🩹(mailboxes) enforce mailboxes are lowercase

enforce lowercase for new mailboxes, upon creation
and when sending to dimail

CHANGELOG.md

@@ -8,6 +8,8 @@ and this project adheres to
 
 ## [Unreleased]
 
+### Fixed
+- ✨(mailboxes) enforce lowercase on mailboxes
 - 🐛(i18n) fix missing translations for status tag labels
 
 ## [1.23.1] - 2026-02-16

src/backend/mailbox_manager/models.py

@@ -351,6 +351,8 @@ Last name and Domain already exists.",
             raise exceptions.ValidationError(
                 _("You can't create or update a mailbox for a disabled domain.")
             )
+
+        self.local_part = self.local_part.lower()
         return super().save(*args, **kwargs)
 
     @property

src/backend/mailbox_manager/tests/api/mailboxes/test_api_mailboxes_create.py

@@ -58,7 +58,7 @@ def test_api_mailboxes__create_no_access_forbidden_not_found(mailbox_data):
     assert not models.Mailbox.objects.exists()
 
 
-def test_api_mailboxes__create_viewer_failure(mailbox_data):
+def test_api_mailboxes__create_viewer_forbidden(mailbox_data):
     """Users with viewer role should not be able to create mailbox on the mail domain."""
     mail_domain = factories.MailDomainEnabledFactory()
     access = factories.MailDomainAccessFactory(
@@ -89,7 +89,7 @@ def test_api_mailboxes__create_display_name_must_be_unique():
 
     new_mailbox_data = {
         "local_part": "something_else",
-        "first_name": existing_mailbox.first_name.upper(),  # ensure case-insensitivity
+        "first_name": existing_mailbox.first_name.upper(),  # checks case-insensitivity
         "last_name": existing_mailbox.last_name.lower(),
     }
     response = client.post(
@@ -239,6 +239,35 @@ def test_api_mailboxes__create_with_accent_success(role, dimail_token_ok):
     }
 
 
+@responses.activate
+def test_api_mailboxes__create_lowercase(dimail_token_ok, mailbox_data):
+    """Should lowercase emails on creation."""
+    access = factories.MailDomainAccessFactory(role=enums.MailDomainRoleChoices.ADMIN)
+    mailbox_data["local_part"] = "WeiRdCaSe"
+
+    # ensure response
+    # token response in fixtures
+    responses.add(
+        responses.POST,
+        re.compile(rf".*/domains/{access.domain.name}/mailboxes/"),
+        body=response_mailbox_created(
+            f"{mailbox_data['local_part']}@{access.domain.name}"
+        ),
+        status=status.HTTP_201_CREATED,
+        content_type="application/json",
+    )
+
+    client = APIClient()
+    client.force_login(access.user)
+    response = client.post(
+        f"/api/v1.0/mail-domains/{access.domain.slug}/mailboxes/",
+        mailbox_data,
+        format="json",
+    )
+    assert response.status_code == status.HTTP_201_CREATED
+    assert response.json()["local_part"] == mailbox_data["local_part"].lower()
+
+
 def test_api_mailboxes__create_administrator_missing_fields():
     """
     Administrator users should not be able to create mailboxes

src/backend/mailbox_manager/tests/fixtures/dimail.py

@@ -301,4 +301,4 @@ def response_allows_created(user_name, domain_name):
 ## MAILBOXES
 def response_mailbox_created(email_address):
     """mimic dimail response upon successful mailbox creation."""
-    return json.dumps({"email": email_address, "password": "password"})
+    return json.dumps({"email": email_address.lower(), "password": "password"})