API Controller to create, update or delete a User with CustomUserSettings, and assign a Role

[MarGraz]

Hi Everyone,

I'm trying to create an ApiController to create, read, update, or delete users. This controller will be used in my Orchard Core microservice that will act as an SSO (Single Sign-On) platform. I've already configured the OpenId module and set up the Client Credentials Flow to call my new SSO ApiController in a secure way.

Now, I took inspiration from this discussion to create a User that also has a Content Type called UserDetails, which works with the stereotype CustomUserSettings and contains extra information. In my ApiController, I want to create this user with the custom settings, and additionally, I want to assign a Role that already exists in Orchard Core, which I will receive in the payload.

I saw that the UserManager should be enough to create the user and assign a role, but I want to ensure I'm doing it right.

I have created a handler, and the create user API endpoint will call this handler method, you can see it below.

Questions:

1. What do you think about the code I wrote?
2. If I set EmailConfirmed to false, will the user automatically receive an email to confirm their email address? Or do I need to create a Workflow to verify the user email?

 public class UserHandler : IUserHandler
{
    private readonly IContentManager _contentManager;
    private readonly UserManager<IUser> _userManager;
    private readonly ILogger<UserHandler> _logger;

    public UserHandler(IContentManager contentManager, UserManager<IUser> userManager, ILogger<UserHandler> logger)
    {
        _contentManager = contentManager;
        _userManager = userManager;
        _logger = logger;
    }

    public async Task<UserApiModel> CreateUserAsync(UserApiModel userApiModel)
    {
        // Check if a user with the provided email already exists
        IUser? existingUser = await _userManager.FindByEmailAsync(userApiModel.Email);
        if (existingUser != null)
        {
            throw new InvalidOperationException("User with this email already exists.");
        }

        // Ensure there is at least one role specified
        if (userApiModel.RoleNames == null || !userApiModel.RoleNames.Any())
        {
            throw new InvalidOperationException("At least one role must be specified.");
        }

        // Create a new user
        User user = new User
        {
            UserName = userApiModel.UserName,
            Email = userApiModel.Email,
            EmailConfirmed = true, // If set to false?
            IsEnabled = userApiModel.IsEnabled,
            TwoFactorEnabled = userApiModel.TwoFactorEnabled,
            IsLockoutEnabled = userApiModel.IsLockoutEnabled
        };

        // Create the user in the UserManager
        IdentityResult userCreateResult = await _userManager.CreateAsync(user);
        if (!userCreateResult.Succeeded)
        {
            throw new InvalidOperationException("Failed to create user.");
        }

        // Assign roles to the user
        IdentityResult roleResult = await _userManager.AddToRolesAsync(user, userApiModel.RoleNames);
        if (!roleResult.Succeeded)
        {
            // Fail rollback
            await _userManager.DeleteAsync(user);
            throw new InvalidOperationException($"Failed to add user to roles: {string.Join(", ", roleResult.Errors.Select(e => e.Description))}");
        }

        // Create a new content item for the user details
        ContentItem userDetailsContentItem = await _contentManager.NewAsync("UserDetails");
        userDetailsContentItem.Published = true;
        userDetailsContentItem.Latest = true;
        userDetailsContentItem.PublishedUtc = DateTime.UtcNow;
        userDetailsContentItem.ModifiedUtc = DateTime.UtcNow;
        userDetailsContentItem.ContentItemVersionId = Guid.NewGuid().ToString();
        
        userDetailsContentItem.Weld("UserDetails", new UserDetails());

        await userDetailsContentItem.AlterAsync<UserDetails>(async userDetailsPart =>
        {
            userDetailsPart.Name = userApiModel.UserDetails.Name;
            userDetailsPart.Surname = userApiModel.UserDetails.Surname;
            userDetailsPart.Phone = userApiModel.UserDetails.Phone;
            userDetailsPart.WhatsApp = userApiModel.UserDetails.WhatsApp;
            userDetailsPart.Street = userApiModel.UserDetails.Street;
            userDetailsPart.StreetNumber = userApiModel.UserDetails.StreetNumber;
            userDetailsPart.City = userApiModel.UserDetails.City;
        });

        // Add the user details content item
        user.Properties.Add("UserDetails", JObject.FromObject(userDetailsContentItem));

        // Update the user with the details information
        IdentityResult updateResult = await _userManager.UpdateAsync(user);
        if (!updateResult.Succeeded)
        {
            throw new InvalidOperationException("Failed to update user with details information.");
        }

        // Populate the ContentItemId and DocumentId from the created user details
            userApiModel.Id = user.Id.ToString();
            userApiModel.UserId = user.UserId;

        return userApiModel;
    }           
}

Thank you for your help 😊

[MarGraz]

I found the problem I had with the User creation. I was not correctly representing the UserDetails model to be added as a part😅 I compared my model with the one saved in the DB and found the issue.

