Lots of refinement

user/magic_link_test.go

@@ -289,6 +289,53 @@ func TestUser_MagicLink_ResetPassword_WrongKindRejected(t *testing.T) {
 	})
 }
 
+func TestUser_MagicLink_VerifyEmail_ProvisionedNoPrimary(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, newManager newManagerFunc) {
+		a := newTestManagerFromConfig(t, newManager, &Config{
+			DefaultAccess:    PermissionDenyAll,
+			ProvisionEnabled: true,
+			Users: []*User{
+				{Name: "prov", Hash: "$2a$10$YLiO8U21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C", Role: RoleUser},
+			},
+		})
+		prov, err := a.User("prov")
+		require.Nil(t, err)
+
+		// A provisioned user can verify an email (for notifications), but it must NOT become primary
+		_, err = a.VerifyEmail(addVerifyLink(t, a, prov.ID, "prov@example.com", time.Hour))
+		require.Nil(t, err)
+
+		emails, err := a.Emails(prov.ID)
+		require.Nil(t, err)
+		require.Equal(t, []string{"prov@example.com"}, emails)
+		primary, err := a.PrimaryEmail(prov.ID)
+		require.Nil(t, err)
+		require.Equal(t, "", primary)
+	})
+}
+
+func TestUser_MagicLink_ResetPassword_ProvisionedRejected(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, newManager newManagerFunc) {
+		// Provisioned users come from the config file (ProvisionEnabled), not AddUser
+		a := newTestManagerFromConfig(t, newManager, &Config{
+			DefaultAccess:    PermissionDenyAll,
+			ProvisionEnabled: true,
+			Users: []*User{
+				{Name: "prov", Hash: "$2a$10$YLiO8U21sX1uhZamTLJXHuxgVC0Z/GKISibrKCLohPgtG7yIxSk4C", Role: RoleUser},
+			},
+		})
+		prov, err := a.User("prov")
+		require.Nil(t, err)
+		require.True(t, prov.Provisioned)
+
+		// A reset token can be created, but consuming it must be rejected for a provisioned user
+		// (their password comes from the config file, like change-pass).
+		raw, err := a.CreateMagicLink(MagicLinkKindPasswordReset, prov.ID, "", time.Hour)
+		require.Nil(t, err)
+		require.ErrorIs(t, a.ResetPassword(raw, "newpass"), ErrProvisionedUserChange)
+	})
+}
+
 func TestUser_MagicLink_ResetPassword_Expired(t *testing.T) {
 	forEachBackend(t, func(t *testing.T, newManager newManagerFunc) {
 		a := newTestManager(t, newManager, PermissionDenyAll)

user/manager.go

@@ -1648,8 +1648,9 @@ func (a *Manager) DeleteEmailVerification(userID, email string) error {
 // validating the token (kind + expiry), it deletes the link, adds the address to the user's
 // verified emails, and -- if the user has no primary email yet and the address is not already
 // primary on another account -- promotes the new address to primary. All mutations run in one
-// transaction. A primary collision simply leaves the address verified but non-primary. Returns
-// the consumed link.
+// transaction. A primary collision simply leaves the address verified but non-primary. Provisioned
+// users never get a primary (the recovery email is meaningless for them -- they can't reset).
+// Returns the consumed link.
 func (a *Manager) VerifyEmail(rawToken string) (*MagicLink, error) {
 	tokenHash := hashToken(rawToken)
 	m, err := a.MagicLinkByHash(tokenHash)
@@ -1659,6 +1660,10 @@ func (a *Manager) VerifyEmail(rawToken string) (*MagicLink, error) {
 	if m.Kind != MagicLinkKindEmailVerify || time.Now().Unix() > m.Expires {
 		return nil, ErrMagicLinkNotFound
 	}
+	u, err := a.UserByID(m.UserID)
+	if err != nil {
+		return nil, err
+	}
 	err = db.ExecTx(a.db, func(tx *sql.Tx) error {
 		// Single use: delete the link, then add the (idempotent) verified address
 		if _, err := tx.Exec(a.queries.deleteMagicLinkByHash, tokenHash); err != nil {
@@ -1667,6 +1672,9 @@ func (a *Manager) VerifyEmail(rawToken string) (*MagicLink, error) {
 		if _, err := tx.Exec(a.queries.insertEmailIgnore, m.UserID, m.Email); err != nil {
 			return err
 		}
+		if u.Provisioned {
+			return nil // Provisioned users don't get a primary (recovery) email
+		}
 		// Promote to primary only if the user has none yet and the address is globally free.
 		// We check with SELECTs rather than catching a unique violation, because Postgres aborts
 		// the whole transaction on any constraint error (which would undo the verified-email add).
@@ -1712,6 +1720,9 @@ func (a *Manager) ResetPassword(rawToken, password string) error {
 	if err != nil {
 		return err
 	}
+	if u.Provisioned {
+		return ErrProvisionedUserChange // Provisioned users get their password from the config file, not reset
+	}
 	hash, err := a.maybeHashPassword(password, false)
 	if err != nil {
 		return err