From feea4592c5fa0de5f109fb0617fdc854e28f3670 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <fromme@dreipunktnull.com>
Date: Wed, 28 Feb 2024 10:50:23 +0100
Subject: [PATCH] feat: catch access denied exceptions with listener

---
 src/EventListener/AccessDeniedListener.php | 48 ++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 src/EventListener/AccessDeniedListener.php

diff --git a/src/EventListener/AccessDeniedListener.php b/src/EventListener/AccessDeniedListener.php
new file mode 100644
index 0000000..36e9bd5
--- /dev/null
+++ b/src/EventListener/AccessDeniedListener.php
@@ -0,0 +1,48 @@
+<?php
+
+namespace App\EventListener;
+
+use Psr\Log\LoggerInterface;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpKernel\Event\ExceptionEvent;
+use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+#[AsEventListener(event: KernelEvents::EXCEPTION, method: 'onKernelException', priority: 2)]
+class AccessDeniedListener
+{
+    public function __construct(
+        private readonly Security $security,
+        private readonly LoggerInterface $logger,
+        private readonly UrlGeneratorInterface $urlGenerator
+    ) {
+    }
+
+    public function onKernelException(ExceptionEvent $event): void
+    {
+        $exception = $event->getThrowable();
+        if (false === $exception instanceof AccessDeniedException) {
+            return;
+        }
+
+        $request = $event->getRequest();
+
+        if ($request->isXmlHttpRequest()) {
+            return;
+        }
+
+        $request->getSession()->getFlashBag()->add('error', 'Zugriff verweigert');
+
+        $this->logger->warning('Access denied', [
+            'uri' => $request->getRequestUri(),
+        ]);
+
+        $user = $this->security->getUser();
+        $redirectRoute = $user ? $user->getDefaultRoute() : 'app_login';
+
+        $event->setResponse(new RedirectResponse($this->urlGenerator->generate($redirectRoute)));
+    }
+}