Expose UserManager<T>.GetChangeEmailTokenPurpose()

[lonix1]

UserManager In 2.1 exposed the "purpose" constants, eg. ConfirmEmailTokenPurpose.

We relied on this in order to use userManager.VerifyUserTokenAsync().

Now those constants are gone, and there is a GetChangeEmailTokenPurpose() method in its place, which is protected.

Please make it public, otherwise the verify function is unusable.

(Subclassing just adds an unnecessary mess as this class already conceals a lot of complexity and should be usable as is.)

[blowdart]

@HaoK another breaking change?

[lonix1]

To be consistent, consider:

Changing GetChangeEmailTokenPurpose() (and related) to public.

OR, changing VerifyUserTokenAsync() to protected, because it becomes useless anyways.

[HaoK]

No the constants are still there, see: https://github.com/aspnet/AspNetCore/blob/master/src/Identity/Extensions.Core/src/UserManager.cs#L39

[lonix1]

It doesn't work when trying to change email, because now it uses GetChangeEmailTokenPurpose, which is protected. (Could be other uses cases too, haven't checked.)

And as you can see, it was changed to "ChangeEmail:" + newEmail, so the constant you linked is dead code.

It is used here and here.

[HaoK]

Ok, that seems safe enough to expose in the future.

So you can just call VerifyUserTokenAsync with "ChangeEmail:" + newEmail as the purpose in the short term.

But there's no breaking change here

[HaoK]

Something for the backlog / future @blowdart

[lonix1]

Thanks for looking into this.

I've opted to subclass instead, to avoid magic strings (as shown by this issue, it's a bad idea to rely on magic strings 😄).

For anyone else migrating code to 2.2, note that if you subclass, it's important not to register the subclass with the container, but to replace the default during init:

services
.AddIdentityCore<User>()
.AddUserManager<MyUserManager<User>>()    // <--- the magic

And then it's as easy as this:

public async Task<bool> ValidateEmailChangeToken(TUser user, string newEmail, string token) {
  return await VerifyUserTokenAsync(
    user,
    Options.Tokens.ChangeEmailTokenProvider,
    GetChangeEmailTokenPurpose(newEmail),
    token
  );
}