Email account owner off changes in their account

SS14.Web/Areas/Identity/Pages/Account/ConfirmEmailChange.cshtml.cs

@@ -2,13 +2,15 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Text;
+using System.Text.Encodings.Web;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.RazorPages;
 using Microsoft.AspNetCore.WebUtilities;
 using SS14.Auth.Shared.Data;
+using SS14.Auth.Shared.Emails;
 
 namespace SS14.Web.Areas.Identity.Pages.Account;
 
@@ -17,17 +19,20 @@ public class ConfirmEmailChangeModel : PageModel
 {
     private readonly SpaceUserManager _userManager;
     private readonly SignInManager<SpaceUser> _signInManager;
+    private readonly IEmailSender _emailSender;
     private readonly ApplicationDbContext _dbContext;
     private readonly AccountLogManager _accountLogManager;
 
     public ConfirmEmailChangeModel(
         SpaceUserManager userManager,
         SignInManager<SpaceUser> signInManager,
+        IEmailSender emailSender,
         ApplicationDbContext dbContext,
         AccountLogManager accountLogManager)
     {
         _userManager = userManager;
         _signInManager = signInManager;
+        _emailSender = emailSender;
         _dbContext = dbContext;
         _accountLogManager = accountLogManager;
     }
@@ -68,6 +73,13 @@ await _accountLogManager.LogAndSave(
 
         await _signInManager.RefreshSignInAsync(user);
         StatusMessage = "Thank you for confirming your email change.";
+
+        await _emailSender.SendEmailAsync(
+            oldEmail,
+            "Your Space Station 14 account email was changed",
+            $"This email was sent to the old email address for security, if this was you feel free to ignore this email." +
+            $"\n\nFurther emails from this point forward will go to {email}." +
+            $"\n\nIf this was not you, send an email to support@spacestation14.com immediately.");
         return Page();
     }
-}
+}

SS14.Web/Areas/Identity/Pages/Account/Manage/ChangePassword.cshtml.cs

@@ -8,6 +8,7 @@
 using Microsoft.AspNetCore.Mvc.RazorPages;
 using Microsoft.Extensions.Logging;
 using SS14.Auth.Shared.Data;
+using SS14.Auth.Shared.Emails;
 using SS14.Auth.Shared.Sessions;
 
 namespace SS14.Web.Areas.Identity.Pages.Account.Manage;
@@ -18,17 +19,20 @@ public class ChangePasswordModel : PageModel
     private readonly SessionManager _sessionManager;
     private readonly AccountLogManager _logManager;
     private readonly SignInManager<SpaceUser> _signInManager;
+    private readonly IEmailSender _emailSender;
     private readonly ILogger<ChangePasswordModel> _logger;
 
     public ChangePasswordModel(
         UserManager<SpaceUser> userManager,
         SignInManager<SpaceUser> signInManager,
+        IEmailSender emailSender,
         ILogger<ChangePasswordModel> logger,
         SessionManager sessionManager,
         AccountLogManager logManager)
     {
         _userManager = userManager;
         _signInManager = signInManager;
+        _emailSender = emailSender;
         _logger = logger;
         _sessionManager = sessionManager;
         _logManager = logManager;
@@ -105,6 +109,12 @@ public async Task<IActionResult> OnPostAsync()
         _logger.LogInformation("User changed their password successfully.");
         StatusMessage = "Your password has been changed.";
 
+        var userEmail = await _userManager.GetEmailAsync(user);
+        await _emailSender.SendEmailAsync(userEmail,
+            "Your Space Station 14 account password was changed",
+            $"This email was sent to you to confirm your password change. If this was you feel free to ignore this email." +
+            $"\n\nIf this was not you, send an email to support@spacestation14.com immediately.");
+
         return RedirectToPage();
     }
 }

SS14.Web/Areas/Identity/Pages/Account/Manage/Disable2fa.cshtml.cs

@@ -7,26 +7,30 @@
 using Microsoft.AspNetCore.Mvc.RazorPages;
 using Microsoft.Extensions.Logging;
 using SS14.Auth.Shared.Data;
+using SS14.Auth.Shared.Emails;
 
 namespace SS14.Web.Areas.Identity.Pages.Account.Manage;
 
 public class Disable2faModel : PageModel
 {
     private readonly SpaceUserManager _userManager;
     private readonly SignInManager<SpaceUser> _signInManager;
+    private readonly IEmailSender _emailSender;
     private readonly ILogger<Disable2faModel> _logger;
     private readonly ApplicationDbContext _dbContext;
     private readonly AccountLogManager _accountLogManager;
 
     public Disable2faModel(
         SpaceUserManager userManager,
         SignInManager<SpaceUser> signInManager,
+        IEmailSender emailSender,
         ILogger<Disable2faModel> logger,
         ApplicationDbContext dbContext,
         AccountLogManager accountLogManager)
     {
         _userManager = userManager;
         _signInManager = signInManager;
+        _emailSender = emailSender;
         _logger = logger;
         _dbContext = dbContext;
         _accountLogManager = accountLogManager;
@@ -70,11 +74,18 @@ public async Task<IActionResult> OnPostAsync()
         }
 
