EP/myep
4
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: align role assignment logic with myep-team

Browse Source
This commit is contained in:
Björn Fromme committed 2026-08-19 12:14:09 +02:00
1 parent 5a3957e143
commit 0c667d6b69
23 files changed
+1109 -527
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/Security/BpnAuthenticator.php
+39 -37
View File
@@ -8,6 +8,7 @@ use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Exception\ImmediateConnectionCloseException;
use App\BusProNet\Exception\TimeoutException;
use App\BusProNet\Model\CrmAttributes;
use App\BusProNet\Model\PersonalData;
use App\Entity\User;
use App\Htmx\HxRedirectResponse;
@@ -34,13 +35,11 @@ use Symfony\Component\Security\Http\Util\TargetPathTrait;
* Validates credentials via BPN's getPersonalData endpoint and creates or updates
* local User entities. Passwords are stored encrypted with RSA for subsequent API calls.
*
* Roles have two owners. The non-privileged ones mirror the CRM selections on every login, in
* both directions, so somebody who becomes (or stops being) a Teamer in BusPro is granted (or
* loses) ROLE_TEAMER here — the sibling app myep-team gates on it. Role::PRIVILEGED is never
* imported: BusPro backend users can edit their own CRM selections, so honouring those would
* let anybody make themselves an administrator; they are granted in /admin/user only.
*
* Hotel codes still seed a *new* account only and are managed in /admin/user afterwards.
* BusPro owns the whole role set and the hotel codes: both are synced on every login, in both
* directions, so anything the CRM no longer reports is withdrawn here. What the CRM claims is
* not automatically granted, though — Role::sync() turns an administrative claim into a
* nomination that an administrator has to approve in /admin/user, because BusPro backend users
* can edit their own CRM selections and would otherwise make themselves administrators.
*/
class BpnAuthenticator extends AbstractLoginFormAuthenticator implements AuthenticationEntryPointInterface
{
@@ -109,13 +108,13 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
if (null === $user = $userRepository->findOneBy(['email' => $email])) {
$user = new User($email);
$user->setHotelCodes(array_values(array_unique($crmAttributes->hotelCodes)));
$this->entityManager->persist($user);
}
$this->syncFromCrm($user, $crmAttributes);
$user
->setRoles($this->syncedRoles($email, $user->getRoles(), $crmAttributes->roles))
->setPassword($encryptedPassword)
->setPersonId($personalData->personId)
->setAddressId($personalData->addressId)
@@ -131,40 +130,43 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
}
/**
* Merges the two halves of the role set: the non-privileged roles the BusPro CRM currently
* reports, and the privileged ones an administrator granted here. Anything the CRM no
* longer reports is dropped, so revoking a selection there revokes it here too.
*
* @param string[] $storedRoles
* @param string[] $crmRoles
*
* @return string[]
* Writes back what the CRM currently claims: the roles per Role::sync() and the hotel codes
* verbatim. Both replace what is stored, which is what makes BusPro the source of truth.
*/
private function syncedRoles(string $email, array $storedRoles, array $crmRoles): array
private function syncFromCrm(User $user, CrmAttributes $crmAttributes): void
{
return Role::combine($this->importableRoles($email, $crmRoles), $storedRoles);
}
$previousRoles = $user->getRoles();
/**
* @param string[] $crmRoles
*
* @return string[]
*/
private function importableRoles(string $email, array $crmRoles): array
{
$roles = Role::filterImportable($crmRoles);
$dropped = array_values(array_intersect($crmRoles, Role::PRIVILEGED));
if ([] !== $dropped) {
// Somebody holds a privileged CRM selection in BusPro. We do not honour it, but it
// should stay visible: it either needs to be revoked there or granted in /admin/user.
$this->authLogger->warning('Ignored privileged roles from BPN CRM attributes', [
'email' => $email,
'roles' => $dropped,
if ([] === $crmAttributes->selectionGroups) {
// BusPro always answers with the full attribute tree and expresses membership through
// the `auswahl` flag, so an empty one is a degraded payload rather than a revocation.
// Syncing it would strip the roles of every user who logs in.
$this->authLogger->warning('Skipped the role sync: the BPN CRM response carries no selection groups', [
'email' => $user->getEmail(),
]);
// An existing account keeps everything it has. A brand new one still needs a role,
// and an empty claim set is exactly what Role::sync() answers with the fallback.
if ([] !== Role::assignedOnly($previousRoles)) {
return;
}
}
return $roles;
$user
->setRoles(Role::sync($previousRoles, $crmAttributes->roles))
->setHotelCodes(array_values(array_unique($crmAttributes->hotelCodes)))
;
$nominated = array_diff(Role::pendingOnly($user->getRoles()), Role::pendingOnly($previousRoles));
if ([] !== $nominated) {
// The CRM claims an administrative role for somebody who does not hold it. It grants
// nothing until an administrator approves it in /admin/user.
