refactor(auth): one email fold, in SQL and TypeScript, and no reads of the dead column

An address was folded five different ways across the codebase: three SQL
spellings — `lower(x)`, `lower(trim(x))`, `lower(btrim(x))` — plus reads of
`user.normalized_email`, plus inline `trim().toLowerCase()`. Only one of the
SQL forms matches the expression the new index is built on, so the others were
sequential scans of `user` wearing the costume of an indexed lookup.

`normalized_email` turned out to be populated after all — for a fifth of
accounts, by a signup plugin removed in June, using Gmail dot-and-tag stripping.
That is the right function for deduplicating signups and the wrong one for
identity: it merges addresses a mail provider may route to different people,
and it stops at the day the plugin left. Every read of the column is gone. The
column itself stays for one release, because Better Auth selects every schema
column and dropping it while the previous release still serves would break
sign-in; the drop is the follow-up, and the repo's drop audit will name the
argless reads that must be fixed first.

`foldedEmail` now lives in the schema beside the index that indexes it, so the
predicate and the index are one expression by construction. Its TypeScript
twin is `normalizeEmail` from `@sim/utils/string`, which the new access code
now uses instead of inlining the fold.

The index is no longer unique. Production holds thirteen addresses that
collide once folded — real, verified, active accounts — so a unique build would
fail the deploy by design. Access resolution refuses to bind an ambiguous
address, which keeps either account from reading the other's documents until
the pairs are merged and the index can be promoted.

The directory-sync cron joins docker/crontab; the parity audit caught that Helm
alone was not enough.

Author: waleedlatif1

apps/sim/app/api/v1/admin/dashboard/actor.ts

@@ -1,16 +1,18 @@
 import { db } from '@sim/db'
-import { user } from '@sim/db/schema'
-import { eq, or } from 'drizzle-orm'
+import { foldedEmail, user } from '@sim/db/schema'
+import { normalizeEmail } from '@sim/utils/string'
+import { eq } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
 import type { AdminMutationActor } from '@/lib/admin/dashboard'
 
 export async function getAdminAuditActor(request: NextRequest): Promise<AdminMutationActor> {
-  const email = request.headers.get('x-admin-email')?.trim().toLowerCase()
+  const rawEmail = request.headers.get('x-admin-email')
+  const email = rawEmail ? normalizeEmail(rawEmail) : ''
   if (!email) return { id: null, name: 'Admin API', email: null }
   const [admin] = await db
     .select({ id: user.id, name: user.name, email: user.email })
     .from(user)
-    .where(or(eq(user.email, email), eq(user.normalizedEmail, email)))
+    .where(eq(foldedEmail(user.email), email))
     .limit(1)
   return admin ?? { id: null, name: 'Admin Panel', email }
 }

apps/sim/connectors/confluence/permissions.ts

@@ -1,4 +1,5 @@
 import { createLogger } from '@sim/logger'
+import { normalizeEmail } from '@sim/utils/string'
 import type {
   ConfluencePrincipal,
   ConfluenceRestriction,
@@ -189,7 +190,7 @@ export async function resolveUserEmails(
         accessToken
       )
       for (const entry of body.results ?? []) {
-        const email = entry.email?.trim().toLowerCase()
+        const email = entry.email ? normalizeEmail(entry.email) : ''
         if (entry.accountId && email) emails.set(entry.accountId, email)
       }
     } catch (error) {

apps/sim/connectors/google-drive/directory.ts

@@ -1,4 +1,5 @@
 import { createLogger } from '@sim/logger'
+import { normalizeEmail } from '@sim/utils/string'
 import { canonicalGroupId } from '@/lib/knowledge/access/tokens'
 import type {
   ConnectorDirectory,
@@ -35,7 +36,7 @@ const MAX_GROUP_NESTING_DEPTH = 10
  */
 export function googleWorkspaceDomain(adminEmail: unknown): string | undefined {
   if (typeof adminEmail !== 'string') return undefined
-  const domain = adminEmail.trim().toLowerCase().split('@')[1]
+  const domain = normalizeEmail(adminEmail).split('@')[1]
   return domain || undefined
 }
 
