feat: redirect to the deeplink after the form login

src/Security/BpnAuthenticator.php

@@ -16,6 +16,7 @@ use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
 use Symfony\Component\Security\Http\Authenticator\AbstractLoginFormAuthenticator;
 use Symfony\Component\Security\Http\Authenticator\Passport\Badge\CsrfTokenBadge;
 use Symfony\Component\Security\Http\Authenticator\Passport\Badge\RememberMeBadge;
@@ -23,9 +24,14 @@ use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
 use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
 use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
 use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
+use Symfony\Component\Security\Http\Util\TargetPathTrait;
 
 class BpnAuthenticator extends AbstractLoginFormAuthenticator implements AuthenticationEntryPointInterface
 {
+    use TargetPathTrait;
+
+    private const FIREWALL_NAME = 'main';
+
     public function __construct(
         private readonly UrlGeneratorInterface $urlGenerator,
         private readonly EntityManagerInterface $entityManager,
@@ -41,6 +47,21 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         return $this->urlGenerator->generate('app_security_login');
     }
 
+    /**
+     * The firewall saves the requested url as the target path right before it calls this. An
+     * htmx request is a fragment - a modal, a table body - that cannot stand as a page, so
+     * after the login it must not be where the user lands. htmx does not send the
+     * X-Requested-With header that would make Symfony skip it on its own.
+     */
+    public function start(Request $request, ?AuthenticationException $authException = null): Response
+    {
+        if (true === $request->headers->has('HX-Request') && true === $request->hasSession()) {
+            $this->removeTargetPath($request->getSession(), self::FIREWALL_NAME);
+        }
+
+        return parent::start($request, $authException);
+    }
+
     public function authenticate(Request $request): Passport
     {
         $email = mb_strtolower(trim($request->request->getString('_username')));
@@ -92,6 +113,14 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
 
         $this->entityManager->flush();
 
+        // A deeplink the user was sent to the login from. Outstanding teamer checks still
+        // win: RequiredTeamerCheckSubscriber redirects every app_teamer_ request to them.
+        if ($targetPath = $this->getTargetPath($request->getSession(), $firewallName)) {
+            $this->removeTargetPath($request->getSession(), $firewallName);
+
+            return new RedirectResponse($targetPath);
+        }
+
         $route = $user->getDefaultRoute();
         if ('app_teamer_index' === $route) {
             $check = $this->requiredTeamerCheckRegistry->getFirstUnresolvedCheck($user);