Triggering an action after user resets password?

Question

I was hoping there was hook_user_pass_reset, but I seem to be out of luck. Some background:

• I made a new field on users called "email_confirmed"
• This field gets set = 1 when the user has confirmed their email address
• I don't use the "blocked" value, or the normal Drupal way, because I want users to still log in and do stuff. I only want to limit certain actions, which will only become possible after email_confirmed = 1

So all I want to do is update this field = 1, the moment the user uses the confirmation link to change their password. So it will not be good enough to this when the user changes his password. It needs to happen the moment the user has executed the confirmation link?

Answer 1

/**
 * Implements hook_ENTITY_TYPE_update().
 */
function MODULE_user_update(Drupal\user\UserInterface $user) {
  if (!empty($user->original)) { // check previous value exists
    if($user->original->pass->value != $user->pass->value) { // check if pass changed
      $user->field_email_confirmed->value = 1; // set new value
    }
  }
}

Answer 2

The Logintobbogan module for Drupal 7 does something similar. It implements hook_form_alter() for the user password reset form, which is also used for processing the one-time login link sent in the confirmation email, to set $account->logintoboggan_email_validated to TRUE.

In Drupal 8, it could be still possible to implement something similar. The difference is that the user.reset.login route (whose path is /user/reset/{uid}/{timestamp}/{hash}/login) is handled by a controller. Instead of hook_form_alter(), a module should alter the user.reset.login route to use a different controller, which sets the desired account field.
Alternatively, the email sent for the email confirmation could contain a link to a different route that sets the account field.