public async Task <IActionResult> UpdateUser(string id, [FromBody] UserEditDto user)
{
if (user == null)
{
return(InvalidRequestBodyJson(nameof(UserEditDto)));
}
if (!string.IsNullOrWhiteSpace(user.Id) && id != user.Id)
{
return(BadRequest("Conflicting user id in URL and model data"));
}
ApplicationUser appUser = await _accountManager.GetUserByIdAsync(id);
if (null == appUser)
{
return(NotFound());
}
Guid[] currentRoleIds = appUser != null ? (await _accountManager.GetUserRoleIdsAsync(appUser)).ToArray() : null;
await _accessChecker.ValidateAccessToEntityAsync(appUser, EntityAction.Update);
var manageUsersPolicyResult = _authorizationService.AuthorizeAsync(
User, appUser, UserAccountAuthorizationRequirements.Update);
var assignRolePolicyResult = _authorizationService.AuthorizeAsync(
User,
new UserRoleChange {
NewRoles = user.Roles?.Select(r => Guid.Parse(r.Id)).ToArray(), CurrentRoles = currentRoleIds
},
Policies.AssignAllowedRolesPolicy);
if ((await Task.WhenAll(manageUsersPolicyResult, assignRolePolicyResult)).Any(r => !r.Succeeded))
{
return(Forbid());
}
if (!ModelState.IsValid)
{
return(BadRequest(ModelState));
}
if (appUser == null)
{
return(NotFound(id));
}
var currentUserId = this.User.GetUserId();
if (currentUserId == id && string.IsNullOrWhiteSpace(user.CurrentPassword))
{
if (!string.IsNullOrWhiteSpace(user.NewPassword))
{
return(BadRequest("Current password is required when changing your own password"));
}
if (appUser.UserName != user.UserName)
{
return(BadRequest("Current password is required when changing your own username"));
}
}
if (currentUserId == id && (appUser.UserName != user.UserName || !string.IsNullOrWhiteSpace(user.NewPassword)))
{
if (!await _accountManager.CheckPasswordAsync(appUser, user.CurrentPassword))
{
AddErrors(new string[] { "The username/password couple is invalid." });
return(BadRequest(ModelState));
}
}
_mapper.Map <UserDto, ApplicationUser>(user, appUser);
await _accountManager.UpdateUserAsync(appUser, user.Roles.Select(r => Guid.Parse(r.Id)));
if (!string.IsNullOrWhiteSpace(user.NewPassword))
{
if (!string.IsNullOrWhiteSpace(user.CurrentPassword))
{
await _accountManager.UpdatePasswordAsync(appUser, user.CurrentPassword, user.NewPassword);
}
else
{
await _accountManager.ResetPasswordAsync(appUser, user.NewPassword);
}
}
return(NoContent());
}
