Send "X-Email: yes" to primary

server/server_account.go

@@ -866,7 +866,8 @@ func (s *Server) handleAccountPasswordReset(w http.ResponseWriter, r *http.Reque
 // convertEmailAddress checks the email address against the user's verified email list.
 // If smtp-sender-verify is false (default), the email is passed through as-is for
 // backwards compatibility. If true, the user must be authenticated and the email must be
-// in their verified list. "yes"/"true"/"1" resolves to the first verified email.
+// in their verified list. "yes"/"true"/"1" resolves to the user's primary email (falling
+// back to the first verified email if no primary is designated).
 func (s *Server) convertEmailAddress(u *user.User, email string) (string, *errHTTP) {
 	if !s.config.SMTPSenderVerify {
 		if toBool(email) {
@@ -885,7 +886,13 @@ func (s *Server) convertEmailAddress(u *user.User, email string) (string, *errHT
 		return "", errHTTPBadRequestEmailAddressNotVerified
 	}
 	if toBool(email) {
-		return emails[0], nil
+		primary, err := s.userManager.PrimaryEmail(u.ID)
+		if err != nil {
+			return "", errHTTPInternalError
+		} else if primary != "" {
+			return primary, nil
+		}
+		return emails[0], nil // No primary designated (e.g. provisioned user); fall back to first verified
 	} else if util.Contains(emails, email) {
 		return email, nil
 	}

server/server_test.go

@@ -1336,14 +1336,16 @@ func TestServer_DailyMessageQuotaFromDatabase(t *testing.T) {
 }
 
 type testMailer struct {
-	count int
-	mu    sync.Mutex
+	count  int
+	lastTo string
+	mu     sync.Mutex
 }
 
 func (t *testMailer) SendNotification(to string, m *model.Message, senderIP string) error {
 	t.mu.Lock()
 	defer t.mu.Unlock()
 	t.count++
+	t.lastTo = to
 	return nil
 }
 
@@ -1357,6 +1359,12 @@ func (t *testMailer) Count() int {
 	return t.count
 }
 
+func (t *testMailer) LastTo() string {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	return t.lastTo
+}
+
 func (t *testMailer) SendEmailVerification(to, link string) error { return nil }
 
 func (t *testMailer) SendPasswordReset(to, link string) error { return nil }
@@ -1653,6 +1661,33 @@ func TestServer_PublishEmailVerify_BoolValue(t *testing.T) {
 	})
 }
 
+func TestServer_PublishEmailVerify_BoolValueUsesPrimary(t *testing.T) {
+	forEachBackend(t, func(t *testing.T, databaseURL string) {
+		conf := newTestConfigWithAuthFile(t, databaseURL)
+		conf.SMTPSenderVerify = true
+		s := newTestServer(t, conf)
+		mailer := &testMailer{}
+		s.mailer = mailer
+		defer s.closeDatabases()
+
+		require.Nil(t, s.userManager.AddUser("phil", "phil", user.RoleUser, false))
+		u, err := s.userManager.User("phil")
+		require.Nil(t, err)
+		// Two verified emails; the primary is NOT the alphabetically-first one
+		require.Nil(t, s.userManager.AddEmail(u.ID, "aaa@example.com"))
+		require.Nil(t, s.userManager.AddEmail(u.ID, "zzz@example.com"))
+		require.Nil(t, s.userManager.SetPrimaryEmail(u.ID, "zzz@example.com"))
+
+		// "yes" must resolve to the primary email, not emails[0] (alphabetically first)
+		response := request(t, s, "PUT", "/mytopic", "hi", map[string]string{
+			"Email":         "yes",
+			"Authorization": util.BasicAuth("phil", "phil"),
+		})
+		require.Equal(t, 200, response.Code)
+		require.Equal(t, "zzz@example.com", mailer.LastTo())
+	})
+}
+
 func TestServer_PublishEmailVerify_BoolValue_NoVerify(t *testing.T) {
 	forEachBackend(t, func(t *testing.T, databaseURL string) {
 		s := newTestServer(t, newTestConfig(t, databaseURL))