@@ -16,6 +16,7 @@ import (
 	"github.com/cozy/cozy-stack/client"
 	"github.com/cozy/cozy-stack/client/request"
 	"github.com/cozy/cozy-stack/model/contact"
+	"github.com/cozy/cozy-stack/model/instance/lifecycle"
 	"github.com/cozy/cozy-stack/model/vfs"
 	"github.com/cozy/cozy-stack/pkg/consts"
 
@@ -427,10 +428,69 @@ this instance are correctly set.
 	},
 }
 
+var internalEmailsFixer = &cobra.Command{
+	Use:   "internal-emails",
+	Short: "Backfill the internal email of all the instances",
+	Long: `
+This fixer sets the internal email of each instance from its settings email.
+It skips organization instances and keeps an internal email already set. Emails
+found on several instances are listed for manual resolution and left unset.
+If a settings email can't be read, nothing is written and the command fails.
+`,
+	Example: `$ cozy-stack fix internal-emails --dry-run`,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		if !dryRunFlag && !forceFlag {
+			if err := askForConfirmation("Set the internal email on all instances?"); err != nil {
+				return err
+			}
+		}
+		c := newAdminClient()
+		q := url.Values{}
+		if dryRunFlag {
+			q.Set("dry_run", "true")
+		}
+		res, err := c.Req(&request.Options{
+			Method:  "POST",
+			Path:    "/instances/fixers/internal-emails",
+			Queries: q,
+		})
+		if err != nil {
+			return err
+		}
+		defer res.Body.Close()
+		var report lifecycle.InternalEmailsReport
+		if err := json.NewDecoder(res.Body).Decode(&report); err != nil {
+			return err
+		}
+		for email, domains := range report.Duplicates {
+			fmt.Fprintf(os.Stdout, "Duplicate %s: %s\n", email, strings.Join(domains, ", "))
+		}
+		for _, domain := range report.MissingSettings {
+			fmt.Fprintf(os.Stdout, "Missing settings: %s\n", domain)
+		}
+		for _, e := range report.Errors {
+			fmt.Fprintf(os.Stderr, "Error: %s\n", e)
+		}
+		updated := "Updated"
+		if dryRunFlag {
+			updated = "Would update"
+		}
+		fmt.Fprintf(os.Stdout, "Scanned: %d\nMissing settings: %d\nEmpty emails: %d\nDuplicate groups: %d\n%s: %d\nSkipped: %d\nErrors: %d\n",
+			report.Scanned, len(report.MissingSettings), report.EmptyEmails, len(report.Duplicates),
+			updated, report.Updated, report.Skipped, len(report.Errors))
+		if len(report.Errors) > 0 {
+			return fmt.Errorf("%d errors, see above", len(report.Errors))
+		}
+		return nil
+	},
+}
+
 func init() {
 	thumbnailsFixer.Flags().BoolVar(&dryRunFlag, "dry-run", false, "Dry run")
 	thumbnailsFixer.Flags().BoolVar(&withMetadataFlag, "with-metadata", false, "Recalculate images metadata")
 	redisFixer.Flags().BoolVar(&forceFlag, "force", false, "Do not ask for confirmation before fixing redis on all instances")
+	internalEmailsFixer.Flags().BoolVar(&dryRunFlag, "dry-run", false, "Report what would change without writing")
+	internalEmailsFixer.Flags().BoolVar(&forceFlag, "force", false, "Do not ask for confirmation before writing")
 
 	fixerCmdGroup.AddCommand(jobsFixer)
 	fixerCmdGroup.AddCommand(mimeFixerCmd)
@@ -442,6 +502,7 @@ func init() {
 	fixerCmdGroup.AddCommand(serviceTriggersFixer)
 	fixerCmdGroup.AddCommand(sharingsMovedFixer)
 	fixerCmdGroup.AddCommand(indexesFixer)
+	fixerCmdGroup.AddCommand(internalEmailsFixer)
 
 	RootCmd.AddCommand(fixerCmdGroup)
 }
@@ -425,6 +425,48 @@ Delete the accounts which are not linked to a konnector
 POST /instances/alice.cozy.localhost/fixers/orphan-account HTTP/1.1
 ```
 
+### POST /instances/fixers/internal-emails
+
+Set the internal email of every instance from its settings email. Organization
+instances are skipped, and an internal email already set is kept. Emails found
+on several instances are listed in `duplicates` and left unset, for manual
+resolution. If a settings email can't be read, nothing is updated, since
+duplicates can't be ruled out. Each scanned instance is counted once in
+`missing_settings`, `empty_emails`, `updated`, `skipped` or `errors`.
