Allow primary email for provisioend users

server/server_account.go

@@ -735,8 +735,6 @@ func (s *Server) handleAccountEmailSetPrimary(w http.ResponseWriter, r *http.Req
 		return err
 	} else if !emailAddressRegex.MatchString(req.Email) {
 		return errHTTPBadRequestEmailAddressInvalid
-	} else if u.Provisioned {
-		return errHTTPConflictProvisionedUserChange // Provisioned users can't reset, so a recovery email is meaningless
 	}
 	logvr(v, r).Tag(tagAccount).Field("email", req.Email).Info("Setting primary email")
 	err = s.userManager.SetPrimaryEmail(u.ID, req.Email)

server/server_account_email_test.go

@@ -364,7 +364,7 @@ func TestAccount_Signup_WithoutEmail_NoSend(t *testing.T) {
 	})
 }
 
-func TestAccount_Email_ProvisionedNoPrimary(t *testing.T) {
+func TestAccount_Email_ProvisionedPrimary(t *testing.T) {
 	forEachBackend(t, func(t *testing.T, databaseURL string) {
 		hash, err := user.HashPassword("provpass", user.DefaultUserPasswordBcryptCost)
 		require.Nil(t, err)
@@ -379,16 +379,19 @@ func TestAccount_Email_ProvisionedNoPrimary(t *testing.T) {
 		defer s.closeDatabases()
 		auth := map[string]string{"Authorization": util.BasicAuth("prov", "provpass")}
 
-		// A provisioned user can verify an email, but it must NOT become their primary
+		// A provisioned user's first verified email becomes their primary (used by X-Email: yes;
+		// password reset stays blocked separately for provisioned users)
 		verifyEmailFor(t, s, mailer, auth, "prov@example.com")
 		account := getAccount(t, s, auth)
 		require.Equal(t, []string{"prov@example.com"}, verifiedAddrs(account))
-		require.Equal(t, "", primaryAddr(account))
+		require.Equal(t, "prov@example.com", primaryAddr(account))
 
-		// Explicitly setting it primary is rejected
-		rr := request(t, s, "POST", "/v1/account/email/primary", `{"email":"prov@example.com"}`, auth)
-		require.Equal(t, 409, rr.Code)
-		require.Equal(t, 40905, toHTTPError(t, rr.Body.String()).Code)
+		// Verify a second address and explicitly set it primary -> allowed, star moves
+		verifyEmailFor(t, s, mailer, auth, "prov2@example.com")
+		rr := request(t, s, "POST", "/v1/account/email/primary", `{"email":"prov2@example.com"}`, auth)
+		require.Equal(t, 200, rr.Code)
+		account = getAccount(t, s, auth)
+		require.Equal(t, "prov2@example.com", primaryAddr(account))
 	})
 }
 

server/server_test.go

@@ -1728,6 +1728,33 @@ func TestServer_PublishEmailVerify_BoolValueAnonymousRejected(t *testing.T) {
 	})
 }
 
+func TestServer_PublishEmailVerify_BoolValueProvisionedUsesPrimary(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		hash, err := user.HashPassword("provpass", user.DefaultUserPasswordBcryptCost)
+		require.Nil(t, err)
+		conf := newTestConfigWithAuthFile(t, databaseURL)
+		conf.AuthUsers = []*user.User{{Name: "prov", Hash: hash, Role: user.RoleUser}}
+		s := newTestServer(t, conf)
+		mailer := &testMailer{}
+		s.mailer = mailer
+		defer s.closeDatabases()
+
+		prov, err := s.userManager.User("prov")
+		require.Nil(t, err)
+		require.Nil(t, s.userManager.AddEmail(prov.ID, "aaa@example.com"))
+		require.Nil(t, s.userManager.AddEmail(prov.ID, "zzz@example.com"))
+		require.Nil(t, s.userManager.SetPrimaryEmail(prov.ID, "zzz@example.com"))
+
+		// A provisioned user's "yes" resolves to their chosen primary, not the alphabetically-first
+		response := request(t, s, "PUT", "/mytopic", "hi", map[string]string{
+			"Email":         "yes",
+			"Authorization": util.BasicAuth("prov", "provpass"),
+		})
+		require.Equal(t, 200, response.Code)
+		require.Equal(t, "zzz@example.com", mailer.LastTo())
+	})
+}
+
 func TestServer_PublishEmailVerify_Anonymous(t *testing.T) {
 	forEachBackend(t, func(t *testing.T, databaseURL string) {
 		conf := newTestConfigWithAuthFile(t, databaseURL)