Don't allow invites to users who are already registered (#12560)

* Don't allow invites to users who are already registered

* Check that the user count has not changed

* Ensure that the admin is still registered

app/controllers/admin/invitations_controller.rb

@@ -11,6 +11,13 @@ module Admin
     def create
       email = params.dig(:user, :email)
       name = params.dig(:user, :name)
+
+      if User.exists?(["lower(email) = ? AND registered = ?", email, true])
+        flash[:error] = "Invitation was not sent. There is already a registered user with the email: #{email}"
+        redirect_to admin_invitations_path
+        return
+      end
+
       username = "#{name.downcase.tr(' ', '_').gsub(/[^0-9a-z ]/i, '')}_#{rand(1000)}"
       User.invite!(email: email,
                    name: name,

spec/requests/admin/invitations_spec.rb

@@ -29,6 +29,15 @@ RSpec.describe "/admin/invitations", type: :request do
            params: { user: { email: "hey#{rand(1000)}@email.co", name: "Roger #{rand(1000)}" } }
       expect(User.last.registered).to be false
     end
+
+    it "does not create an invitation if a user with that email exists" do
+      expect do
+        post "/admin/invitations",
+             params: { user: { email: admin.email, name: "Roger #{rand(1000)}" } }
+      end.not_to change { User.all.count }
+      expect(admin.reload.registered).to be true
+      expect(flash[:error].present?).to be true
+    end
   end
 
   describe "DELETE /admin/invitations" do