Attempt to change email to another user's email/username using Identity API results in mismatch between email and username

[bluedot2]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

If I POST to the /manage/info Identity API endpoint with a new email, but another user already exists with that email/username, the call succeeds (with no changes to the user's account yet); when the user clicks the link in the confirmation email (resulting in a call to the /confirmEmail endpoint), it results in an error, but the user's email has in fact been changed (but not the username). This contradicts the policy of the email and username always being the same, and the user now has an email that is the same as another user's email/username.

Expected Behavior

I would expect an error to occur if a POST to /manage/info includes a request to change the email to one used by another user.

However, it's possible that after the change request is made (POST to /manage/info) but before the user clicks the link in the confirmation email (/confirmEmail), a new account could have been created with the same email/username requested in the change. In this case an error should occur and the account should be left unchanged.

Steps To Reproduce

1. Create two accounts (say A and B) using the /register endpoint.
2. Call the /login endpoint to get an access token for account A.
3. POST to the /manage/info endpoint (using the access token) with newEmail set to account B's email/username. This call will succeed.
4. Click the link in the confirmation email. It will fail with a 401 error, but A's email will now be the same as B's email/username.

Exceptions (if any)

No response

.NET Version

8.0.100

Anything else?

ASP.NET Core version: 8.0.0

[BillyMartin1964]

This has always been a confusing issue since Identity assumes the username will be the email address. Maybe a boolean for make username the email?