$this->authLogger->info('Nominated for administrative roles by the BPN CRM', [
'email' => $user->getEmail(),
'roles' => array_values($nominated),
]);
}
}
public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
src/Security/Role.php
+174 -30
View File
@@ -5,11 +5,17 @@ declare(strict_types=1);
namespace App\Security;
/**
* The roles this application knows about.
* The roles this application knows about, and the policy that assigns them.
*
* Roles are stored as plain strings in the User::$roles JSON column and consumed as strings
* by #[IsGranted], the voters and security.yaml's role_hierarchy, so they are constants
* rather than an enum.
*
* The governing rule: the BusPro CRM is the source of truth. It may nominate, but never grant,
* an administrative role — a nomination is stored as a marker (ROLE_X_PENDING) that grants
* nothing until an administrator approves it in /admin/user. The CRM's word alone is enough to
* take a role away, never to hand it out, and an administrator's word alone is enough for
* neither.
*/
final class Role
{
@@ -27,6 +33,14 @@ final class Role
public const GROUPS_ADMIN = 'ROLE_GROUPS_ADMIN';
public const GROUPS_MANAGER = 'ROLE_GROUPS_MANAGER';
/**
* Appended to an administrative role to mark it as claimed by the CRM but not yet approved.
* Markers live in the same column as the real roles and are handed to Symfony along with
* them, but nothing references them: no access_control rule, no role_hierarchy entry and no
* voter. Always ask effectiveOnly() when the question is what an account may actually do.
*/
public const PENDING_SUFFIX = '_PENDING';
/**
* The roles that are actually assigned to accounts. ROLE_USER is left out because every
* account has it implicitly (see User::getRoles()) and it is never stored.
@@ -44,37 +58,54 @@ final class Role
];
/**
* Roles that are never taken over from BusProNet. Many people can edit CRM selections in
* the BusPro backend, so these are granted by an administrator in /admin/user only.
* Roles the CRM grants outright. ROLE_CUSTOMER is never claimed by BusPro — it is the
* fallback for an account left without any effective role, and exclusive with the others.
*
* @var string[]
*/
public const PRIVILEGED = [
public const UNCONDITIONAL = [
self::TEAMER,
self::CUSTOMER,
];
/**
* Roles the CRM only nominates for. Many people can edit CRM selections in the BusPro
* backend, so honouring these directly would let anybody make themselves an administrator.
*
* @var string[]
*/
public const ADMINISTRATIVE = [
self::ADMIN,
self::MANAGER,
self::HOUSE_MANAGER,
self::GROUPS_ADMIN,
self::GROUPS_MANAGER,
];
/**
* Reduces the roles derived from BPN CRM attributes to the ones we accept from there.
* Roles nobody may approve for their own account. ROLE_ADMIN outranks every check in this
* application, including the approval surface itself, so it always takes a second
* administrator. The remaining administrative roles grant less than what an approver
* already holds, so requiring a second pair of eyes for them would only lock out the
* single-administrator case for no gain.
*
* Falls back to ROLE_CUSTOMER the way CrmAttributesResponseParser does, so an account
* whose only selection was a privileged one does not end up without any role.
*
* @param string[] $roles
*
* @return string[]
* @var string[]
*/
public static function filterImportable(array $roles): array
{
$importable = array_values(array_unique(array_diff($roles, self::PRIVILEGED)));
public const SELF_APPROVAL_FORBIDDEN = [
self::ADMIN,
];
return [] === $importable ? [self::CUSTOMER] : $importable;
/**
* The marker standing for a role that the CRM claims but nobody has approved.
*/
public static function pending(string $role): string
{
return $role.self::PENDING_SUFFIX;
}
/**
* The roles actually assigned to an account — everything except the implicit ROLE_USER,
* which User::getRoles() prepends and which is never stored.
* The roles actually stored on an account — everything except the implicit ROLE_USER,
* which User::getRoles() prepends and which is never stored. Markers included.
*
* @param string[] $roles
*
@@ -86,41 +117,148 @@ final class Role
}
/**
* The non-privileged half of a role set: what BpnAuthenticator syncs from the BusPro CRM.
* The roles that actually grant something: no ROLE_USER, no markers.
*
* @param string[] $roles
*
* @return string[]
*/
public static function syncedOnly(array $roles): array
public static function effectiveOnly(array $roles): array
{
return array_values(array_diff(self::assignedOnly($roles), self::PRIVILEGED));
return array_values(array_filter(
self::assignedOnly($roles),
static fn (string $role): bool => false === self::isPending($role),
));
}
/**
* The privileged half: what an administrator granted in /admin/user.
