import to prevent case-sensitivity issues (#231)
+- **Security**: Upgraded fast-xml-parser to 5.3.4
+
 ## [26.14] - 2026-01-30
 
 - **Email Builder**: Fixed buttons with HTML content like `<strong>` rendering as default "Button" text instead of custom content (#242, [gomjml PR#33](https://github.com/preslavrachev/gomjml/pull/33))

config/config.go

@@ -14,7 +14,7 @@ import (
 	"github.com/spf13/viper"
 )
 
-const VERSION = "26.14"
+const VERSION = "26.15"
 
 type Config struct {
 	Server              ServerConfig

console/package-lock.json

@@ -106,7 +106,8 @@
   },
   "overrides": {
     "seroval": "^1.4.1",
-    "seroval-plugins": "^1.4.1"
+    "seroval-plugins": "^1.4.1",
+    "fast-xml-parser": "5.3.4"
   },
   "devDependencies": {
     "@eslint/js": "^9.19.0",

console/package.json

@@ -91,6 +91,8 @@ func (c *Contact) Validate() error {
 	if c.Email == "" {
 		return fmt.Errorf("email is required")
 	}
+	// Normalize email to lowercase
+	c.Email = NormalizeEmail(c.Email)
 	// Email must be valid
 	if !govalidator.IsEmail(c.Email) {
 		return fmt.Errorf("invalid email format")
@@ -656,8 +658,8 @@ func FromJSON(data interface{}) (*Contact, error) {
 		return nil, fmt.Errorf("unsupported data type: %T", data)
 	}
 
-	// Extract required fields and trim all Unicode whitespace (including NBSP)
-	email := trimUnicodeSpace(jsonResult.Get("email").String())
+	// Extract required fields and normalize email for consistent storage and lookups
+	email := NormalizeEmail(jsonResult.Get("email").String())
 	if email == "" {
 		return nil, fmt.Errorf("email is required")
 	}
@@ -817,6 +819,12 @@ func trimUnicodeSpace(s string) string {
 	return strings.TrimFunc(s, unicode.IsSpace)
 }
 
+// NormalizeEmail normalizes an email address by trimming whitespace and converting to lowercase.
+// This ensures consistent storage and lookups regardless of input case.
+func NormalizeEmail(email string) string {
+	return strings.ToLower(trimUnicodeSpace(email))
+}
+
 // Helper functions for parsing nullable fields from JSON
 func parseNullableString(result gjson.Result, field string, target **NullableString) error {
 	if value := result.Get(field); value.Exists() {

internal/domain/contact.go

@@ -143,6 +143,105 @@ func TestContact_Validate(t *testing.T) {
 	}
 }
 
+func TestContact_Validate_NormalizesEmail(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "lowercase email unchanged",
+			input:    "[email protected]",
+			expected: "[email protected]",
+		},
+		{
+			name:     "uppercase email normalized",
+			input:    "[email protected]",
+			expected: "[email protected]",
+		},
+		{
+			name:     "mixed case email normalized",
+			input:    "[email protected]",
+			expected: "[email protected]",
+		},
+		{
+			name:     "email with leading/trailing spaces normalized",
+			input:    "  [email protected]  ",
+			expected: "[email protected]",
+		},
+		{
+			name:     "mixed case with spaces normalized",
+			input:    "  [email protected]  ",
+			expected: "[email protected]",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := &Contact{Email: tt.input}
+			err := c.Validate()
+			assert.NoError(t, err)
+			assert.Equal(t, tt.expected, c.Email)
+		})
+	}
+}
+
+func TestNormalizeEmail(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "lowercase unchanged",
+			input:    "[email protected]",
+			expected: "[email protected]",
+		},
+		{
+			name:     "uppercase to lowercase",
+			input:    "[email protected]",
+			expected: "[email protected]",
+		},
+		{
+			name:     "mixed case to lowercase",
+			input:    "[email protected]",
+			expected: "[email protected]",
+		},
+		{
+			name:     "trim leading spaces",
+			input:    "  [email protected]",
+			expected: "[email protected]",
+		},
+		{
+			name:     "trim trailing spaces",
+			input:    "[email protected]  ",
+			expected: "[email protected]",
+		},
+		{
+			name:     "trim both and lowercase",
+			input:    "  [email protected]  ",
+			expected: "[email protected]",
+		},
+		{
+			name:     "empty string",
+			input:    "",
+			expected: "",
+		},
+		{
+			name:     "only spaces",
+			input:    "   ",
+			expected: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := NormalizeEmail(tt.input)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
 func TestScanContact(t *testing.T) {
 	now := time.Now()
 
@@ -998,6 +1097,22 @@ func TestFromJSON(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name:  "email is normalized to lowercase",
+			input: `{"email": "[email protected]"}`,
+			want: &Contact{
+				Email: "[email protected]",
+			},
+			wantErr: false,
+		},
+		{
+			name:  "email with mixed case and spaces is normalized",
+			input: `{"email": "  [email protected]  "}`,
+			want: &Contact{
+				Email: "[email protected]",
+			},
+			wantErr: false,
+		},
 	}
 
 	for _, tt := range tests {

internal/domain/contact_test.go

@@ -44,6 +44,9 @@ func NewContactService(
 }
 
 func (s *ContactService) GetContactByEmail(ctx context.Context, workspaceID string, email string) (*domain.Contact, error) {
+	// Normalize email for consistent lookups
+	email = domain.NormalizeEmail(email)
+
 	// Check if this is a system call (e.g., from Supabase webhook)
 	isSystemCall := ctx.Value(domain.SystemCallKey) != nil
 
@@ -132,6 +135,9 @@ func (s *ContactService) GetContacts(ctx context.Context, req *domain.GetContact
 }
 
 func (s *ContactService) DeleteContact(ctx context.Context, workspaceID string, email string) error {
+	// Normalize email for consistent lookups
+	email = domain.NormalizeEmail(email)
+
 	var err error
 	log.Println("DeleteContact", email, workspaceID)
 	ctx, _, userWorkspace, err := s.authService.AuthenticateUserForWorkspace(ctx, workspaceID)