         await tx.CommitAsync();
-        
+
         await _signInManager.RefreshSignInAsync(user);
-        
+
         _logger.LogInformation("User with ID '{UserId}' has disabled 2FA.", _userManager.GetUserId(User));
         StatusMessage = "2FA has been disabled. You can re-enable 2FA when you setup an authenticator app";
+
+        var userEmail = await _userManager.GetEmailAsync(user);
+        await _emailSender.SendEmailAsync(userEmail,
+            "Your Space Station 14 account 2fa was disabled",
+            $"This email was sent to you to confirm that 2fa has been disabled on your account. If this was you feel free to ignore this email." +
+            $"\n\nIf this was not you, send an email to support@spacestation14.com immediately.");
+
         return RedirectToPage("./TwoFactorAuthentication");
     }
-}
+}

SS14.Web/Areas/Identity/Pages/Account/Manage/EnableAuthenticator.cshtml.cs

@@ -11,6 +11,7 @@
 using Microsoft.AspNetCore.Mvc.RazorPages;
 using Microsoft.Extensions.Logging;
 using SS14.Auth.Shared.Data;
+using SS14.Auth.Shared.Emails;
 
 namespace SS14.Web.Areas.Identity.Pages.Account.Manage;
 
@@ -20,6 +21,7 @@ public class EnableAuthenticatorModel : PageModel
     private readonly ILogger<EnableAuthenticatorModel> _logger;
     private readonly UrlEncoder _urlEncoder;
     private readonly SignInManager<SpaceUser> _signInManager;
+    private readonly IEmailSender _emailSender;
     private readonly ApplicationDbContext _dbContext;
     private readonly AccountLogManager _accountLogManager;
 
@@ -28,6 +30,7 @@ public class EnableAuthenticatorModel : PageModel
     public EnableAuthenticatorModel(
         SpaceUserManager userManager,
         ILogger<EnableAuthenticatorModel> logger,
+        IEmailSender emailSender,
         UrlEncoder urlEncoder,
         SignInManager<SpaceUser> signInManager,
         ApplicationDbContext dbContext,
@@ -37,6 +40,7 @@ public EnableAuthenticatorModel(
         _logger = logger;
         _urlEncoder = urlEncoder;
         _signInManager = signInManager;
+        _emailSender = emailSender;
         _dbContext = dbContext;
         _accountLogManager = accountLogManager;
     }
@@ -91,7 +95,7 @@ public async Task<IActionResult> OnPostAsync()
         }
 
         await using var tx = await _dbContext.Database.BeginTransactionAsync();
-        
+
         // Strip spaces and hypens
         var verificationCode = Input.Code.Replace(" ", string.Empty).Replace("-", string.Empty);
 
@@ -110,15 +114,22 @@ public async Task<IActionResult> OnPostAsync()
         await _userManager.SetTwoFactorEnabledAsync(user, true);
         var userId = await _userManager.GetUserIdAsync(user);
         _logger.LogInformation("User with ID '{UserId}' has enabled 2FA with an authenticator app.", userId);
-        
+
         StatusMessage = "Your authenticator app has been verified.";
         await _signInManager.RefreshSignInAsync(user);
 
+        var userEmail = await _userManager.GetEmailAsync(user);
+        await _emailSender.SendEmailAsync(userEmail,
+            "Your Space Station 14 account 2fa was enabled",
+            $"This email was sent to you to confirm that 2fa has been enabled on your account. If this was you feel free to ignore this email." +
+            $"(And make sure you wrote down your recovery codes)" +
+            $"\n\nIf this was not you, send an email to support@spacestation14.com immediately.");
+
         if (await _userManager.CountRecoveryCodesAsync(user) == 0)
         {
             var recoveryCodes = await _userManager.GenerateNewTwoFactorRecoveryCodesAsync(user, 10);
             RecoveryCodes = recoveryCodes.ToArray();
-        
+
             await tx.CommitAsync();
             return RedirectToPage("./ShowRecoveryCodes");
         }
@@ -137,7 +148,7 @@ private async Task LoadSharedKeyAndQrCodeUriAsync(SpaceUser user)
         {
             await _userManager.ResetAuthenticatorKeyAsync(user);
             unformattedKey = await _userManager.GetAuthenticatorKeyAsync(user);
-            
+
             await _signInManager.RefreshSignInAsync(user);
         }
 
@@ -171,4 +182,4 @@ private string GenerateQrCodeUri(string userName, string unformattedKey)
             _urlEncoder.Encode(userName),
             unformattedKey);
     }
-}
+}

