Stop an unconfirmed Boilerplate account from keeping a password its owner never set (#13863)

[yasmoradi]

closes #13863

An unconfirmed account's password now belongs to whoever last asks for its confirmation. Signing up or signing in with a password sets the password they typed, while asking for a code or magic link, or signing in with an external provider, removes it. The password is set through the store, so the confirmation code already sent stays valid.

Sign up, and the automatic sign up on sign in, accept only one of email or phone number, so nobody can attach their own phone number to someone else's email and confirm it.

New integration tests cover the owner's sign up replacing an earlier password, the owner's code request removing it, a normal sign up keeping it, and sign up refusing both identifiers.

Summary by CodeRabbit

• Bug Fixes
  • Signup now requires exactly one identifier: an email address or phone number.
  • Passwords for unconfirmed accounts are updated or cleared when the account owner signs up, signs in, requests a one-time code, or continues through external sign-in. Password validation is applied when a password is provided.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b8297bb9-c6a4-4467-935b-353946450fee

📥 Commits

Reviewing files that changed from the base of the PR and between ba3ee2b and 383c455.

📒 Files selected for processing: 6

• src/Templates/Boilerplate/Bit.Boilerplate/.template.config/template.json
• src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/Extensions/UserManagerExtensions.cs
• src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.ExternalSignIn.cs
• src/Templates/Boilerplate/Bit.Boilerplate/src/Server/Boilerplate.Server.Api/Features/Identity/IdentityController.cs
• src/Templates/Boilerplate/Bit.Boilerplate/src/Shared/Features/Identity/Dtos/SignUpRequestDto.cs
• src/Templates/Boilerplate/Bit.Boilerplate/src/Tests/Features/Identity/UnconfirmedAccountPasswordTests.cs

+----------------------------------------------------------------------+
| I am here to kick bugs and chew carrots. And I'm all out of carrots. |
+----------------------------------------------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}