MVC: Reset password belongs to Service layer or Actual Entity

Question

I am relatively new to MVC, and have just come across some pre-existing code.

We have a UserService, which mainly contains CRUD operations, and perhaps, one or two business logic operations - all needed by our controllers. It encapsulates the context and the Membership.

I was about to implement the ResetPassword operations, but I was not sure where to implement it; whether to implement it at the UserService or at the User Entity.

---

UserService

bool ResetPassword(string username, string newPassword);

This would lead to my controller being:

ActionResult ResetPassword(string username, string newPassword)
{
  userService.ResetPassword(username, newPassword);
}

vs

User

bool ResetPassword(string newPassword)

This would lead to my controller being:

ActionResult ResetPassword(string username, string newPassword)
{
  var user = userService.GetUser(username);
  user.ResetPassword(newPassword);
}

Which approach is recommended?

Answer 1

You should always decouple data from business logic so you should modify the User object (data layer) in your controller (presentation layer - and yes Views, View Models and Controllers are all a part of your presentation layer) via your business logic layer i.e. UserService!

Answer 2

I would recommend second approach, you have to gains.

1. you domain/business logic (here ResetPassword) will stay away from controllers/action
2. you re-use the functionality from different places (say if you are exposing ResetPassword as a service)