🐛 Bug Report: Test email sent to wrong address

[ethack]

Reproduction steps

I logged into my admin account and configured SMTP settings. I hit the "Send Test Email" button.

Here is a screenshot showing the first characters of the email associated with the account I'm authenticated as.

Expected behavior

I expected the test email to be sent to my email address (the one configured on the account I'm logged in as).

Actual Behavior

The test email was sent to a different user's email address. The user is the only other user in Pocket ID and is a regular user (non-admin).

Here is a screenshot of the mail service logs showing the email was sent to the wrong address.

[ethack]

If I'm understanding this correctly, it looks to be pulling the first user out of the database and sending to their email.

pocket-id/backend/internal/service/email_service.go

Line 49 in 82e475a

if err := srv.db.First(&user).Error; err != nil {

The gorm docs state that First orders by primary key.

I checked and table has a primary key set to id. It just so happens that my second user's id comes before mine.

sqlite> .schema users
CREATE TABLE users
(
    id         TEXT                  NOT NULL PRIMARY KEY,
    created_at DATETIME,
    username   TEXT                  NOT NULL UNIQUE,
    email      TEXT                  NOT NULL UNIQUE,
    first_name TEXT,
    last_name  TEXT,
    is_admin   NUMERIC DEFAULT FALSE NOT NULL
);
sqlite> select * from users order by id;
4a<<redacted>>fcf|1736404168|ash|ash<<redacted>>@<<redacted>>.com|Ash|<<redacted>>|0
a64<<redacted>>65e|1736404013|ethan|ethan<<redacted>>@<<redacted>>.com|Ethan|<<redacted>>|1

I suggest specifying the current logged in user in the query.