There should be an event dispatched when a user's password is going to be reset. It can be dispatched after the user has been validated and before the email which generates a login link is sent.

    $account = reset($users);
    if (!$account instanceof UserInterface) {
      // Error if no users found with provided name or mail.
      throw new UnprocessableEntityHttpException('Unrecognized username or email address.');
    }
    if ($this->userIsBlocked($account->getAccountName())) {
      throw new UnprocessableEntityHttpException('The user has not been activated or is blocked.');
    }

    // @todo dispatch UserPasswordResetEvent($account, $document);

    // Send the password reset email.
    $mail = _user_mail_notify('password_reset', $account, $account->getPreferredLangcode());
    if (empty($mail)) {
      throw new UnprocessableEntityHttpException('Unable to send email. Contact the site administrator if the problem persists.');
    }

In fact, this event could be used to generate the email which is sent. The password_reset email may be completely useless in a headless situation and handled by a different service. Moving this code to an event subscriber in this module makes it feasible to swap functionality.

CommentFileSizeAuthor
#2 3107573-2.patch8.13 KBmglaman
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

mglaman created an issue. See original summary.

mglaman’s picture

Status: Active » Needs review
FileSize
8.13 KB

I also realized we need to revisit this for registration for the same problems.

  • mglaman committed a11b5ed on 8.x-1.x
    Issue #3107573 by mglaman: Fire an event to allow modules to react to a...
mglaman’s picture

Status: Needs review » Fixed

Committed!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.