Store emails in lowercase

[ignatiusm]

Resolves #825 and resolves #542

Context

This PR has a bit of a strange origin story:

Last year, I was doing some testing and was able to create separate accounts for: joe@test.com; Joe@test.com; and joe@Test.com: #542 At some part of the app there was a search for duplicate emails, and given I was was able to create separate accounts I figured the duplicate email search should be case sensitive (backed up by some stackoverflow answers on a related question - it turns out the spec for emails is not very specific).

However, when we were getting CTRL Pen tested I encountered an issue of incompatibility with Auth0's behaviour of saving emails as lowercase: #825

On the basis of this we decided to also store emails as lowercase in CTRL. Emails are encypted at rest (using the prisma-field-encryption library. There is also an emailHash field to stores a hash of the email to allow for index creation and unique checks: e.g. CREATE UNIQUE INDEX "User_emailHash_key" ON "User"("emailHash");

Tests and code fixes

AuthController

• application/backend/src/controllers/AuthController.test.ts to check that registering an admin fails with emailHash already in use when an existing admin exists with an uppercase version of the email. Evidence of failing Auth test:

• Key code fix is in application/backend/prisma/schema.prisma to normalise the User emailHash, but an explanatory note is also included in application/backend/src/controllers/AuthController.ts

ParticipantsController

• application/backend/src/controllers/ParticipantsController.test.ts to check that when creating a batch of invites, emails with different cases do not result in two separate invites.

• Key fixes are in:

  • application/backend/src/controllers/ParticipantsController.ts to normalise email to lowercase when creating Invites for participants
  • application/backend/prisma/schema.prisma to normalise the Invites emailHash

Admin-portal invite Modal

• application/admin-client/cypress/e2e/invites.cy.js test to ensure that only lowercase emails are added to recipients list by typing and pasting.

• application/admin-client/src/components/InviteModal.tsx I did a bit of a refactor to simplify and clarify the logic for adding by typing vs adding by pasting and carve out some helper functions.

Note: if you do not make clean then yarn dev and make seed then you may encounter errors due to prisma schema changes. You might need to run yarn prisma:generate to recreate the prisma client.

I also created another issue (#890) to add invites for dev and test users. Without invites there is a chance for weird states to exist (e.g. a users should have an 'Accepted' invite) and we probably need tests for them!

[plouka13]

Hey Iggy! This is great!

There is one path that I believe is still missing and it's the CSV Import page.

See images where I was able to add an uppercase and lowercase version of the same email without it flagging them as not unique.

and here where the emails are in the invite modal without being forced to lowercase.

However! When continuing through the invite flow, the emails are normalised as expected and the actual invites that get sent out are correctly filtered on unique emails.

See email sending logs (although it failed all emails because I didn't have smtp setup).

[backend]: {
[backend]:   message: {
[backend]:     resendEmailRequestCount: 6,
[backend]:     newInvitesCount: 6,
[backend]:     emailsResentCount: 0,
[backend]:     alreadyAcceptedCount: 0,
[backend]:     failedEmailsCount: 6,
[backend]:     failedEmails: [
[backend]:       'example@fuuhyuhfjenc.com',
[backend]:       'example@qwdsa.com',
[backend]:       'example2@example.com',
[backend]:       'feujjisf@example.com',
[backend]:       'uppercase@email.com',
[backend]:       'example@exewample.com'
[backend]:     ]
[backend]:   },
[backend]:   level: 'info',
[backend]:   timestamp: '2026-08-04T00:03:25.083Z'
[backend]: }

[iamtanuj18]

@ignatiusm Quick note on issue #915. I haven't touched these three files since your #888 PR covers them:

ParticipantsController.createInvites
InviteModal.tsx
emailHash normalisation in schema.prisma

The .trim().toLowerCase() in #888 handles whitespace on the invite path. My work on issue #915 handles the same trim everywhere else. Auth handlers, admin panel edits (user and participant), CSV and RedCap imports, seed script env vars, createAdmin.ts, and next of kin email across register and edit flows.