feat(identity): phone number confirmation flow (closes #174) #198
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| namespace SimpleModule.Users.Contracts; | ||
|
|
||
| public interface ISmsSender | ||
| { | ||
| Task SendVerificationCodeAsync( | ||
| ApplicationUser user, | ||
| string phoneNumber, | ||
| string code, | ||
| CancellationToken cancellationToken = default | ||
| ); | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| using System.Security.Claims; | ||
| using Microsoft.AspNetCore.Builder; | ||
| using Microsoft.AspNetCore.Http; | ||
| using Microsoft.AspNetCore.Identity; | ||
| using Microsoft.AspNetCore.Mvc; | ||
| using Microsoft.AspNetCore.Routing; | ||
| using SimpleModule.Core; | ||
| using SimpleModule.Core.Inertia; | ||
| using SimpleModule.Users.Contracts; | ||
|
|
||
| namespace SimpleModule.Users.Pages.Account.Manage; | ||
|
|
||
| public class ConfirmPhoneNumberEndpoint : IViewEndpoint | ||
| { | ||
| public const string Route = UsersConstants.Routes.ConfirmPhoneNumber; | ||
|
|
||
| public void Map(IEndpointRouteBuilder app) | ||
| { | ||
| app.MapPost( | ||
| Route, | ||
| async ( | ||
| [FromForm] string? phoneNumber, | ||
| [FromForm] string? code, | ||
| ClaimsPrincipal principal, | ||
| UserManager<ApplicationUser> userManager, | ||
| SignInManager<ApplicationUser> signInManager | ||
| ) => | ||
| { | ||
| var user = await userManager.GetUserAsync(principal); | ||
| if (user is null) | ||
| { | ||
| return TypedResults.Redirect("/Identity/Account/Login"); | ||
| } | ||
|
|
||
| var username = await userManager.GetUserNameAsync(user); | ||
|
|
||
| if (string.IsNullOrWhiteSpace(phoneNumber) || string.IsNullOrWhiteSpace(code)) | ||
| { | ||
| return Inertia.Render( | ||
| "Users/Account/Manage/Index", | ||
| new | ||
| { | ||
| username, | ||
| phoneNumber = await userManager.GetPhoneNumberAsync(user), | ||
| isPhoneNumberConfirmed = await userManager.IsPhoneNumberConfirmedAsync( | ||
| user | ||
| ), | ||
| pendingPhoneNumber = phoneNumber, | ||
| statusMessage = "Error: Phone number and verification code are required.", | ||
| } | ||
| ); | ||
| } | ||
|
|
||
| var result = await userManager.ChangePhoneNumberAsync(user, phoneNumber, code); | ||
| if (!result.Succeeded) | ||
|
Comment on lines
+54
to
+55
Owner
Author
There was a problem hiding this comment. Agreed — 6 digits is too narrow a search space to leave unthrottled. Tracking in #199 alongside the SMS resend cooldown, so we add per-user attempt counters once for both email and phone code submission. Out of scope for this PR (phone parity to the existing untrottled email flow). Generated by Claude Code |
||
| { | ||
| return Inertia.Render( | ||
| "Users/Account/Manage/Index", | ||
| new | ||
| { | ||
| username, | ||
| phoneNumber = await userManager.GetPhoneNumberAsync(user), | ||
| isPhoneNumberConfirmed = await userManager.IsPhoneNumberConfirmedAsync( | ||
| user | ||
| ), | ||
| pendingPhoneNumber = phoneNumber, | ||
| statusMessage = "Error: Invalid or expired verification code.", | ||
| } | ||
| ); | ||
| } | ||
|
|
||
| await signInManager.RefreshSignInAsync(user); | ||
|
|
||
| return Inertia.Render( | ||
| "Users/Account/Manage/Index", | ||
| new | ||
| { | ||
| username, | ||
| phoneNumber = await userManager.GetPhoneNumberAsync(user), | ||
| isPhoneNumberConfirmed = await userManager.IsPhoneNumberConfirmedAsync( | ||
| user | ||
| ), | ||
| statusMessage = "Your phone number has been verified.", | ||
| } | ||
| ); | ||
| } | ||
| ) | ||
| .RequireAuthorization() | ||
| .DisableAntiforgery(); | ||
| } | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added
ForcePhoneReverify_ValidUser_ClearsPhoneNumberConfirmedAndRedirectstoAdminUsersEndpointTests. It seeds a user with a confirmed phone, posts to/admin/users/{id}/force-phone-reverify, and asserts both the 302 redirect and thatPhoneNumberConfirmedflips tofalsewhile the number itself is preserved.Generated by Claude Code