From 93eaae7454c03ab2d1abddecf32ffde1e3939bf7 Mon Sep 17 00:00:00 2001
From: Victor Vrantchan <vrancean+github@gmail.com>
Date: Wed, 12 Oct 2016 12:35:34 -0400
Subject: [PATCH] Lowercase strings which should be case insensitive, like
 email and username. (#302)

Fixes #299
Closes #300
---
 server/service/transport_invites.go       |  4 +++
 server/service/transport_invites_test.go  | 30 ++++++++++++++++++-----
 server/service/transport_sessions.go      |  2 ++
 server/service/transport_sessions_test.go | 28 +++++++++++++++------
 4 files changed, 51 insertions(+), 13 deletions(-)

diff --git a/server/service/transport_invites.go b/server/service/transport_invites.go
index f776ed7b30..4f0478f627 100644
--- a/server/service/transport_invites.go
+++ b/server/service/transport_invites.go
@@ -3,6 +3,7 @@ package service
 import (
 	"encoding/json"
 	"net/http"
+	"strings"
 
 	"golang.org/x/net/context"
 )
@@ -12,6 +13,9 @@ func decodeCreateInviteRequest(ctx context.Context, r *http.Request) (interface{
 	if err := json.NewDecoder(r.Body).Decode(&req.payload); err != nil {
 		return nil, err
 	}
+	if req.payload.Email != nil {
+		*req.payload.Email = strings.ToLower(*req.payload.Email)
+	}
 
 	return req, nil
 }
diff --git a/server/service/transport_invites_test.go b/server/service/transport_invites_test.go
index 5b291c90c1..bc299ce885 100644
--- a/server/service/transport_invites_test.go
+++ b/server/service/transport_invites_test.go
@@ -23,15 +23,33 @@ func TestDecodeCreateInviteRequest(t *testing.T) {
 		assert.Equal(t, uint(1), *params.payload.InvitedBy)
 	}).Methods("POST")
 
-	var body bytes.Buffer
-	body.Write([]byte(`{
+	t.Run("lowercase email", func(t *testing.T) {
+		var body bytes.Buffer
+		body.Write([]byte(`{
         "name": "foo",
         "email": "foo@kolide.co",
         "invited_by": 1
     }`))
 
-	router.ServeHTTP(
-		httptest.NewRecorder(),
-		httptest.NewRequest("POST", "/api/v1/kolide/invites", &body),
-	)
+		router.ServeHTTP(
+			httptest.NewRecorder(),
+			httptest.NewRequest("POST", "/api/v1/kolide/invites", &body),
+		)
+	})
+
+	t.Run("uppercase email", func(t *testing.T) {
+		// email string should be lowerased after decode.
+		var body bytes.Buffer
+		body.Write([]byte(`{
+        "name": "foo",
+        "email": "Foo@Kolide.co",
+        "invited_by": 1
+    }`))
+
+		router.ServeHTTP(
+			httptest.NewRecorder(),
+			httptest.NewRequest("POST", "/api/v1/kolide/invites", &body),
+		)
+	})
+
 }
diff --git a/server/service/transport_sessions.go b/server/service/transport_sessions.go
index f6123fcda2..8875de781f 100644
--- a/server/service/transport_sessions.go
+++ b/server/service/transport_sessions.go
@@ -3,6 +3,7 @@ package service
 import (
 	"encoding/json"
 	"net/http"
+	"strings"
 
 	"golang.org/x/net/context"
 )
@@ -44,5 +45,6 @@ func decodeLoginRequest(ctx context.Context, r *http.Request) (interface{}, erro
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		return nil, err
 	}
+	req.Username = strings.ToLower(req.Username)
 	return req, nil
 }
diff --git a/server/service/transport_sessions_test.go b/server/service/transport_sessions_test.go
index f2c43ece56..5388fb2b91 100644
--- a/server/service/transport_sessions_test.go
+++ b/server/service/transport_sessions_test.go
@@ -85,15 +85,29 @@ func TestDecodeLoginRequest(t *testing.T) {
 		assert.Equal(t, "foo", params.Username)
 		assert.Equal(t, "bar", params.Password)
 	}).Methods("POST")
-
-	var body bytes.Buffer
-	body.Write([]byte(`{
+	t.Run("lowercase username", func(t *testing.T) {
+		var body bytes.Buffer
+		body.Write([]byte(`{
         "username": "foo",
         "password": "bar"
     }`))
 
-	router.ServeHTTP(
-		httptest.NewRecorder(),
-		httptest.NewRequest("POST", "/api/v1/kolide/login", &body),
-	)
+		router.ServeHTTP(
+			httptest.NewRecorder(),
+			httptest.NewRequest("POST", "/api/v1/kolide/login", &body),
+		)
+	})
+	t.Run("uppercase username", func(t *testing.T) {
+		var body bytes.Buffer
+		body.Write([]byte(`{
+        "username": "Foo",
+        "password": "bar"
+    }`))
+
+		router.ServeHTTP(
+			httptest.NewRecorder(),
+			httptest.NewRequest("POST", "/api/v1/kolide/login", &body),
+		)
+	})
+
 }