fix(registration and update): Ensure UID is updated alongside Email, and case-sensitivity is honored

app/controllers/devise_token_auth/registrations_controller.rb

@@ -7,9 +7,15 @@ class RegistrationsController < DeviseTokenAuth::ApplicationController
 
     def create
       @resource            = resource_class.new(sign_up_params)
-      @resource.uid        = sign_up_params[:email]
       @resource.provider   = "email"
 
+      # honor devise configuration for case_insensitive_keys
+      if resource_class.case_insensitive_keys.include?(:email)
+        @resource.email = sign_up_params[:email].downcase
+      else
+        @resource.email = sign_up_params[:email]
+      end
+
       # success redirect url is required
       unless params[:confirm_success_url]
         return render json: {
@@ -70,6 +76,7 @@ def create
 
     def update
       if @resource
+
         if @resource.update_attributes(account_update_params)
           render json: {
             status: 'success',

app/models/devise_token_auth/concerns/user.rb

@@ -19,6 +19,9 @@ module DeviseTokenAuth::Concerns::User
     after_save :set_empty_token_hash
     after_initialize :set_empty_token_hash
 
+    # keep uid in sync with email
+    before_save :sync_uid
+
     # get rid of dead tokens
     before_save :destroy_expired_tokens
 
@@ -212,10 +215,15 @@ def set_empty_token_hash
     self.tokens ||= {} if has_attribute?(:tokens)
   end
 
+  def sync_uid
+    self.uid = email if provider == 'email'
+  end
+
   def destroy_expired_tokens
     self.tokens.delete_if{|cid,v|
       expiry = v[:expiry] || v["expiry"]
       DateTime.strptime(expiry.to_s, '%s') < Time.now
     }
   end
+
 end

test/controllers/devise_token_auth/registrations_controller_test.rb

@@ -55,6 +55,36 @@ class DeviseTokenAuth::RegistrationsControllerTest < ActionDispatch::Integration
       end
     end
 
+    describe "case-insensitive email" do
+
+      before do
+        @resource_class = User
+        @request_params = {
+          email: "AlternatingCase@example.com",
+          password: "secret123",
+          password_confirmation: "secret123",
+          confirm_success_url: Faker::Internet.url
+        }
+      end
+
+      test "success should downcase uid if configured" do
+        @resource_class.case_insensitive_keys = [:email]
+        post '/auth', @request_params
+        assert_equal 200, response.status
+        @data = JSON.parse(response.body)
+        assert_equal "alternatingcase@example.com", @data['data']['uid']
+      end
+
+      test "request should not downcase uid if not configured" do
+        @resource_class.case_insensitive_keys = []
+        post '/auth', @request_params
+        assert_equal 200, response.status
+        @data = JSON.parse(response.body)
+        assert_equal "AlternatingCase@example.com", @data['data']['uid']
+      end
+
+    end
+
     describe "Adding extra params" do
       before do
         @redirect_url     = Faker::Internet.url
@@ -205,22 +235,38 @@ class DeviseTokenAuth::RegistrationsControllerTest < ActionDispatch::Integration
         describe "success" do
           before do
             # test valid update param
+            @resource_class = User
             @new_operating_thetan = 1000000
-
-            put "/auth", {
-              operating_thetan: @new_operating_thetan
-            }, @auth_headers
-
-            @data = JSON.parse(response.body)
-            @existing_user.reload
+            @email = "AlternatingCase2@example.com"
+            @request_params = {
+              operating_thetan: @new_operating_thetan,
+              email: @email
+            }
           end
 
           test "Request was successful" do
+            put "/auth", @request_params, @auth_headers
             assert_equal 200, response.status
           end
 
-          test "User attribute was updated" do
+          test "Case sensitive attributes update" do
+            @resource_class.case_insensitive_keys = []
+            put "/auth", @request_params, @auth_headers
+            @data = JSON.parse(response.body)
+            @existing_user.reload
+            assert_equal @new_operating_thetan, @existing_user.operating_thetan
+            assert_equal @email, @existing_user.email
+            assert_equal @email, @existing_user.uid
+          end
+
+          test "Case insensitive attributes update" do
+            @resource_class.case_insensitive_keys = [:email]
+            put "/auth", @request_params, @auth_headers
+            @data = JSON.parse(response.body)
+            @existing_user.reload
             assert_equal @new_operating_thetan, @existing_user.operating_thetan
+            assert_equal @email.downcase, @existing_user.email
+            assert_equal @email.downcase, @existing_user.uid
           end
         end