SS14.Web/Areas/Identity/Pages/Account/Manage/GenerateRecoveryCodes.cshtml.cs

@@ -5,23 +5,27 @@
 using Microsoft.AspNetCore.Mvc.RazorPages;
 using Microsoft.Extensions.Logging;
 using SS14.Auth.Shared.Data;
+using SS14.Auth.Shared.Emails;
 
 namespace SS14.Web.Areas.Identity.Pages.Account.Manage;
 
 public class GenerateRecoveryCodesModel : PageModel
 {
     private readonly SpaceUserManager _userManager;
+    private readonly IEmailSender _emailSender;
     private readonly ApplicationDbContext _dbContext;
     private readonly ILogger<GenerateRecoveryCodesModel> _logger;
     private readonly AccountLogManager _accountLogManager;
 
     public GenerateRecoveryCodesModel(
         SpaceUserManager userManager,
+        IEmailSender emailSender,
         ApplicationDbContext dbContext,
         ILogger<GenerateRecoveryCodesModel> logger,
         AccountLogManager accountLogManager)
     {
         _userManager = userManager;
+        _emailSender = emailSender;
         _dbContext = dbContext;
         _logger = logger;
         _accountLogManager = accountLogManager;
@@ -71,14 +75,21 @@ public async Task<IActionResult> OnPostAsync()
         await _accountLogManager.LogAndSave(user, new AccountLogRecoveryCodesGenerated());
 
         await _userManager.UpdateAsync(user);
-        
+
         var recoveryCodes = await _userManager.GenerateNewTwoFactorRecoveryCodesAsync(user, 10);
         RecoveryCodes = recoveryCodes.ToArray();
 
         await tx.CommitAsync();
-        
+
         _logger.LogInformation("User with ID '{UserId}' has generated new 2FA recovery codes.", userId);
         StatusMessage = "You have generated new recovery codes.";
+
+        var userEmail = await _userManager.GetEmailAsync(user);
+        await _emailSender.SendEmailAsync(userEmail,
+            "Your Space Station 14 account 2fa recovery codes were regenerated",
+            $"This email was sent to you to confirm that 2fa recovery codes have been regenerated on your account. If this was you feel free to ignore this email." +
+            $"\n\nIf this was not you, send an email to support@spacestation14.com immediately.");
+
         return RedirectToPage("./ShowRecoveryCodes");
     }
-}
+}

SS14.Web/Areas/Identity/Pages/Account/Manage/Index.cshtml.cs

@@ -5,13 +5,15 @@
 using Microsoft.AspNetCore.Mvc.RazorPages;
 using Microsoft.Extensions.Options;
 using SS14.Auth.Shared.Data;
+using SS14.Auth.Shared.Emails;
 
 namespace SS14.Web.Areas.Identity.Pages.Account.Manage;
 
 public partial class IndexModel : PageModel
 {
     private readonly SpaceUserManager _userManager;
     private readonly SignInManager<SpaceUser> _signInManager;
+    private readonly IEmailSender _emailSender;
     private readonly IOptions<AccountOptions> _options;
     private readonly ApplicationDbContext _dbContext;
     private readonly AccountLogManager _accountLogManager;
@@ -22,13 +24,15 @@ public partial class IndexModel : PageModel
 
     public IndexModel(
         SpaceUserManager userManager,
-        SignInManager<SpaceUser> signInManager, 
+        SignInManager<SpaceUser> signInManager,
+        IEmailSender emailSender,
         IOptions<AccountOptions> options,
         ApplicationDbContext dbContext,
         AccountLogManager accountLogManager)
     {
         _userManager = userManager;
         _signInManager = signInManager;
+        _emailSender = emailSender;
         _options = options;
         _dbContext = dbContext;
         _accountLogManager = accountLogManager;
@@ -88,13 +92,13 @@ public async Task<IActionResult> OnPostUsernameAsync()
             await LoadAsync(user);
             return Page();
         }
-        
+
         Username = Username.Trim();
         if (Username == user.UserName)
         {
             return RedirectToPage();
         }
-        
+
         UpdateCanEditUsername(user);
         if (!CanEditUsername)
         {
@@ -107,7 +111,7 @@ public async Task<IActionResult> OnPostUsernameAsync()
         await using var tx = await _dbContext.Database.BeginTransactionAsync();
 
         var result = await _userManager.SetUserNameAsync(user, Username);
-        
+
         if (!result.Succeeded)
         {
             foreach (var error in result.Errors)
@@ -118,17 +122,24 @@ public async Task<IActionResult> OnPostUsernameAsync()
             await LoadAsync(user);
             return Page();
         }
-        
+
         user.LastUsernameChange = DateTime.UtcNow;
 
         await _accountLogManager.LogNameChanged(user, oldName, user.UserName);
 
         await _signInManager.RefreshSignInAsync(user);
         StatusMessage = "Your username has been changed. Note that it may take some time to visibly update in some places, such as the launcher.";
-        
+
         await _dbContext.SaveChangesAsync();
         await tx.CommitAsync();
 
+        var userEmail = await _userManager.GetEmailAsync(user);
+        await _emailSender.SendEmailAsync(userEmail,
+            "Your Space Station 14 account username was changed",
+            $"This email was sent to you to confirm your username change, you were known as {oldName} but from now on will be known as {user.UserName}. " +
+            $"If this was you feel free to ignore this email." +
+            $"\n\nIf this was not you, send an email to support@spacestation14.com immediately.");
+
         return RedirectToPage();
     }
-}
+}