[Identity] 3.0 user confirmation flow improvements

[HaoK]

• Add a new explicit step after registration for confirming your account (default behavior will continue to have light up based on email sender / or add a button to simulate confirming with some text pointing to a a doc), will most likely introduce some kind of new IUserConfirmer that will be responsible for encapsulating the confirmation logic (and understand the existing requireConfirmedEmail)

• Add a specific change email flow instead of allowing Email to be automatically updated via Manage page (this new UI basically be similar to a reset password link, some UI to send change email linke, then they come back to some UI after clicking link and confirm it to actually update)

Related issues that this will address: #6568 #5409 #5749 #5751 #5747
#5718

@ajcvickers @blowdart

[Ponant]

Hi @HaoK , the second option is great but for the first one I will not introduce another interface as this will make things more rigid. I do not see the advantage of it at all. For the confirmation flow I would just dump a file and show it on the next view for the dev purposes; there is enough docs on sendgrid etc for a real email sending. Something like this

    public class FileIOEmailSender : IEmailSender
    {
        public Task SendEmailAsync(string email, string subject, string htmlMessage)
        {
            var path = Path.GetFullPath(Path.Combine(AppContext.BaseDirectory, "..\\..\\..\\..\\"))
             + "EmailMessage.html";

            File.WriteAllTextAsync(path, htmlMessage);
            return Task.CompletedTask;
        }
    }

then redirect to view after registration "confirm your email block by copy paste of the following path in browser".

I would also extend the ISender interface to include another parameter
Task SendEmailAsync(string email, string subject, string htmlMessage, string reason = null)
The reason string is useful when dealing with custom tokens.

One issue with email confirmation is the possibility of bots automation and also the consideration that the user wouldn't be able to login until the email is confirmed. So if user did not receive the email or the timespan elapsed then he is stuck. So I do not know at which point you want the template to stop....

Cheers

[HaoK]

#8577