Enhancement: Implement Collation Index for case-insensitive username lookups

[himanshu2006]

Following the database performance optimization in PR #39745 , the unindexed regex fallback search for CAS logins (new RegExp('^' + username + '$', 'i')) was replaced with a direct exact match. This successfully mitigated the risk of O(N) collection scans and CPU spikes during authentication.

However, this change introduces strict case-sensitivity. A CAS provider sending "JohnDoe" will no longer fall back to match an existing Rocket.Chat user stored as "johndoe".

Proposed Solution

To restore case-insensitive matching without sacrificing database performance, we should implement a Collation Index on the Users collection's username field at the database level.

By applying a collation index with strength: 2 (e.g., { locale: 'en', strength: 2 }), MongoDB can perform case-insensitive lookups while natively utilizing the b-tree index.

Alternatives Considered

• Normalizing at write/read (.toLowerCase()): While safe for new setups, doing this retroactively would require a massive database migration to normalize all existing mixed-case usernames. A Collation Index avoids this data migration entirely.
• Reverting to Regex: Unacceptable due to the severe performance penalty on large instances.

Additional Context

This architectural gap was highlighted during the automated review of the CAS regex removal. Tracking this here so we can natively support performant, case-insensitive lookups across the platform.

[adwait50]

Hi! I noticed this issue has been open with no active PR. I traced the two remaining RegExp-based case-insensitive lookups — findOneWithoutLDAPByUsernameIgnoringCase and findOneByUsernameAndServiceNameIgnoringCase — that bypass the existing username_insensitive collation index, causing O(N) collection scans. Fixed both by replacing RegExp with collation: { locale: 'en', strength: 2 }, consistent with how findOneByUsernameIgnoringCase already works. Opening a PR now!