Emailed the account owner when signup hits an existing address

* SignUpApiAction and BeginAction now email the owner of an already-registered
  address (new sendExistingAccountEmail helper) instead of doing nothing. Both
  signup paths now send an email, so response timing no longer reveals whether
  an account exists.
* The existing account is never modified, and send failures are logged and
  swallowed so the response stays identical to a new signup. The email points
  the owner to the "Forgot your password?" reset flow.
* Renamed the SignUpApiAction success status from USER_ADDED to SUCCESS, which
  was misleading in the existing-account case where no user is added. The
  external signup wiki form must key its success branch off SUCCESS.

Co-Authored-By: Claude <[email protected]>

Author: vagisha

signup/src/org/labkey/signup/SignUpController.java

@@ -47,6 +47,7 @@
 import org.labkey.api.security.DbLoginService;
 import org.labkey.api.security.Group;
 import org.labkey.api.security.LoginManager;
+import org.labkey.api.security.LoginUrls;
 import org.labkey.api.security.RequiresLogin;
 import org.labkey.api.security.RequiresNoPermission;
 import org.labkey.api.security.RequiresPermission;
@@ -61,6 +62,7 @@
 import org.labkey.api.util.ButtonBuilder;
 import org.labkey.api.util.ConfigurationException;
 import org.labkey.api.util.DOM;
+import org.labkey.api.util.MailHelper;
 import org.labkey.api.util.PageFlowUtil;
 import org.labkey.api.util.URLHelper;
 import org.labkey.api.util.CsrfInput;
@@ -594,7 +596,8 @@ public boolean handlePost(SignupForm signupForm, BindException errors) throws Ex
             if (UserManager.userExists(email))
             {
                 // Do not reveal whether an account already exists (avoids user enumeration).
-                // Show the same "confirmation sent" response as a new signup, without sending an email.
+                // Notify the real owner and show the same "confirmation sent" response as a new signup.
+                sendExistingAccountEmail(email);
                 clearCaptcha();
                 signupForm.setNewSignUp(false);
                 return false;
@@ -727,6 +730,35 @@ private void createUserAndSendEmail(SignupForm form, ValidEmail email)
         }
     }
 
+    // Sends an informational email to the owner of an already-registered address when someone
+    // submits the signup form for that address. Both the new-signup and existing-account paths
+    // now send an email. The existing account is never modified. Send failures are logged and
+    // swallowed so the caller still returns the same success response as a new signup.
+    private void sendExistingAccountEmail(ValidEmail email)
+    {
+        Container c = getContainer();
+        try
+        {
+            String siteName = LookAndFeelProperties.getInstance(c).getShortName();
+            ActionURL loginUrl = PageFlowUtil.urlProvider(LoginUrls.class).getLoginURL(c, null);
+            String body = "We received a request to create an account on " + siteName
+                    + " using this email address. An account already exists for " + email.getEmailAddress() + ".\n\n"
+                    + "If this was you and you have forgotten your password, go to the sign-in page and use "
+                    + "the \"Forgot your password?\" link to reset it:\n" + loginUrl.getURIString() + "\n\n"
+                    + "If you did not make this request, you can ignore this email.";
+            MailHelper.ViewMessage m = MailHelper.createMessage(
+                    LookAndFeelProperties.getInstance(c).getSystemEmailAddress(), email.getEmailAddress());
+            m.setSubject("You already have an account on " + siteName);
+            m.setText(body);
+            MailHelper.send(m, getUser(), c);
+        }
+        catch (Exception e)
+        {
+            // Log and continue so the response stays identical to the new-signup case.
+            _log.error("Failed to send existing-account email", e);
+        }
+    }
+
     private static List<String> errorsToMessages(Errors errors)
     {
         return errors.getAllErrors().stream()
@@ -954,9 +986,10 @@ public ApiResponse execute(SignupForm signupForm, BindException errors) throws E
             if (UserManager.userExists(email))
             {
                 // Do not reveal whether an account already exists (avoids user enumeration).
-                // Return the same response as a successful new signup, without sending an email.
+                // Notify the account owner and return the same response as a successful new signup.
+                sendExistingAccountEmail(email);
                 clearCaptcha();
-                response.put("status", "USER_ADDED");
+                response.put("status", "SUCCESS");
                 return response;
             }
 
@@ -976,7 +1009,7 @@ public ApiResponse execute(SignupForm signupForm, BindException errors) throws E
 
             clearCaptcha();
 
-            response.put("status", "USER_ADDED");
+            response.put("status", "SUCCESS");
             return response;
         }
     }