* The markers on an account: administrative roles the CRM claims, awaiting approval.
*
* @param string[] $roles
*
* @return string[]
*/
public static function privilegedOnly(array $roles): array
public static function pendingOnly(array $roles): array
{
return array_values(array_intersect($roles, self::PRIVILEGED));
return array_values(array_filter($roles, static fn (string $role): bool => self::isPending($role)));
}
/**
* Reassembles a complete role set from its two owners. Both sides are filtered, so a
* privileged role can never arrive through the synced half and vice versa.
* The roles behind those markers, labelled — what an approver acts on.
*
* @param string[] $synced
* @param string[] $privileged
* @param string[] $roles
*
* @return array<string, string> role => label
*/
public static function nominatedFrom(array $roles): array
{
$labels = self::labels();
$nominated = [];
foreach (self::pendingOnly($roles) as $marker) {
$role = self::realRole($marker);
if (\in_array($role, self::ADMINISTRATIVE, true)) {
$nominated[$role] = $labels[$role];
}
}
return $nominated;
}
/**
* The whole policy, applied on every login.
*
* 1. revoke everything the CRM no longer claims — granted roles and markers alike, which is
* what makes BusPro the source of truth;
* 2. grant the unconditional roles it claims;
* 3. mark every administrative role it claims that is not granted already. This runs after
* the revocation, so a role just revoked is not immediately marked again, and an approved
* role is never marked a second time;
* 4. fall back to ROLE_CUSTOMER when nothing effective is left.
*
* Nothing here can raise a privilege: step 3 only ever produces markers.
*
* @param string[] $storedRoles
* @param string[] $claimedRoles what the CRM reports
*
* @return string[]
*/
public static function combine(array $synced, array $privileged): array
public static function sync(array $storedRoles, array $claimedRoles): array
{
return array_values(array_unique([...self::syncedOnly($synced), ...self::privilegedOnly($privileged)]));
$claimed = array_values(array_intersect(self::ALL, array_unique($claimedRoles)));
$roles = array_values(array_filter(
self::assignedOnly($storedRoles),
static fn (string $role): bool => \in_array(self::realRole($role), $claimed, true),
));
foreach (array_intersect($claimed, self::UNCONDITIONAL) as $role) {
$roles[] = $role;
}
foreach (array_intersect($claimed, self::ADMINISTRATIVE) as $role) {
if (false === \in_array($role, $roles, true)) {
$roles[] = self::pending($role);
}
}
return self::withCustomerFallback(array_values(array_unique($roles)));
}
/**
* Turns a marker into the role it stands for. Refuses anything the account is not nominated
* for, so neither a hand-crafted request nor a claim revoked while the confirmation dialog
* was open can grant a role the CRM never reported.
*
* @param string[] $storedRoles
*
* @return string[]
*
* @throws \InvalidArgumentException when $role is not pending on this account
*/
public static function approve(array $storedRoles, string $role): array
{
$roles = self::assignedOnly($storedRoles);
if (false === \in_array(self::pending($role), $roles, true)) {
throw new \InvalidArgumentException(sprintf('The role "%s" is not pending approval.', $role));
}
$roles = array_diff($roles, [self::pending($role)]);
$roles[] = $role;
return self::withCustomerFallback(array_values(array_unique($roles)));
}
/**
* Everybody without an effective role is a customer, and nobody with one is. The fallback is
* a fallback, not a baseline — ROLE_CUSTOMER and ROLE_TEAMER are mutually exclusive on
* purpose.
*
* @param string[] $roles
*
* @return string[]
*/
private static function withCustomerFallback(array $roles): array
{
if ([] === array_diff(self::effectiveOnly($roles), [self::CUSTOMER])) {
return array_values(array_unique([...$roles, self::CUSTOMER]));
}
return array_values(array_diff($roles, [self::CUSTOMER]));
}
private static function isPending(string $role): bool
{
return str_ends_with($role, self::PENDING_SUFFIX);
}
private static function realRole(string $role): string
{
return self::isPending($role)
? substr($role, 0, -\strlen(self::PENDING_SUFFIX))
: $role;
}
/**
@@ -128,7 +266,7 @@ final class Role
*/
public static function labels(): array
{
return [
$labels = [
self::ADMIN => 'Administration',
self::MANAGER => 'Manager:in',
self::TEAMER => 'Teamer:in',
@@ -137,5 +275,11 @@ final class Role
self::GROUPS_ADMIN => 'Preisrechner Admin',
self::GROUPS_MANAGER => 'Preisrechner',
];
foreach (self::ADMINISTRATIVE as $role) {
$labels[self::pending($role)] = $labels[$role].' (nicht freigeschaltet)';
}
return $labels;
}
}