Update email check exist (#7899)

* throw a 401 error if user tries to update his/her email to an email that exists already

* Make error message generic so we don't violate users' privacy.  Added test case.

* Syntax fixes

* select only the _id field when searching for users with the same email.  Return found document as javascript object.

website/server/controllers/api-v3/auth.js

@@ -545,6 +545,9 @@ api.updateEmail = {
     let validationErrors = req.validationErrors();
     if (validationErrors) throw validationErrors;
 
+    let emailAlreadyInUse = await User.findOne({'auth.local.email': req.body.newEmail}).select({_id: 1}).lean().exec();
+    if (emailAlreadyInUse) throw new NotAuthorized(res.t('cannotFulfillReq'));
+
     let candidatePassword = passwordUtils.encrypt(req.body.password, user.auth.local.salt);
     if (candidatePassword !== user.auth.local.hashed_password) throw new NotAuthorized(res.t('wrongPassword'));