From 19031dba9908bf929481c95b00cbaedc1f021ce7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <fromme@dreipunktnull.com>
Date: Thu, 29 Jan 2026 16:24:27 +0100
Subject: [PATCH] fix: enforce profile completion of applicant in all
 situations

---
 .../Booking/Create/IndexController.php        | 11 ---
 .../ProfileCompletionRedirectListener.php     | 68 +++++++++++++++++++
 templates/booking/create/error.html.twig      |  2 +-
 3 files changed, 69 insertions(+), 12 deletions(-)
 create mode 100644 src/EventListener/ProfileCompletionRedirectListener.php

diff --git a/src/Controller/Booking/Create/IndexController.php b/src/Controller/Booking/Create/IndexController.php
index 0396ab9..f2d3048 100644
--- a/src/Controller/Booking/Create/IndexController.php
+++ b/src/Controller/Booking/Create/IndexController.php
@@ -5,8 +5,6 @@ declare(strict_types=1);
 namespace App\Controller\Booking\Create;
 
 use App\BusProNet\XmlLoader\AgencyLoader;
-use App\Controller\Account\PersonalDataController;
-use App\Entity\User;
 use App\Exception\HotelNotFoundException;
 use App\Exception\HotelNotInTravelException;
 use App\Exception\NoRoomsAvailableException;
@@ -44,7 +42,6 @@ class IndexController extends AbstractController
      *
      * Renders a loading page that triggers the actual initialization via HTMX.
      * This provides immediate visual feedback while BusProNet API calls are made.
-     * Redirects to profile completion if logged-in user has incomplete profile data.
      */
     #[Route(
         path: '/bookings/create',
@@ -56,14 +53,6 @@ class IndexController extends AbstractController
             throw $this->createNotFoundException('Invalid booking parameters provided');
         }
 
-        $user = $this->getUser();
-
-        if ($user instanceof User && false === $user->isProfileComplete()) {
-            $request->getSession()->set(PersonalDataController::SESSION_REDIRECT_KEY, $request->getUri());
-
-            return $this->redirectToRoute('app_personal_data');
-        }
-
         return $this->render('booking/create/index.html.twig', [
             'params' => $params,
         ]);
diff --git a/src/EventListener/ProfileCompletionRedirectListener.php b/src/EventListener/ProfileCompletionRedirectListener.php
new file mode 100644
index 0000000..87fe7fb
--- /dev/null
+++ b/src/EventListener/ProfileCompletionRedirectListener.php
@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\EventListener;
+
+use App\Controller\Account\PersonalDataController;
+use App\Entity\User;
+use App\Htmx\HxRedirectResponse;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Http\Event\LoginSuccessEvent;
+
+/**
+ * Redirects users with incomplete profiles to the personal data page after login.
+ *
+ * When a user logs in with an incomplete profile during a booking flow, this listener
+ * intercepts the redirect to store the original target URL and redirects to the
+ * profile completion page instead. After completing their profile, users are
+ * redirected back to their original destination.
+ */
+class ProfileCompletionRedirectListener implements EventSubscriberInterface
+{
+    public function __construct(
+        private readonly UrlGeneratorInterface $urlGenerator,
+    ) {
+    }
+
+    public static function getSubscribedEvents(): array
+    {
+        return [
+            LoginSuccessEvent::class => ['onLoginSuccess', 0],
+        ];
+    }
+
+    public function onLoginSuccess(LoginSuccessEvent $event): void
+    {
+        $user = $event->getUser();
+
+        if (false === $user instanceof User || true === $user->isProfileComplete()) {
+            return;
+        }
+
+        $request = $event->getRequest();
+        $session = $request->getSession();
+
+        // Get the intended target path (set by SecurityController or authenticator)
+        $targetPath = $session->get('_security.main.target_path');
+
+        // Store target path for redirect after profile completion
+        if (null !== $targetPath) {
+            $session->set(PersonalDataController::SESSION_REDIRECT_KEY, $targetPath);
+        }
+
+        // Generate personal data URL
+        $personalDataUrl = $this->urlGenerator->generate('app_personal_data');
+
+        // Use HTMX-aware redirect if this is an HTMX request
+        if (true === $request->headers->has('HX-Request')) {
+            $event->setResponse(new HxRedirectResponse($personalDataUrl));
+
+            return;
+        }
+
+        $event->setResponse(new RedirectResponse($personalDataUrl));
+    }
+}
diff --git a/templates/booking/create/error.html.twig b/templates/booking/create/error.html.twig
index 540cf6a..f7628e0 100644
--- a/templates/booking/create/error.html.twig
+++ b/templates/booking/create/error.html.twig
@@ -13,7 +13,7 @@
         } %}
 
         {# hx-boost disabled for cross-origin #}
-        <a href="{{ returnUrl }}" hx-boost="false" class="button button--secondary">
+        <a href="{{ returnUrl }}" hx-boost="false" class="button button--primary">
             Zurück
         </a>
     </div>