+
+#### Query-String
+
+| Parameter | Description                                          |
+| --------- | ---------------------------------------------------- |
+| dry_run   | `true` to report what would be updated, but not save |
+
+#### Request
+
+```http
+POST /instances/fixers/internal-emails?dry_run=true HTTP/1.1
+```
+
+#### Response
+
+```http
+HTTP/1.1 200 OK
+Content-Type: application/json
+```
+
+```json
+{
+  "scanned": 4,
+  "missing_settings": [],
+  "empty_emails": 0,
+  "duplicates": {
+    "bob@example.com": ["bob.cozy.localhost", "bob2.cozy.localhost"]
+  },
+  "updated": 1,
+  "skipped": 3,
+  "errors": []
+}
+```
+
 ### POST /instances/:domain/export
 
 Starts an export for the given instance. The CouchDB documents will be saved in
 
@@ -27,6 +27,7 @@ cozy-stack fix <command> [flags]
 * [cozy-stack](cozy-stack.md)	 - cozy-stack is the main command
 * [cozy-stack fix contact-emails](cozy-stack_fix_contact-emails.md)	 - Detect and try to fix invalid emails on contacts
 * [cozy-stack fix indexes](cozy-stack_fix_indexes.md)	 - Rebuild the CouchDB views and indexes
+* [cozy-stack fix internal-emails](cozy-stack_fix_internal-emails.md)	 - Backfill the internal email of all the instances
 * [cozy-stack fix jobs](cozy-stack_fix_jobs.md)	 - Take a look at the consistency of the jobs
 * [cozy-stack fix mime](cozy-stack_fix_mime.md)	 - Fix the class computed from the mime-type
 * [cozy-stack fix orphan-account](cozy-stack_fix_orphan-account.md)	 - Remove the orphan accounts
 
@@ -0,0 +1,45 @@
+## cozy-stack fix internal-emails
+
+Backfill the internal email of all the instances
+
+### Synopsis
+
+
+This fixer sets the internal email of each instance from its settings email.
+It skips organization instances and keeps an internal email already set. Emails
+found on several instances are listed for manual resolution and left unset.
+If a settings email can't be read, nothing is written and the command fails.
+
+
+```
+cozy-stack fix internal-emails [flags]
+```
+
+### Examples
+
+```
+$ cozy-stack fix internal-emails --dry-run
+```
+
+### Options
+
+```
+      --dry-run   Report what would change without writing
+      --force     Do not ask for confirmation before writing
+  -h, --help      help for internal-emails
+```
+
+### Options inherited from parent commands
+
+```
+      --admin-host string   administration server host (default "localhost")
+      --admin-port int      administration server port (default 6060)
+  -c, --config string       configuration file (default "$HOME/.cozy.yaml")
+      --host string         server host (default "localhost")
+  -p, --port int            server port (default 8080)
+```
+
+### SEE ALSO
+
+* [cozy-stack fix](cozy-stack_fix.md)	 - A set of tools to fix issues or migrate content.
+
@@ -41,3 +41,74 @@ func GetInstanceByInternalEmail(email string) (*instance.Instance, error) {
 		return nil, fmt.Errorf("internal email %s is on several instances", email)
 	}
 }
+
+// InternalEmailsReport sums up a backfill of internal emails.
