From c17dd1f1419ba731de930b4607e467b66f840a49 Mon Sep 17 00:00:00 2001
From: Ong Chung Yau <33013947+chungyau97@users.noreply.github.com>
Date: Fri, 5 Sep 2025 21:04:12 +0800
Subject: [PATCH] Fix use case-insensitive email lookup and comparison during
 login (#5145)

fix: use case-insensitive email lookup and comparison
---
 packages/server/src/enterprise/services/account.service.ts | 2 +-
 packages/server/src/enterprise/services/user.service.ts    | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/packages/server/src/enterprise/services/account.service.ts b/packages/server/src/enterprise/services/account.service.ts
index e9ab3f57d..a4cb46ad9 100644
--- a/packages/server/src/enterprise/services/account.service.ts
+++ b/packages/server/src/enterprise/services/account.service.ts
@@ -176,7 +176,7 @@ export class AccountService {
                 if (data.user.tempToken) {
                     const user = await this.userService.readUserByToken(data.user.tempToken, queryRunner)
                     if (!user) throw new InternalFlowiseError(StatusCodes.NOT_FOUND, UserErrorMessage.USER_NOT_FOUND)
-                    if (user.email !== data.user.email)
+                    if (user.email.toLowerCase() !== data.user.email?.toLowerCase())
                         throw new InternalFlowiseError(StatusCodes.BAD_REQUEST, UserErrorMessage.INVALID_USER_EMAIL)
                     const name = data.user.name
                     if (data.user.credential) user.credential = this.userService.encryptUserCredential(data.user.credential)
diff --git a/packages/server/src/enterprise/services/user.service.ts b/packages/server/src/enterprise/services/user.service.ts
index 4492b6beb..9ea457838 100644
--- a/packages/server/src/enterprise/services/user.service.ts
+++ b/packages/server/src/enterprise/services/user.service.ts
@@ -5,7 +5,7 @@ import { getRunningExpressApp } from '../../utils/getRunningExpressApp'
 import { Telemetry, TelemetryEventType } from '../../utils/telemetry'
 import { User, UserStatus } from '../database/entities/user.entity'
 import { isInvalidEmail, isInvalidName, isInvalidPassword, isInvalidUUID } from '../utils/validation.util'
-import { DataSource, QueryRunner } from 'typeorm'
+import { DataSource, ILike, QueryRunner } from 'typeorm'
 import { generateId } from '../../utils'
 import { GeneralErrorMessage } from '../../utils/constants'
 import { getHash } from '../utils/encryption.util'
@@ -54,8 +54,9 @@ export class UserService {
     }
 
     public async readUserByEmail(email: string | undefined, queryRunner: QueryRunner) {
+        if (!email) throw new InternalFlowiseError(StatusCodes.BAD_REQUEST, UserErrorMessage.INVALID_USER_EMAIL)
         this.validateUserEmail(email)
-        return await queryRunner.manager.findOneBy(User, { email })
+        return await queryRunner.manager.findOneBy(User, { email: ILike(email) })
     }
 
     public async readUserByToken(token: string | undefined, queryRunner: QueryRunner) {