Add self-service account management commands (delete, update username/email/password/profile)

web/backend/Features/Features.Auth/Commands/UpdateEmail/UpdateEmailCommand.cs

@@ -0,0 +1,14 @@
+using Features.Auth.Dtos;
+using MediatR;
+
+namespace Features.Auth.Commands.UpdateEmail;
+
+/// <summary>
+///     Changes the email address of the given user account. The account's <c>EmailConfirmed</c> status
+///     is reset to unconfirmed as a result.
+/// </summary>
+/// <param name="UserAccountId">
+///     The authenticated caller's own ID, extracted from the access token -- never bind this from
+///     client-supplied input.
+/// </param>
+public record UpdateEmailCommand(Guid UserAccountId, string NewEmail) : IRequest<UpdateEmailPayload>;

web/backend/Features/Features.Auth/Commands/UpdateEmail/UpdateEmailHandler.cs

@@ -0,0 +1,39 @@
+using Domain.Exceptions;
+using Features.Auth.Dtos;
+using Features.Auth.Identity;
+using MediatR;
+using Microsoft.AspNetCore.Identity;
+
+namespace Features.Auth.Commands.UpdateEmail;
+
+/// <summary>
+///     Handles <see cref="UpdateEmailCommand" /> via <see cref="UserManager{TUser}" />.
+///     <see cref="UserManager{TUser}.SetEmailAsync" /> also resets <c>EmailConfirmed</c> to
+///     <see langword="false" />, so the user must re-confirm the new address (see
+///     <c>Features.Auth.Commands.ResendConfirmationEmail</c>).
+/// </summary>
+public class UpdateEmailHandler(UserManager<ApplicationUser> userManager)
+    : IRequestHandler<UpdateEmailCommand, UpdateEmailPayload>
+{
+    /// <exception cref="NotFoundException">Thrown when the account does not exist.</exception>
+    /// <exception cref="ConflictException">Thrown when the requested email address is already in use.</exception>
+    public async Task<UpdateEmailPayload> Handle(
+        UpdateEmailCommand request,
+        CancellationToken cancellationToken
+    )
+    {
+        ApplicationUser user =
+            await userManager.FindByIdAsync(request.UserAccountId.ToString())
+            ?? throw new NotFoundException("User account not found");
+
+        IdentityResult result = await userManager.SetEmailAsync(user, request.NewEmail);
+        if (!result.Succeeded)
+        {
+            if (result.Errors.Any(e => e.Code == "DuplicateEmail"))
+                throw new ConflictException("Email address already exists");
+            throw new ConflictException(string.Join("; ", result.Errors.Select(e => e.Description)));
+        }
+
+        return new UpdateEmailPayload(user.Id, user.Email, user.EmailConfirmed);
+    }
+}

web/backend/Features/Features.Auth/Commands/UpdateEmail/UpdateEmailValidator.cs

@@ -0,0 +1,18 @@
+using FluentValidation;
+
+namespace Features.Auth.Commands.UpdateEmail;
+
+/// <summary>Validates <see cref="UpdateEmailCommand" />, mirroring the email rules in <c>RegisterUserValidator</c>.</summary>
+public class UpdateEmailValidator : AbstractValidator<UpdateEmailCommand>
+{
+    public UpdateEmailValidator()
+    {
+        RuleFor(x => x.NewEmail)
+            .NotEmpty()
+            .WithMessage("Email is required")
+            .EmailAddress()
+            .WithMessage("Invalid email format")
+            .MaximumLength(128)
+            .WithMessage("Email cannot exceed 128 characters");
+    }
+}