+type InternalEmailsReport struct {
+	Scanned         int                 `json:"scanned"`
+	MissingSettings []string            `json:"missing_settings"`
+	EmptyEmails     int                 `json:"empty_emails"`
+	Duplicates      map[string][]string `json:"duplicates"`
+	Updated         int                 `json:"updated"`
+	Skipped         int                 `json:"skipped"`
+	Errors          []string            `json:"errors"`
+}
+
+// BackfillInternalEmails sets the internal email from the settings email. It
+// writes nothing if a settings read fails, as it may hide a duplicate.
+func BackfillInternalEmails(insts []*instance.Instance, dryRun bool) *InternalEmailsReport {
+	report := &InternalEmailsReport{
+		MissingSettings: []string{},
+		Duplicates:      map[string][]string{},
+		Errors:          []string{},
+	}
+	byEmail := make(map[string][]*instance.Instance)
+	for _, inst := range insts {
+		report.Scanned++
+		if inst.IsOrganizationInstance() && inst.InternalEmail == "" {
+			report.Skipped++
+			continue
+		}
+		email := inst.InternalEmail
+		if email == "" {
+			var err error
+			email, err = inst.SettingsEMail()
+			if couchdb.IsNotFoundError(err) {
+				report.MissingSettings = append(report.MissingSettings, inst.Domain)
+				continue
+			}
+			if err != nil {
+				report.Errors = append(report.Errors, fmt.Sprintf("%s: %s", inst.Domain, err))
+				continue
+			}
+		}
+		if email = utils.NormalizeEmail(email); email == "" {
+			report.EmptyEmails++
+			continue
+		}
+		byEmail[email] = append(byEmail[email], inst)
+	}
+
+	scanFailed := len(report.Errors) > 0
+	for email, owners := range byEmail {
+		if len(owners) > 1 {
+			for _, owner := range owners {
+				report.Duplicates[email] = append(report.Duplicates[email], owner.Domain)
+			}
+			report.Skipped += len(owners)
+			continue
+		}
+		inst := owners[0]
+		if inst.InternalEmail == email || scanFailed {
+			report.Skipped++
+			continue
+		}
+		if !dryRun {
+			if err := SetInternalEmail(inst, email); err != nil {
+				report.Errors = append(report.Errors, fmt.Sprintf("%s: %s", inst.Domain, err))
+				continue
+			}
+		}
+		report.Updated++
+	}
+	return report
+}
@@ -2,6 +2,9 @@ package lifecycle_test
 
 import (
 	"bytes"
+	"fmt"
+	"net/url"
+	"strings"
 	"testing"
 	"time"
 
@@ -494,6 +497,69 @@ func TestLifecycle(t *testing.T) {
 		assert.Equal(t, instance.TOSNone, deadline)
 	})
 
+	t.Run("BackfillInternalEmails", func(t *testing.T) {
+		suffix := fmt.Sprintf("%d.example", time.Now().UnixNano())
+		create := func(slug, email string) *instance.Instance {
+			t.Helper()
+			domain := slug + "-" + suffix
+			inst, err := lifecycle.Create(&lifecycle.Options{Domain: domain, Email: email})
+			require.NoError(t, err)
+			t.Cleanup(func() { _ = lifecycle.Destroy(domain) })
+			return inst
+		}
+		internalEmail := func(inst *instance.Instance) string {
+			t.Helper()
+			got, err := lifecycle.GetInstance(inst.Domain)
+			require.NoError(t, err)
+			return got.InternalEmail
+		}
+
+		insts := []*instance.Instance{
+			create("alice", " Alice@"+suffix),
+			create("bob", "bob@"+suffix),
+			create("bob2", "BOB@"+suffix),
+			create("nobody", ""),
