From b63060abebc1ad82905fdcddc3370629df68cb6d Mon Sep 17 00:00:00 2001
From: ChinoKou <ChinoKou@outlook.com>
Date: Thu, 14 May 2026 09:56:53 +0800
Subject: [PATCH] fix(user): validate and normalize email during user creation

---
 backend/internal/user.js | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/backend/internal/user.js b/backend/internal/user.js
index 37cd8043..0f0130bd 100644
--- a/backend/internal/user.js
+++ b/backend/internal/user.js
@@ -27,14 +27,6 @@ const internalUser = {
 		const auth = data.auth || null;
 		delete data.auth;
 
-		data.email = data.email.toLowerCase().trim();
-		const emailAvailable = await internalUser.isEmailAvailable(data.email, undefined);
-		if (!emailAvailable) {
-			throw new errs.ValidationError(
-				`Email address already in use - ${data.email}`,
-			);
-		}
-
 		data.avatar = data.avatar || "";
 		data.roles = data.roles || [];
 
@@ -43,6 +35,15 @@ const internalUser = {
 		}
 
 		await access.can("users:create", data);
+
+		if (typeof data.email !== "undefined" && data.email !== null) {
+			data.email = data.email.toLowerCase().trim();
+			const emailAvailable = await internalUser.isEmailAvailable(data.email);
+			if (!emailAvailable) {
+				throw new errs.ValidationError(`Email address already in use - ${data.email}`);
+			}
+		}
+
 		data.avatar = gravatar.url(data.email, { default: "mm" });
 
 		let user = await userModel.query().insertAndFetch(data).then(utils.omitRow(omissions()));