Replace ILIKE email lookups from IDP authentication with more specific case-insensitive match (#92)

Author: somethingnew2-0

api/authentication.py

@@ -8,6 +8,7 @@
 from flask import Request, abort, current_app, g, redirect, session, url_for
 from flask.typing import ResponseReturnValue
 from sentry_sdk import set_user
+from sqlalchemy import func
 
 from api.extensions import oidc
 from api.models import OktaUser
@@ -19,7 +20,9 @@ def authenticate_user(request: Request) -> Optional[ResponseReturnValue]:
         if current_app.config["ENV"] in ("development", "test"):
             # Bypass authentication for development and testing
             current_user = (
-                OktaUser.query.filter(OktaUser.email.ilike(current_app.config["CURRENT_OKTA_USER_EMAIL"]))
+                OktaUser.query.filter(
+                    func.lower(OktaUser.email) == func.lower(current_app.config["CURRENT_OKTA_USER_EMAIL"])
+                )
                 .filter(OktaUser.deleted_at.is_(None))
                 .first_or_404()
             )
@@ -28,7 +31,7 @@ def authenticate_user(request: Request) -> Optional[ResponseReturnValue]:
             payload = CloudflareAuthenticationHelpers.verify_cloudflare_token(request)
             if "email" in payload:
                 current_user = (
-                    OktaUser.query.filter(OktaUser.email.ilike(payload["email"]))
+                    OktaUser.query.filter(func.lower(OktaUser.email) == func.lower(payload["email"]))
                     .filter(OktaUser.deleted_at.is_(None))
                     .first_or_404()
                 )
@@ -48,7 +51,9 @@ def authenticate_user(request: Request) -> Optional[ResponseReturnValue]:
                 )
                 return redirect(redirect_uri)
             current_user = (
-                OktaUser.query.filter(OktaUser.email.ilike(session["oidc_auth_profile"].get("email")))
+                OktaUser.query.filter(
+                    func.lower(OktaUser.email) == func.lower(session["oidc_auth_profile"].get("email"))
+                )
                 .filter(OktaUser.deleted_at.is_(None))
                 .first_or_404()
             )