fix(user): harden account email and password handling

- normalize emails (trim + lowercase) and enforce uniqueness across
  registration, OAuth auto-registration, and email binding
- serialize concurrent writers on the same normalized email within a
  transaction to avoid duplicate accounts
- resolve password reset to a single matching account and reject
  ambiguous or absent matches
- require an existing password before self-service password change and
  reject login for accounts without a usable password

model/user_update_test.go

@@ -1,6 +1,7 @@
 package model
 
 import (
+	"errors"
 	"testing"
 
 	"github.com/QuantumNous/new-api/common"
@@ -90,3 +91,130 @@ func TestUpdateUserSettingOnlyUpdatesSetting(t *testing.T) {
 	assert.Equal(t, 4, got.RequestCount)
 	assert.Equal(t, "zh", got.GetSetting().Language)
 }
+
+func TestEnsureEmailAvailableRejectsExistingEmailCaseInsensitive(t *testing.T) {
+	setupUserUpdateTestState(t)
+
+	require.NoError(t, DB.Create(&User{
+		Username: "existing",
+		Password: "old-password",
+		Email:    "Taken@Example.com",
+		Status:   common.UserStatusEnabled,
+	}).Error)
+
+	err := EnsureEmailAvailable(" taken@example.COM ", 0)
+	require.ErrorIs(t, err, ErrEmailAlreadyTaken)
+
+	user, err := GetUniqueUserByEmail("TAKEN@example.com")
+	require.NoError(t, err)
+	assert.Equal(t, "existing", user.Username)
+
+	require.NoError(t, EnsureEmailAvailable("taken@example.com", user.Id))
+}
+
+func TestInsertRejectsDuplicateEmailWithoutUniqueIndex(t *testing.T) {
+	setupUserUpdateTestState(t)
+
+	require.NoError(t, DB.Create(&User{
+		Username: "existing",
+		Password: "old-password",
+		Email:    "taken@example.com",
+		Status:   common.UserStatusEnabled,
+	}).Error)
+
+	user := &User{
+		Username: "oauth-user",
+		Email:    "TAKEN@example.com",
+		Role:     common.RoleCommonUser,
+		Status:   common.UserStatusEnabled,
+	}
+
+	err := user.Insert(0)
+	require.ErrorIs(t, err, ErrEmailAlreadyTaken)
+
+	var count int64
+	require.NoError(t, DB.Model(&User{}).Where("username = ?", "oauth-user").Count(&count).Error)
+	assert.Zero(t, count)
+}
+
+func TestInsertKeepsBlankPasswordForPasswordlessUser(t *testing.T) {
+	setupUserUpdateTestState(t)
+
+	user := &User{
+		Username: "passwordless-user",
+		Role:     common.RoleCommonUser,
+		Status:   common.UserStatusEnabled,
+	}
+
+	require.NoError(t, user.Insert(0))
+
+	var stored User
+	require.NoError(t, DB.Where("username = ?", user.Username).First(&stored).Error)
+	assert.Empty(t, stored.Password)
+}
+
+func TestValidateAndFillRejectsPasswordlessUser(t *testing.T) {
+	setupUserUpdateTestState(t)
+
+	require.NoError(t, DB.Create(&User{
+		Username: "passwordless-user",
+		Password: "",
+		Status:   common.UserStatusEnabled,
+	}).Error)
+
+	loginUser := User{
+		Username: "passwordless-user",
+		Password: "NewPassword123",
+	}
+	err := loginUser.ValidateAndFill()
+	require.ErrorIs(t, err, ErrInvalidCredentials)
+
+	var stored User
+	require.NoError(t, DB.Where("username = ?", "passwordless-user").First(&stored).Error)
+	assert.Empty(t, stored.Password)
+}
+
+func TestResetUserPasswordByEmailRequiresSingleActiveMatch(t *testing.T) {
+	setupUserUpdateTestState(t)
+
+	require.NoError(t, DB.Create(&User{
+		Username: "duplicate-1",
+		Password: "old-1",
+		Email:    "legacy@example.com",
+		AffCode:  "dupe1",
+		Status:   common.UserStatusEnabled,
+	}).Error)
+	require.NoError(t, DB.Create(&User{
+		Username: "duplicate-2",
+		Password: "old-2",
+		Email:    "LEGACY@example.com",
+		AffCode:  "dupe2",
+		Status:   common.UserStatusEnabled,
+	}).Error)
+
+	err := ResetUserPasswordByEmail("legacy@example.com", "NewPassword123")
+	require.ErrorIs(t, err, ErrEmailAmbiguous)
+
+	var duplicates []User
+	require.NoError(t, DB.Where("LOWER(email) = ?", "legacy@example.com").Order("username asc").Find(&duplicates).Error)
+	require.Len(t, duplicates, 2)
+	assert.Equal(t, "old-1", duplicates[0].Password)
+	assert.Equal(t, "old-2", duplicates[1].Password)
+
+	require.NoError(t, DB.Create(&User{
+		Username: "unique",
+		Password: "old",
+		Email:    "unique@example.com",
+		AffCode:  "unique",
+		Status:   common.UserStatusEnabled,
+	}).Error)
+
+	require.NoError(t, ResetUserPasswordByEmail("UNIQUE@example.com", "NewPassword123"))
+
+	var unique User
+	require.NoError(t, DB.Where("username = ?", "unique").First(&unique).Error)
+	assert.True(t, common.ValidatePasswordAndHash("NewPassword123", unique.Password))
+
+	err = ResetUserPasswordByEmail("missing@example.com", "NewPassword123")
+	require.True(t, errors.Is(err, ErrEmailNotFound))
+}