From fb465ab226e1f3a69b686e0414562c98307d12a5 Mon Sep 17 00:00:00 2001
From: Hamid Reza Mohammadi <mohammadi.hr@gmail.com>
Date: Fri, 14 May 2021 09:54:54 +0430
Subject: [PATCH] #115 controlling signup process

---
 RMuseum/Startup.cs                            |  2 +-
 .../Controllers/AppUserControllerBase.cs      | 39 +++++++++++++------
 RSecurityBackend/RSecurityBackend.xml         | 10 +++++
 .../Services/Implementation/AppUserService.cs | 36 ++++++++++++-----
 4 files changed, 66 insertions(+), 21 deletions(-)

diff --git a/RMuseum/Startup.cs b/RMuseum/Startup.cs
index 0f06ed01..4552cf89 100644
--- a/RMuseum/Startup.cs
+++ b/RMuseum/Startup.cs
@@ -56,7 +56,7 @@ namespace RMuseum
                     builder => builder.SetIsOriginAllowed(_ => true)
                     .AllowAnyMethod()
                     .AllowAnyHeader()
-                    .WithExposedHeaders("paging-headers", "audio-upload-enabled")
+                    .WithExposedHeaders("paging-headers", "audio-upload-enabled", "signup-verified")
                     .AllowCredentials()
                     );
             });
diff --git a/RSecurityBackend/Controllers/AppUserControllerBase.cs b/RSecurityBackend/Controllers/AppUserControllerBase.cs
index 5ce6f09e..56a17e62 100644
--- a/RSecurityBackend/Controllers/AppUserControllerBase.cs
+++ b/RSecurityBackend/Controllers/AppUserControllerBase.cs
@@ -4,6 +4,7 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Identity.UI.Services;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Configuration;
+using Newtonsoft.Json;
 using RSecurityBackend.Models.Auth.Db;
 using RSecurityBackend.Models.Auth.Memory;
 using RSecurityBackend.Models.Auth.ViewModels;
@@ -825,20 +826,25 @@ namespace RSecurityBackend.Controllers
                 return BadRequest(res.ExceptionString);
             }
 
-            try
+            if(VerifyEmailOnSignUp)
             {
-                await _emailSender.SendEmailAsync
-                    (
-                    signUpViewModel.Email,
-                    GetSignUpEmailSubject(res.Result.Secret),
-                    GetSignUpEmailHtmlContent(res.Result.Secret, signUpViewModel.CallbackUrl)
-                    );
-            }
-            catch (Exception exp)
-            {
-                return BadRequest("Error sending email: " + exp.ToString());
+                try
+                {
+                    await _emailSender.SendEmailAsync
+                        (
+                        signUpViewModel.Email,
+                        GetSignUpEmailSubject(res.Result.Secret),
+                        GetSignUpEmailHtmlContent(res.Result.Secret, signUpViewModel.CallbackUrl)
+                        );
+                }
+                catch (Exception exp)
+                {
+                    return BadRequest("Error sending email: " + exp.ToString());
+                }
             }
 
+            HttpContext.Response.Headers.Add("signup-verified", JsonConvert.SerializeObject(!VerifyEmailOnSignUp));
+
             return Ok(true);
         }
 
@@ -996,6 +1002,17 @@ namespace RSecurityBackend.Controllers
             }
         }
 
+        /// <summary>
+        /// verify email on signup
+        /// </summary>
+        public bool VerifyEmailOnSignUp
+        {
+            get
+            {
+                return bool.Parse(Configuration.GetSection("SignUp")["VerifyEmail"]);
+            }
+        }
+
         /// <summary>
         /// reset password
         /// </summary>
diff --git a/RSecurityBackend/RSecurityBackend.xml b/RSecurityBackend/RSecurityBackend.xml
index bd1cb425..8d909939 100644
--- a/RSecurityBackend/RSecurityBackend.xml
+++ b/RSecurityBackend/RSecurityBackend.xml
@@ -275,6 +275,11 @@
             </summary>
             <returns></returns>
         </member>
+        <member name="P:RSecurityBackend.Controllers.AppUserControllerBase.VerifyEmailOnSignUp">
+            <summary>
+            verify email on signup
+            </summary>
+        </member>
         <member name="M:RSecurityBackend.Controllers.AppUserControllerBase.ResetPassword(RSecurityBackend.Models.Auth.ViewModels.ResetPasswordViewModel)">
             <summary>
             reset password
@@ -2687,6 +2692,11 @@
             <param name="secret"></param>
             <returns>associated email</returns>
         </member>
+        <member name="P:RSecurityBackend.Services.Implementation.AppUserService.VerifyEmailOnSignUp">
+            <summary>
+            verify email on signup
+            </summary>
+        </member>
         <member name="M:RSecurityBackend.Services.Implementation.AppUserService.FinalizeSignUp(System.String,System.String,System.String,System.String,System.String)">
             <summary>
             finalize signup process using email
diff --git a/RSecurityBackend/Services/Implementation/AppUserService.cs b/RSecurityBackend/Services/Implementation/AppUserService.cs
index 5749f067..360c6829 100644
--- a/RSecurityBackend/Services/Implementation/AppUserService.cs
+++ b/RSecurityBackend/Services/Implementation/AppUserService.cs
@@ -1188,6 +1188,17 @@ namespace RSecurityBackend.Services.Implementation
             }
         }
 
+        /// <summary>
+        /// verify email on signup
+        /// </summary>
+        public bool VerifyEmailOnSignUp
+        {
+            get
+            {
+                return bool.Parse(Configuration.GetSection("SignUp")["VerifyEmail"]);
+            }
+        }
+
         /// <summary>
         /// finalize signup process using email
         /// </summary>
@@ -1214,13 +1225,18 @@ namespace RSecurityBackend.Services.Implementation
                     return new RServiceResult<bool>(false, "این نام کاربری قبلا استفاده شده است");
                 }
 
-                if(
-                    email
-                    !=
-                    (await RetrieveEmailFromQueueSecret(RVerifyQueueType.SignUp, secret)).Result
-                 )
+                bool verify = VerifyEmailOnSignUp;
+
+                if (verify)
                 {
-                    return new RServiceResult<bool>(false, "کلمه عبور اشتباه وارد شده است");
+                    if (
+                        email
+                        !=
+                        (await RetrieveEmailFromQueueSecret(RVerifyQueueType.SignUp, secret)).Result
+                       )
+                    {
+                        return new RServiceResult<bool>(false, "کد ارسالی به ایمیل اشتباه وارد شده است");
+                    }
                 }
 
                 secret = secret.Trim();
@@ -1251,9 +1267,11 @@ namespace RSecurityBackend.Services.Implementation
                 {
                     return new RServiceResult<bool>(false, userAddResult.ExceptionString);
                 }
-
-                userAddResult.Result.EmailConfirmed = true;
-                await _userManager.UpdateAsync(userAddResult.Result);
+                if(verify)
+                {
+                    userAddResult.Result.EmailConfirmed = true;
+                    await _userManager.UpdateAsync(userAddResult.Result);
+                }
 
                 RVerifyQueueItem[] failedQueue = await _context.VerifyQueueItems.Where(i => i.Email == email && i.Secret != secret && i.QueueType == RVerifyQueueType.SignUp).ToArrayAsync();
                 if(failedQueue.Length != 0)