+		}
+
+		report := lifecycle.BackfillInternalEmails(insts, true)
+		assert.Equal(t, 4, report.Scanned)
+		assert.Equal(t, 1, report.Updated)
+		assert.Equal(t, 2, report.Skipped)
+		assert.Equal(t, 1, report.EmptyEmails)
+		assert.ElementsMatch(t, []string{insts[1].Domain, insts[2].Domain}, report.Duplicates["bob@"+suffix])
+		assert.Empty(t, report.Errors)
+		assert.Empty(t, internalEmail(insts[0]), "dry run must not write")
+
+		report = lifecycle.BackfillInternalEmails(insts, false)
+		assert.Equal(t, 1, report.Updated)
+		assert.Equal(t, "alice@"+suffix, internalEmail(insts[0]))
+		assert.Empty(t, internalEmail(insts[1]))
+		assert.Empty(t, internalEmail(insts[2]))
+
+		orgSlug := "org-" + strings.TrimSuffix(suffix, ".example")
+		org, err := lifecycle.Create(&lifecycle.Options{Domain: orgSlug + ".example", OrgID: orgSlug})
+		require.NoError(t, err)
+		t.Cleanup(func() { _ = lifecycle.Destroy(org.Domain) })
+		require.True(t, org.IsOrganizationInstance())
+		require.NoError(t, lifecycle.SetInternalEmail(org, "erin@"+suffix))
+		erin := create("erin", "erin@"+suffix)
+		report = lifecycle.BackfillInternalEmails([]*instance.Instance{org, erin}, false)
+		assert.Len(t, report.Duplicates["erin@"+suffix], 2)
+		assert.Empty(t, internalEmail(erin))
+
+		// A failed settings read blocks every write.
+		clusters := config.GetConfig().CouchDB.Clusters
+		t.Cleanup(func() { config.GetConfig().CouchDB.Clusters = clusters })
+		unreachable, _ := url.Parse("http://127.0.0.1:1/")
+		config.GetConfig().CouchDB.Clusters = append(clusters[:len(clusters):len(clusters)], config.CouchDBCluster{URL: unreachable})
+		broken := &instance.Instance{Domain: "broken-" + suffix, CouchCluster: len(clusters)}
+		dave := create("dave", "dave@"+suffix)
+		report = lifecycle.BackfillInternalEmails([]*instance.Instance{dave, broken}, false)
+		assert.Len(t, report.Errors, 1)
+		assert.Equal(t, 0, report.Updated)
+		assert.Empty(t, internalEmail(dave))
+	})
+
 	t.Run("InstanceDestroy", func(t *testing.T) {
 		_ = lifecycle.Destroy("test.cozycloud.cc")
 
 
@@ -355,3 +355,12 @@ func indexesFixer(c echo.Context) error {
 
 	return c.NoContent(http.StatusNoContent)
 }
+
+func internalEmailsFixer(c echo.Context) error {
+	insts, err := instance.List()
+	if err != nil {
+		return wrapError(err)
+	}
+	dryRun := c.QueryParam("dry_run") == "true"
+	return c.JSON(http.StatusOK, lifecycle.BackfillInternalEmails(insts, dryRun))
+}
@@ -825,4 +825,5 @@ func Routes(router *echo.Group) {
 	router.POST("/:domain/fixers/sharings-moved", sharingsMovedFixer)
 	router.POST("/:domain/fixers/service-triggers", serviceTriggersFixer)
 	router.POST("/:domain/fixers/indexes", indexesFixer)
+	router.POST("/fixers/internal-emails", internalEmailsFixer)
 }
Original file line number	Diff line number	Diff line change
@@ -825,4 +825,5 @@ func Routes(router *echo.Group) {
825	825	router.POST("/:domain/fixers/sharings-moved", sharingsMovedFixer)
826	826	router.POST("/:domain/fixers/service-triggers", serviceTriggersFixer)
827	827	router.POST("/:domain/fixers/indexes", indexesFixer)
	828	+ router.POST("/fixers/internal-emails", internalEmailsFixer)
828	829	}