Prevent duplicate guest email signup

py/tests/test_auth.py

@@ -462,6 +462,32 @@ async def test_guest_signup_email(cli, url, factory: Factory, db_conn):
     }
 
 
+@if_online
+async def test_guest_signup_email_existing(cli, url, factory: Factory, db_conn):
+    await factory.create_company()
+    assert 0 == await db_conn.fetchval('SELECT COUNT(*) FROM users')
+
+    guest_1 = {
+        'email': 'testing@gmail.com',
+        'first_name': 'Tes',
+        'last_name': 'Ting',
+        'grecaptcha_token': '__ok__',
+    }
+    r = await cli.json_post(url('signup-guest', site='email'), data=guest_1)
+    assert r.status == 200, await r.text()
+
+    guest_2 = {
+        'email': 'testing@gmail.com',
+        'first_name': 'TesT',
+        'last_name': 'hot',
+        'grecaptcha_token': '__ok__',
+    }
+    r = await cli.json_post(url('signup-guest', site='email'), data=guest_2)
+    assert r.status == 470, await r.text()
+    assert {'status': 'existing user'} == await r.json()
+    assert 1 == await db_conn.fetchval('SELECT COUNT(*) FROM users')
+
+
 async def test_guest_signup_google(cli, url, factory: Factory, db_conn, mocker):
     await factory.create_company()
     data = {'id_token': 'good.test.token'}

py/web/views/auth.py

@@ -239,8 +239,13 @@ async def guest_signup(request):
         await check_grecaptcha(m, request)
 
     details = await siw_method(m, app=request.app)
-
     user_email = details['email'].lower()
+
+    conn = request['conn']
+    existing_user = await conn.fetchrow('SELECT * FROM users WHERE email=$1', user_email)
+    if existing_user:
+        raise JsonErrors.HTTP470(status='existing user')
+
     user_id, status = await request['conn'].fetchrow_b(
         CREATE_USER_SQL,
         values=Values(