@@ -143,7 +144,7 @@ export async function listGroupMembers(
     )
 
     for (const member of members) {
-      const email = member.email?.trim().toLowerCase()
+      const email = member.email ? normalizeEmail(member.email) : ''
       if (!email) continue
       if (member.status && member.status.toUpperCase() !== 'ACTIVE') continue
 

apps/sim/lib/auth/sso/application/admit-sso-user.ts

@@ -2,6 +2,7 @@ import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import {
   account,
+  foldedEmail,
   invitation,
   member,
   permissions,
@@ -13,7 +14,7 @@ import {
 import { createLogger } from '@sim/logger'
 import { normalizeSSODomain } from '@sim/utils/sso-domain'
 import { normalizeEmail } from '@sim/utils/string'
-import { and, desc, eq, gt, inArray, isNull, sql } from 'drizzle-orm'
+import { and, desc, eq, gt, inArray, isNull } from 'drizzle-orm'
 import { applySessionPolicyToNewMember } from '@/lib/auth/session-policy'
 import { ssoJitAdmissionOperation } from '@/lib/auth/sso/application/operations'
 import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
@@ -184,7 +185,7 @@ async function runAdmissionTransaction(
             eq(invitation.organizationId, provider.organizationId),
             eq(invitation.status, 'pending'),
             gt(invitation.expiresAt, new Date()),
-            sql`lower(trim(${invitation.email})) = ${normalizedEmail}`
+            eq(foldedEmail(invitation.email), normalizedEmail)
           )
         )
         .limit(1),

apps/sim/lib/billing/enterprise-owner-claim.test.ts

@@ -325,21 +325,11 @@ describe('Enterprise future-owner claims', () => {
           condition.type === 'eq' && condition.left === user.id && condition.right === 'owner-1'
       )
     ).toBe(true)
-    const emailScope = updateConditions.find((condition) => condition.type === 'or')
-    const emailConditions = Array.isArray(emailScope?.conditions) ? emailScope.conditions : []
-    expect(
-      emailConditions.some(
-        (condition) =>
-          condition?.type === 'eq' &&
-          condition.left === user.normalizedEmail &&
-          condition.right === request.ownerEmail
-      )
-    ).toBe(true)
-    expect(
-      emailConditions.filter(
-        (condition) => condition?.type === 'eq' && condition.right === request.ownerEmail
-      )
-    ).toHaveLength(2)
+    /** The folded address is one `eq`, not an OR over a dead column and an ad-hoc fold. */
+    const emailConditions = updateConditions.filter(
+      (condition) => condition?.type === 'eq' && condition.right === request.ownerEmail
+    )
+    expect(emailConditions).toHaveLength(1)
     expect(mocks.createOrganization).not.toHaveBeenCalled()
     expect(mocks.enqueue).not.toHaveBeenCalled()
   })

apps/sim/lib/billing/enterprise-owner-claim.ts

@@ -1,6 +1,6 @@
 import { AuditAction, AuditResourceType, recordAuditOnce } from '@sim/audit'
 import { db } from '@sim/db'
-import { member, outboxEvent, user, workspace } from '@sim/db/schema'
+import { foldedEmail, member, outboxEvent, user, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { safeCompare } from '@sim/security/compare'
 import { generateId } from '@sim/utils/id'
@@ -297,9 +297,7 @@ async function assertOwnerEmailHasNoAccount(ownerEmail: string): Promise<void> {
   const [existingUser] = await db
     .select({ id: user.id })
     .from(user)
-    .where(
-      or(eq(user.normalizedEmail, ownerEmail), eq(sql<string>`lower(${user.email})`, ownerEmail))
-    )
+    .where(eq(foldedEmail(user.email), ownerEmail))
     .limit(1)
   if (existingUser) {
     throw new EnterpriseProvisioningError(
@@ -499,12 +497,7 @@ export async function createEnterpriseOwnerClaim(
     const [accountCreatedDuringReview] = await tx
       .select({ id: user.id })
       .from(user)
-      .where(
-        or(
-          eq(user.normalizedEmail, normalized.ownerEmail),
-          eq(sql<string>`lower(${user.email})`, normalized.ownerEmail)
-        )
-      )
+      .where(eq(foldedEmail(user.email), normalized.ownerEmail))
       .limit(1)
     if (accountCreatedDuringReview) {
       throw new EnterpriseProvisioningError(
@@ -968,13 +961,7 @@ export async function acceptEnterpriseOwnerClaim(params: {
         .update(user)
         .set({ emailVerified: true, updatedAt: new Date() })
         .where(
-          and(
-            eq(user.id, params.userId),
-            or(
-              eq(user.normalizedEmail, payload.request.ownerEmail),
-              eq(sql<string>`lower(trim(${user.email}))`, payload.request.ownerEmail)
-            )
-          )
+          and(eq(user.id, params.userId), eq(foldedEmail(user.email), payload.request.ownerEmail))
         )
         .returning({ id: user.id })
       if (!verifiedOwner) {

