Changing primary email does not "free up" the original email address

[rfk]

@vbudhram mentioned this to me a little while ago, but I only just got around to stepping through it and filing a bug. STR:

• Create an account with address A
• Add a secondary email address B
• Switch B to be your primary address
• Remove A from the account

Expected results:

• I can now sign up for a new, separate account with address A

Actual results:

• The original account is still holding on to A and nobody else can use it. If they try, they'll get a pretty confusing error message:

What I can do is add it as a secondary email onto another account, then make it the primary from there. But I can't directly create a new account with the original email as primary.

---

The reason for all this, is that we have to keep the original email address hanging around in the accounts table, because it's used as an input to the password-hashing function. When I try to create a new account with that email address, it violates the UNIQUE constraint on the normalizedEmail column here:

https://github.com/mozilla/fxa-auth-db-mysql/blob/master/lib/db/schema/patch-001-002.sql#L5

But...IIUC we no longer really use that column for ensuring uniqueness, because all emails are now written into the emails table and uniqueness is preserved there. So I wonder, can we just drop the unique constraint on this column (or perhaps even drop the column entirely) and resolve this issue?

┆Issue is synchronized with this Jira Task
┆Issue Number: FXA-689

[vbudhram]

This has been hanging out in next for a while. I don't think I will have a chance to pick this up in current train. Moving to backlog with a ❤️ because I would like to get it resolved at some point.

[rfk]

Taking this out of the milestone, but leaving it alive because I want to dig into the refactoring here a little.

[clouserw]

Marking this needs:product (/cc @davismtl ). Is this something you want? There seems like security implications to allowing once-registered account to be created again, especially with sub platform now

[shane-tomlinson]

Ref #502, #1437

[rfk]

Ref https://bugzilla.mozilla.org/show_bug.cgi?id=1652661

[rfk]

Got another report of a user hitting this via Matrix today.

[kelimuttu]

There's also a question in SUMO about this recently.

[data-sync-user]

➤ Wil Clouser commented:

FXA-685, verifier upgrades, would fix this