Method makeSessionFromNameAndEmail

rest/session_api.go:162–205

MakeSessionFromUserAndEmail first attempts to find the user by username. If found, updates the users's email if different. If no match for username, attempts to find by the user by email. If not found, and createUserIfNeeded=true, creates a new user based on username, email.

(username, email string, createUserIfNeeded bool)

// email if different. If no match for username, attempts to find by the user by email.
// If not found, and createUserIfNeeded=true, creates a new user based on username, email.
func (h *handler) makeSessionFromNameAndEmail(username, email string, createUserIfNeeded bool) error {

	// First attempt lookup by username and make a login session for her.
	user, err := h.db.Authenticator(h.ctx()).GetUser(username)
	if err != nil {
		return err
	}

	// Attempt email updates/lookups if an email is provided.
	if len(email) > 0 {
		if user != nil {
			// User found, check whether the email needs to be updated
			// (e.g. user has changed email in external auth system)
			if email != user.Email() {
				if err = h.db.Authenticator(h.ctx()).UpdateUserEmail(user, email); err != nil {
					// Failure to update email during session creation is non-critical, log and continue.
					base.InfofCtx(h.ctx(), base.KeyAuth, "Unable to update email for user %s during session creation.  Session will still be created. Error:%v,", base.UD(username), err)
				}
			}
		} else {
			// User not found by username. Attempt user lookup by email. This provides backward
			// compatibility for users that were originally created with id = email
			if user, err = h.db.Authenticator(h.ctx()).GetUserByEmail(email); err != nil {
				return err
			}
		}
	}

	// Couldn't find existing user.
	if user == nil {
		if !createUserIfNeeded {
			return base.HTTPErrorf(http.StatusUnauthorized, "No such user")
		}

		// Create a User with the given username, email address, and a random password.
		// CAS mismatch indicates the user has been created by another request underneath us, can continue with session creation
		user, err = h.db.Authenticator(h.ctx()).RegisterNewUser(username, email)
		if err != nil && !base.IsCasMismatch(err) {
			return err
		}
	}

	return h.makeSession(user)
}

// ADMIN API: Generates a login session for a user and returns the session ID and cookie name.
func (h *handler) createUserSession() error {