ldap: avoid clashes on emails

When creating users on LDAP, make sure that the email won't clash. If
that was to happen, then set the email to nil so the user has to enter
the email manually.

Fixes SUSE#1302

Signed-off-by: Miquel Sabaté Solà <[email protected]>

lib/portus/ldap.rb

@@ -168,9 +168,12 @@ def find_or_create_user!
 
       # The user does not exist in Portus yet, let's create it.
       unless user
+        em = guess_email
+        em = nil if User.exists?(email: em)
+
         user = User.create(
           username: username,
-          email:    guess_email,
+          email:    em,
           password: password,
           admin:    !User.not_portus.any?
         )

spec/lib/portus/ldap_spec.rb

@@ -65,6 +65,10 @@ def fail!(symbol)
     @last_symbol = symbol
   end
 
+  def setup_search_mock!(response)
+    @ldap = LdapSearchAdapter.new(response)
+  end
+
   def guess_email_test(response)
     @ldap = LdapSearchAdapter.new(response)
     guess_email
@@ -213,6 +217,15 @@ def load_configuration_test
   end
 
   describe "#find_or_create_user!" do
+    let(:valid_response) do
+      [
+        {
+          "dn"    => ["ou=users,dc=example,dc=com"],
+          "email" => "[email protected]"
+        }
+      ]
+    end
+
     before :each do
       APP_CONFIG["ldap"] = { "enabled" => true }
     end
@@ -260,6 +273,24 @@ def load_configuration_test
 
       expect(User.count).to eq 2
     end
+
+    it "raises the proper error on email duplication" do
+      ge = { "enabled" => true, "attr" => "email" }
+      APP_CONFIG["ldap"] = { "enabled" => true, "base" => "", "guess_email" => ge }
+
+      lm = LdapMock.new(username: "name", password: "12341234")
+      lm.setup_search_mock!(valid_response)
+      lm.find_or_create_user_test!
+
+      lm = LdapMock.new(username: "another", password: "12341234")
+      lm.setup_search_mock!(valid_response)
+      lm.find_or_create_user_test!
+
+      [["name", "[email protected]"], ["another", nil]].each do |u|
+        user = User.find_by(username: u.first)
+        expect(user.email).to eq u.last
+      end
+    end
   end
 
   describe "#authenticate!" do