From f32cfcd9f237526b139881e614d5fe1f7bb8ee9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <fromme@dreipunktnull.com>
Date: Wed, 14 Feb 2024 15:56:38 +0100
Subject: [PATCH] feat: set preferred role on login via get parameter

---
 src/BusProNet/UserDataHandler.php           |  8 ++++----
 src/Controller/Security/LoginController.php | 14 +++++++++-----
 src/Entity/User.php                         |  2 +-
 src/Security/BpnAuthenticator.php           | 15 ++++++++++-----
 templates/security/login.html.twig          |  3 +++
 5 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/src/BusProNet/UserDataHandler.php b/src/BusProNet/UserDataHandler.php
index 104f80d..56eaaa8 100644
--- a/src/BusProNet/UserDataHandler.php
+++ b/src/BusProNet/UserDataHandler.php
@@ -19,16 +19,16 @@ class UserDataHandler
     ) {
     }
 
-    public function collectRoles(CrmAttributesResponse $crmAttributes): array
+    public function collectRoles(CrmAttributesResponse $crmAttributes, ?string $preferredRole): array
     {
         // Collect user's roles from CRM attributes
         $roles = [];
 
-        if ($crmAttributes->isAdmin()) {
+        if ($crmAttributes->isAdmin() && (null === $preferredRole || 'admin' === $preferredRole)) {
             $roles[] = 'ROLE_ADMIN';
-        } elseif ($crmAttributes->isManager()) {
+        } elseif ($crmAttributes->isManager() && (null === $preferredRole || 'manager' === $preferredRole)) {
             $roles[] = 'ROLE_MANAGER';
-        } elseif ($crmAttributes->isHouseManager()) {
+        } elseif ($crmAttributes->isHouseManager() && (null === $preferredRole || 'house_manager' === $preferredRole)) {
             $roles[] = 'ROLE_HOUSE_MANAGER';
         }
 
diff --git a/src/Controller/Security/LoginController.php b/src/Controller/Security/LoginController.php
index b79e6a4..5e93e00 100644
--- a/src/Controller/Security/LoginController.php
+++ b/src/Controller/Security/LoginController.php
@@ -4,6 +4,7 @@ namespace App\Controller\Security;
 
 use App\Entity\User;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
@@ -11,7 +12,7 @@ use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
 class LoginController extends AbstractController
 {
     #[Route('/login', name: 'app_security_login')]
-    public function login(AuthenticationUtils $authenticationUtils): Response
+    public function login(AuthenticationUtils $authenticationUtils, Request $request): Response
     {
         // redirect to default route in case of active session
         if (null !== $user = $this->getUser()) {
@@ -25,10 +26,13 @@ class LoginController extends AbstractController
         // last username entered by the user
         $lastUsername = $authenticationUtils->getLastUsername();
 
-          return $this->render('security/login.html.twig', [
-              'last_username' => $lastUsername,
-              'error'         => $error,
-          ]);
+        $role = $request->query->get('role');
+
+        return $this->render('security/login.html.twig', [
+            'last_username' => $lastUsername,
+            'error' => $error,
+            'role' => $role,
+        ]);
     }
 
     #[Route('/logout', name: 'app_security_logout')]
diff --git a/src/Entity/User.php b/src/Entity/User.php
index 7063a4e..96f5eb6 100644
--- a/src/Entity/User.php
+++ b/src/Entity/User.php
@@ -176,7 +176,7 @@ class User implements UserInterface, TimestampableEntityInterface
         if ($this->hasRole('ROLE_ADMIN')) {
             return 'app_admin_index';
         } elseif ($this->hasRole('ROLE_MANAGER')) {
-            return 'app_admin_index';
+            return 'app_manager_index';
         } elseif ($this->hasRole('ROLE_HOUSE_MANAGER')) {
             return 'app_house_manager_index';
         } else {
diff --git a/src/Security/BpnAuthenticator.php b/src/Security/BpnAuthenticator.php
index d6feff4..f3e6630 100644
--- a/src/Security/BpnAuthenticator.php
+++ b/src/Security/BpnAuthenticator.php
@@ -63,8 +63,9 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
                     return null;
                 }
 
-                // Finale checks and local user loading/creation
-                $user = $this->getOrCreateLocalUser($response, $email, $password);
+                // Final checks and local user loading/creation
+                $preferredRole = $request->request->get('_role');
+                $user = $this->getOrCreateLocalUser($response, $email, $password, $preferredRole);
 
                 if (null === $user) {
                     return null;
@@ -98,8 +99,12 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         return new RedirectResponse($url);
     }
 
-    private function getOrCreateLocalUser(ProfileResponse $profileResponse, string $email, string $password): ?User
-    {
+    private function getOrCreateLocalUser(
+        ProfileResponse $profileResponse,
+        string $email,
+        string $password,
+        ?string $preferredRole
+    ): ?User {
         // Fetch CRM attributes, early return in case of an API error
         try {
             /** @var CrmAttributesResponse $crmAttributes */
@@ -111,7 +116,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         // Collect user's roles from CRM attributes
         $roles = $this
             ->userDataHandler
-            ->collectRoles($crmAttributes)
+            ->collectRoles($crmAttributes, $preferredRole)
         ;
 
         // User is expected to have at least one role
diff --git a/templates/security/login.html.twig b/templates/security/login.html.twig
index 44e3b3b..ebb6850 100644
--- a/templates/security/login.html.twig
+++ b/templates/security/login.html.twig
@@ -32,6 +32,9 @@
                         Login
                     </button>
                     <input type="hidden" name="_csrf_token" value="{{ csrf_token('authenticate') }}">
+                    {% if role is not null %}
+                        <input type="hidden" name="_role" value="{{ role }}">
+                    {% endif %}
                 </form>
                 <div class="pt-4">
                     <a href="{{ path('app_security_password_reset') }}" class="text-sm underline">