fallbackEmail is now independent from email

src/users.js

@@ -180,8 +180,9 @@ async function add(email, data, auditSource) {
     assert(data.username === null || typeof data.username === 'string');
     assert(data.password === null || typeof data.password === 'string');
     assert.strictEqual(typeof data.displayName, 'string');
+    assert.strictEqual(typeof data.fallbackEmail, 'string');
 
-    let { username, password, displayName } = data;
+    let { username, password, displayName, fallbackEmail } = data;
     const source = data.source || '';        // empty is local user
     const role = data.role || exports.ROLE_USER;
 
@@ -204,6 +205,12 @@ async function add(email, data, auditSource) {
     error = validateEmail(email);
     if (error) throw error;
 
+    fallbackEmail = fallbackEmail.toLowerCase();
+    if (fallbackEmail) {
+        let error = validateEmail(fallbackEmail);
+        if (error) throw error;
+    }
+
     error = validateDisplayName(displayName);
     if (error) throw error;
 
@@ -222,7 +229,7 @@ async function add(email, data, auditSource) {
         id: 'uid-' + uuid.v4(),
         username: username,
         email: email,
-        fallbackEmail: email,
+        fallbackEmail: fallbackEmail,
         password: Buffer.from(derivedKey, 'binary').toString('hex'),
         salt: salt.toString('hex'),
         resetToken: '',
@@ -701,7 +708,7 @@ async function createOwner(email, username, password, displayName, auditSource)
     const activated = await isActivated();
     if (activated) throw new BoxError(BoxError.ALREADY_EXISTS, 'Cloudron already activated');
 
-    return await add(email, { username, password, displayName, role: exports.ROLE_OWNER }, auditSource);
+    return await add(email, { username, password, fallbackEmail: '', displayName, role: exports.ROLE_OWNER }, auditSource);
 }
 
 async function sendInvite(user, options, auditSource) {