Now the create operation seems to work.
Here are the changes I made:

• I created a new UserDetails model that represents the Orchard Core model part;
• I removed some userDetailsContentItem properties, such as Published, Latest, etc., because I saw from the DB model that these are not set when you create a new user from the admin panel;
• It seems that the Weld method is not necessary, so I removed it 🤔

The modified parts of the code are:

[...]

// Create a new content item for the user details
ContentItem userDetailsContentItem = await _contentManager.NewAsync("UserDetails");
// userDetailsContentItem.Published = true;
// userDetailsContentItem.Latest = true;
// userDetailsContentItem.PublishedUtc = DateTime.UtcNow;
// userDetailsContentItem.ModifiedUtc = DateTime.UtcNow;
// userDetailsContentItem.ContentItemVersionId = Guid.NewGuid().ToString();

// userDetailsContentItem.Weld("UserDetails", new UserDetails());

await userDetailsContentItem.AlterAsync<UserDetails>(async userDetailsPart =>
{
    userDetailsPart.Name.Text = userApiModel.UserDetails.Name;
    userDetailsPart.Surname.Text = userApiModel.UserDetails.Surname;
    userDetailsPart.WhatsApp.Text = userApiModel.UserDetails.WhatsApp;
    userDetailsPart.Street.Text = userApiModel.UserDetails.Street;
    userDetailsPart.StreetNumber.Text = userApiModel.UserDetails.StreetNumber;
    userDetailsPart.City.Text = userApiModel.UserDetails.City;
});

[...]

This is how the UserDetails model saved in the DB looks like:

  "UserDetails": {
    "DisplayText": " ",
    "Name": {
      "Text": "A test"
    },
    "Surname": {
      "Text": "Pluto"
    },
    "Phone": null,
    "WhatsApp": {
      "Text": "+390123564789"
    },
    "Street": {
      "Text": "Via Marconi"
    },
    "StreetNumber": {
      "Text": "10"
    },
    "City": {
      "Text": "Roma"
    },
    "ZipCode": {
      "Text": "00100"
    }
  }

Questions:

1. What do you think about the code I wrote?
2. If I set EmailConfirmed to false, will the user automatically receive an email to confirm their email address? Or do I need to create a Workflow to verify the user's email?
3. What are the best practices for deleting and updating a user?

Thank you

[Piedone]

Thanks for sharing this!

[MarGraz]

Oh yeah, there was some moving around of that code indeed. However, if you're building a new app, I recommend you use the preview packages, and then you'll get the very latest OC. This also includes a migration from Json.NET to System.Text.Json, a crucial change that you as a module author also need to adapt to, so right now it's better to start with the preview.

Hi @Piedone,

I usually use stable versions of libraries, CMS, or frameworks when I want to take a project into production.
So, I have few questions:

1. Can Orchard Core preview be considered stable, or is it an alpha or beta that is subject to many changes?
2. What kind of changes should I expect in the preview source code?
3. How difficult is it to upgrade from 1.8.3 to the preview now, considering I have already created 7 Orchard Core microservices, various Content Types, and two modules?
4. Does the upgrade involve a radical change in the database requiring manual intervention and a lot of effort, or is the migration automatic and not radical?

I'm asking these questions to evaluate the impact on my effort before making the change. Otherwise, I prefer to postpone this upgrade to a later time 🤔

Thank you

[Piedone]

1. The preview is not meant to be stable, but in practice currently it fairly is.
2. Anything that the community works on and merges in the meantime from the currently open, and later opened pull requests. This can include breaking changes, since the upcoming version will be 2.0.
3. See the 2.0 release notes: https://docs.orchardcore.net/en/latest/releases/2.0.0/ These are the upgrade steps from 1.8.x to the current preview. If there will be anything else for the actually released 2.0, then that'll be added there.
4. Also see the release notes. The migration to STJ involves manual updates to your code, with potentially (depending on your code) in-depth changes.

[MarGraz]

1. The preview is not meant to be stable, but in practice currently it fairly is.

That's good.

2. Anything that the community works on and merges in the meantime from the currently open, and later opened pull requests. This can include breaking changes, since the upcoming version will be 2.0.

That's not good considering that I will be in a production environment next month.

3. See the 2.0 release notes: https://docs.orchardcore.net/en/latest/releases/2.0.0/ These are the upgrade steps from 1.8.x to the current preview. If there will be anything else for the actually released 2.0, then that'll be added there.

Nice, all the changes are well documented 😊

4. Also see the release notes. The migration to STJ involves manual updates to your code, with potentially (depending on your code) in-depth changes.

Ok, I think that because I need to go into production next month, it's better to use a conservative strategy. I will continue developing on 1.8.3, and when 2.0 is released, I will manage the update with a calculated effort.

Thank you for all the explanations, as always 🙃

[Piedone]

No problem!