apps/sim/lib/billing/webhooks/enterprise.ts

@@ -1,9 +1,10 @@
 import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
-import { organization, outboxEvent, session, subscription, user } from '@sim/db/schema'
+import { foldedEmail, organization, outboxEvent, session, subscription, user } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
 import { isRecordLike } from '@sim/utils/object'
+import { normalizeEmail } from '@sim/utils/string'
 import { and, eq, inArray, sql } from 'drizzle-orm'
 import type Stripe from 'stripe'
 import { getEmailSubject, renderEnterpriseSubscriptionEmail } from '@/components/emails'
@@ -532,7 +533,7 @@ async function reconcileManualEnterpriseSubscription(
         requestedByUserId
           ? eq(user.id, requestedByUserId)
           : requestedByEmail
-            ? eq(user.normalizedEmail, requestedByEmail.toLowerCase())
+            ? eq(foldedEmail(user.email), normalizeEmail(requestedByEmail))
             : eq(user.stripeCustomerId, stripeCustomerId)
       )
       .limit(1)

apps/sim/lib/invitations/direct-grant.ts

@@ -1,6 +1,7 @@
 import { AuditAction, AuditResourceType, recordAudit, recordAuditOnce } from '@sim/audit'
 import { db } from '@sim/db'
 import {
+  foldedEmail,
   invitation,
   invitationWorkspaceGrant,
   member,
@@ -12,7 +13,7 @@ import { permissionSatisfies } from '@sim/platform-authz/workspace'
 import { generateId } from '@sim/utils/id'
 import { isRecordLike } from '@sim/utils/object'
 import { normalizeEmail } from '@sim/utils/string'
-import { and, eq, sql } from 'drizzle-orm'
+import { and, eq } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
 import {
   acquireOrganizationUserMutationLocks,
@@ -94,7 +95,7 @@ async function getPendingWorkspaceInvitationIds(
     .innerJoin(invitationWorkspaceGrant, eq(invitationWorkspaceGrant.invitationId, invitation.id))
     .where(
       and(
-        sql`lower(${invitation.email}) = ${normalizedEmail}`,
+        eq(foldedEmail(invitation.email), normalizedEmail),
         eq(invitation.status, 'pending'),
         eq(invitationWorkspaceGrant.workspaceId, workspaceId)
       )

apps/sim/lib/invitations/workspace-invitations.ts

@@ -1,9 +1,15 @@
 import { AuditAction, AuditResourceType, recordAudit, recordAuditOnce } from '@sim/audit'
 import { db } from '@sim/db'
-import { type InvitationMembershipIntent, member, permissions, user } from '@sim/db/schema'
+import {
+  foldedEmail,
+  type InvitationMembershipIntent,
+  member,
+  permissions,
+  user,
+} from '@sim/db/schema'
 import { isOrgAdminRole, permissionSatisfies } from '@sim/platform-authz/workspace'
 import { normalizeEmail } from '@sim/utils/string'
-import { and, eq, inArray, sql } from 'drizzle-orm'
+import { and, eq, inArray } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
 import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
 import {
@@ -479,7 +485,7 @@ export async function createWorkspaceInvitation({
   const existingUser = await db
     .select({ id: user.id })
     .from(user)
-    .where(sql`lower(${user.email}) = ${normalizedEmail}`)
+    .where(eq(foldedEmail(user.email), normalizedEmail))
     .then((rows) => rows[0])
 
   const existingMembership = existingUser ? await getUserOrganization(existingUser.id) : null

apps/sim/lib/knowledge/access/drive-permissions.ts

@@ -1,3 +1,4 @@
+import { normalizeEmail } from '@sim/utils/string'
 import { groupToken, sortAccessTokens, userToken } from '@/lib/knowledge/access/tokens'
 import { LINK_ACCESS_TOKEN, PUBLIC_ACCESS_TOKEN } from '@/lib/knowledge/access/types'
 
@@ -50,7 +51,7 @@ export const CLOSED_OPEN_SHARING: OpenSharingPolicy = Object.freeze({
  * decided by the reader's own email domain rather than a second predicate.
  */
 export function domainGroupId(domain: string): string {
-  return `domain:${domain.trim().toLowerCase()}`
+  return `domain:${normalizeEmail(domain)}`
 }
 
 export interface DriveAclInput {