feat: reload the page with a flash when an htmx request fails

src/Security/LoginEntryPoint.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Security;
 
+use App\Htmx\HxRedirectResponse;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -16,6 +17,10 @@ use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface
  *
  * Deliberately the login *page* rather than straight into /auth/init: the page is where a failed
  * login's flash message is shown, and bouncing there instead would swallow it.
+ *
+ * An htmx request -- typically a click after the session expired -- gets HX-Redirect instead:
+ * a plain 302 is followed invisibly by the browser, and htmx would swap the whole login page into
+ * whatever the click targeted, a modal included.
  */
 final readonly class LoginEntryPoint implements AuthenticationEntryPointInterface
 {
@@ -25,6 +30,12 @@ final readonly class LoginEntryPoint implements AuthenticationEntryPointInterfac
 
     public function start(Request $request, ?AuthenticationException $authException = null): Response
     {
-        return new RedirectResponse($this->urlGenerator->generate('app_login'));
+        $url = $this->urlGenerator->generate('app_login');
+
+        if ($request->headers->has('HX-Request')) {
+            return new HxRedirectResponse($url);
+        }
+
+        return new RedirectResponse($url);
     }
 }