fallbackEmail is now independent from email

src/routes/test/users-test.js

@@ -76,6 +76,15 @@ describe('Users API', function () {
             expect(response.statusCode).to.equal(400);
         });
 
+        it('cannot create user with non email fallbackEmail', async function () {
+            const response = await superagent.post(`${serverUrl}/api/v1/users`)
+                .query({ access_token: owner.token })
+                .send({ username: user2.username, email: user2.email, fallbackEmail: 'notanemail' })
+                .ok(() => true);
+
+            expect(response.statusCode).to.equal(400);
+        });
+
         it('create second user succeeds', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/users`)
                 .query({ access_token: owner.token })
@@ -299,6 +308,15 @@ describe('Users API', function () {
             expect(response.statusCode).to.equal(400);
         });
 
+        it('change fallbackEmail fails due to invalid email', async function () {
+            const response = await superagent.post(`${serverUrl}/api/v1/users/${user2.id}`)
+                .query({ access_token: owner.token })
+                .send({ fallbackEmail: 'newemail@cloudron' })
+                .ok(() => true);
+
+            expect(response.statusCode).to.equal(400);
+        });
+
         it('change user succeeds without email nor displayName', async function () {
             const response = await superagent.post(`${serverUrl}/api/v1/users/${user2.id}`)
                 .query({ access_token: owner.token })

src/routes/users.js

@@ -43,6 +43,7 @@ async function add(req, res, next) {
 
     if (typeof req.body.email !== 'string') return next(new HttpError(400, 'email must be string'));
     if ('username' in req.body && typeof req.body.username !== 'string') return next(new HttpError(400, 'username must be string'));
+    if ('fallbackEmail' in req.body && typeof req.body.fallbackEmail !== 'string') return next(new HttpError(400, 'fallbackEmail must be string'));
     if ('displayName' in req.body && typeof req.body.displayName !== 'string') return next(new HttpError(400, 'displayName must be string'));
     if ('password' in req.body && typeof req.body.password !== 'string') return next(new HttpError(400, 'password must be string'));
     if ('role' in req.body) {
@@ -54,8 +55,9 @@ async function add(req, res, next) {
     const email = req.body.email;
     const username = 'username' in req.body ? req.body.username : null;
     const displayName = req.body.displayName || '';
+    const fallbackEmail = req.body.fallbackEmail || '';
 
-    const [error, id] = await safe(users.add(email, { username, password, displayName, invitor: req.user, role: req.body.role || users.ROLE_USER }, AuditSource.fromRequest(req)));
+    const [error, id] = await safe(users.add(email, { username, password, displayName, fallbackEmail, invitor: req.user, role: req.body.role || users.ROLE_USER }, AuditSource.fromRequest(req)));
     if (error) return next(BoxError.toHttpError(error));
 
     next(new HttpSuccess(201, { id }));