IdentityApiEndpointRouteBuilderExtensions should not create the ConfirmationLink

[JJong-nl]

The IdentityApiEndpointRouteBuilderExtensions should never create a ConfirmationLink but must be dealing with codes only.

When we see the implementation of IEmailSender<TUser>
We see SendConfirmationLinkAsync, SendPasswordResetCodeAsync and SendPasswordResetLinkAsync

Here the SendPasswordResetLinkAsync and the SendConfirmationLinkAsync should be removed and a SendConfirmationCodeAsync should be added.

The SendPasswordResetCodeAsync is used in the ApiEndpoint but SendPasswordResetLinkAsync is never used in the Api.
Only in the UI implementation.

When we want to generate a link instead of using the code, we should generating the link inside the IEmailSender<TUser> implementation.

So only SendConfirmationCodeAsync and SendPasswordResetCodeAsync sould be sufficient in the IEmailSender<TUser> interface

IdentityApiEndpointRouteBuilderExtensions.cs

aspnetcore/src/Identity/Core/src/IdentityApiEndpointRouteBuilderExtensions.cs

Lines 214 to 217 in 65f485e

	var code = await userManager.GeneratePasswordResetTokenAsync(user);
	code = WebEncoders.Base64UrlEncode(Encoding.UTF8.GetBytes(code));
	await emailSender.SendPasswordResetCodeAsync(user, resetRequest.Email, HtmlEncoder.Default.Encode(code));

ForgotPassword.cshtml.cs

aspnetcore/src/Identity/UI/src/Areas/Identity/Pages/V5/Account/ForgotPassword.cshtml.cs

Lines 75 to 83 in 65f485e

	var code = await _userManager.GeneratePasswordResetTokenAsync(user);
	code = WebEncoders.Base64UrlEncode(Encoding.UTF8.GetBytes(code));
	var callbackUrl = Url.Page(
	"/Account/ResetPassword",
	pageHandler: null,
	values: new { area = "Identity", code },
	protocol: Request.Scheme)!;
	await _emailSender.SendPasswordResetLinkAsync(user, Input.Email, HtmlEncoder.Default.Encode(callbackUrl));

The ForgotPassword.cshtml.cs should also be using the SendPasswordResetCodeAsync inside the implementation of the emailsender we sould generate the callbackUrl.

[JJong-nl]

Maybe,
Rename the IEmailSender<TUser> to the following

public interface IIdentityCoreEventHandler<TUser> where TUser : class
{
    Task UserLogedInAsync(TUser user);
    Task UserLogedOutAsync(TUser user);
    Task EmailConfirmedAsync(TUser user);
    Task EmailChangedAsync(TUser user, string oldEmail, string newEmail);
    Task PasswordChangedAsync(TUser user, string oldPassword, string newPassword);
    Task EmailChangedAsync(TUser user, string oldEmail, string newEmail);
    Task SendConfirmationCodeAsync(TUser user, string email, string confirmationCode);
    Task SendPasswordResetCodeAsync(TUser user, string email, string resetCode);
    . . .
}