Send by username without permissions required

Author: silverbackdan

features/user/new_email_address.feature

@@ -161,6 +161,16 @@ Feature: Register process via a form
     And the JSON node "newEmailConfirmationToken" should not exist
     And I should not receive any emails
 
+  @loginUser
+  Scenario: I can resend a new email address confirmation email with a new token
+    Given there is a "new_email" form
+    And there is a user with the username "another_user" password "password" and role "ROLE_USER"
+    And I add "referer" header equal to "http://www.website.com"
+    When I send a "GET" request to "/confirm-email/my_username/new@email.com/abc123"
+    Then the response status code should be 201
+    And the JSON node "newEmailConfirmationToken" should not exist
+    And I should not receive any emails
+
   Scenario: I can verify my new email address
     Given there is a user with the username "my_username" password "password" and role "ROLE_USER" and the email address "old@email.com"
     And the user has a new email address "new@email.com" and confirmation token abc123

src/Action/User/ResendVerifyEmailAddressAction.php

@@ -13,10 +13,8 @@
 
 namespace Silverback\ApiComponentsBundle\Action\User;
 
-use Silverback\ApiComponentsBundle\Entity\User\AbstractUser;
 use Silverback\ApiComponentsBundle\Helper\User\UserDataProcessor;
 use Silverback\ApiComponentsBundle\Helper\User\UserMailer;
-use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\Response;
 
 /**
@@ -27,17 +25,22 @@
     public function __construct(
         private UserMailer $userMailer,
         private UserDataProcessor $userDataProcessor,
-        private Security $security,
     ) {
     }
 
-    public function __invoke(string $username, string $token): Response
+    public function __invoke(string $username): Response
     {
-        $user = $this->security->getUser();
-        if (!$user instanceof AbstractUser) {
-            return new Response(null, Response::HTTP_UNAUTHORIZED);
+        $user = $this->userDataProcessor->updateVerifyEmailToken($username);
+        if (!$user) {
+            $response = new Response(null, Response::HTTP_OK);
+            $response->setCache([
+                'private' => true,
+                's_maxage' => 0,
+                'max_age' => 0,
+            ]);
+            return $response;
         }
-        $this->userDataProcessor->setEmailAddressVerifyToken($user);
+
         $emailSuccess = $this->userMailer->sendEmailVerifyEmail($user);
 
         $response = new Response(null, $emailSuccess ? Response::HTTP_OK : Response::HTTP_SERVICE_UNAVAILABLE);

src/Action/User/ResendVerifyNewEmailAddressAction.php

@@ -13,10 +13,8 @@
 
 namespace Silverback\ApiComponentsBundle\Action\User;
 
-use Silverback\ApiComponentsBundle\Entity\User\AbstractUser;
 use Silverback\ApiComponentsBundle\Helper\User\UserDataProcessor;
 use Silverback\ApiComponentsBundle\Helper\User\UserMailer;
-use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\Response;
 
 /**
@@ -27,17 +25,21 @@
     public function __construct(
         private UserMailer $userMailer,
         private UserDataProcessor $userDataProcessor,
-        private Security $security,
     ) {
     }
 
-    public function __invoke(string $username, string $token): Response
+    public function __invoke(string $username): Response
     {
-        $user = $this->security->getUser();
-        if (!$user instanceof AbstractUser) {
-            return new Response(null, Response::HTTP_UNAUTHORIZED);
+        $user = $this->userDataProcessor->updateNewEmailToken($username);
+        if (!$user) {
+            $response = new Response(null, Response::HTTP_OK);
+            $response->setCache([
+                'private' => true,
+                's_maxage' => 0,
+                'max_age' => 0,
+            ]);
+            return $response;
         }
-        $this->userDataProcessor->setNewEmailConfirmationToken($user);
         $emailSuccess = $this->userMailer->sendChangeEmailConfirmationEmail($user);
 
         $response = new Response(null, $emailSuccess ? Response::HTTP_OK : Response::HTTP_SERVICE_UNAVAILABLE);

src/Helper/User/UserDataProcessor.php

@@ -39,12 +39,8 @@ public function __construct(
 
     public function updatePasswordConfirmationToken(string $usernameQuery): ?AbstractUser
     {
-        $user = $this->userRepository->loadUserByIdentifier($usernameQuery);
-        if (!$user) {
-            throw new InvalidArgumentException('Username not found');
-        }
-
-        if ($user->isPasswordRequestLimitReached($this->tokenTtl)) {
+        $user = $this->findUserByUsername($usernameQuery);
+        if (!$user || $user->isPasswordRequestLimitReached($this->tokenTtl)) {
             return null;
         }
 
@@ -107,13 +103,42 @@ public function processChanges(AbstractUser $user, ?AbstractUser $previousUser):
         }
     }
 
-    public function setNewEmailConfirmationToken(AbstractUser $user): void
+    private function findUserByUsername(string $usernameQuery): ?AbstractUser
+    {
+        $user = $this->userRepository->loadUserByIdentifier($usernameQuery);
+        if (!$user) {
+            throw new InvalidArgumentException('Username not found');
+        }
+        return $user;
+    }
+
+    public function updateNewEmailToken(string $usernameQuery): ?AbstractUser
+    {
+        $user = $this->findUserByUsername($usernameQuery);
+        if (!$user) {
+            return null;
+        }
+        $this->setNewEmailConfirmationToken($user);
+        return $user;
+    }
+
+    public function updateVerifyEmailToken(string $usernameQuery): ?AbstractUser
+    {
+        $user = $this->findUserByUsername($usernameQuery);
+        if (!$user) {
+            return null;
+        }
+        $this->setEmailAddressVerifyToken($user);
+        return $user;
+    }
+
+    private function setNewEmailConfirmationToken(AbstractUser $user): void
     {
         $user->setNewEmailConfirmationToken($this->passwordHasher->hashPassword($user, $token = TokenGenerator::generateToken()));
         $user->plainNewEmailConfirmationToken = $token;
     }
 
-    public function setEmailAddressVerifyToken(AbstractUser $user): void
+    private function setEmailAddressVerifyToken(AbstractUser $user): void
     {
         $user->setEmailAddressVerifyToken($this->passwordHasher->hashPassword($user, $token = TokenGenerator::generateToken()));
         $user->plainEmailAddressVerifyToken = $token;