Move the permission "REGISTERED" to the VerifyEmail page.

You should move the "Permission registeredPermission = _permissionRepository.GetPermissionByName("REGISTERED");" line from the Register Account page to the EmailVerified page since an Account really isn't "REGISTERED" until they verify their email address. This way a "PUBLIC" Account will not have access to the "REGISTERED" pages until they verify their email address.


private IWebContext _webContext;
private IAccountRepository _accountRepository;

private IPermissionRepository _permissionRepository;

public void Init(IVerifyEmail _view)
{
_webContext = ObjectFactory.GetInstance<IWebContext>();
_accountRepository = ObjectFactory.GetInstance<IAccountRepository>();

_permissionRepository = ObjectFactory.GetInstance<IPermissionRepository>();

string userName = Cryptography.Decrypt(_webContext.UserNameToVerify, "verify");

Account account = _accountRepository.GetAccountByUserName(userName);

Permission registeredPermission = _permissionRepository.GetPermissionByName("REGISTERED");

if (account != null)
{
account.EmailVerified = true;

_accountRepository.AddPermission(account, registeredPermission);

_accountRepository.SaveAccount(account);