feat: revert password grant in favor of pkce

config/packages/league_oauth2_server.yaml

@@ -3,10 +3,11 @@ league_oauth2_server:
         private_key: '%env(resolve:OAUTH_PRIVATE_KEY)%'
         private_key_passphrase: null
         encryption_key: '%env(resolve:OAUTH_ENCRYPTION_KEY)%'
+        require_code_challenge_for_public_clients: true
         enable_client_credentials_grant: true
         enable_auth_code_grant: true
         enable_refresh_token_grant: true
-        enable_password_grant: true
+        enable_password_grant: false
         access_token_ttl: PT10M
     resource_server:
         public_key: '%env(resolve:OAUTH_PUBLIC_KEY)%'

config/services.yaml

@@ -261,7 +261,3 @@ services:
             $apiBaseUrl: '%env(default::MAILJET_API_BASE_URL)%'
             $defaultListId: '%env(default::MAILJET_DEFAULT_LIST_ID)%'
             $contactMetadataFields: '%mailjet_contact_metadata_fields%'
-
-    App\EventListener\UserResolverListener:
-        arguments:
-            $userProvider: '@security.user_providers'

src/EventListener/UserResolverListener.php

@@ -1,43 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\EventListener;
-
-use App\Security\Crypt;
-use League\Bundle\OAuth2ServerBundle\Event\UserResolveEvent;
-use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
-use Symfony\Component\Security\Core\Exception\AuthenticationException;
-use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
-use Symfony\Component\Security\Core\User\UserProviderInterface;
-
-#[AsEventListener(event: 'league.oauth2_server.event.user_resolve', method: 'onUserResolve')]
-final class UserResolverListener
-{
-    public function __construct(
-        private readonly UserProviderInterface $userProvider,
-        private readonly Crypt $crypt,
-    ) {
-    }
-
-    public function onUserResolve(UserResolveEvent $event): void
-    {
-        try {
-            $user = $this->userProvider->loadUserByIdentifier($event->getUsername());
-        } catch (AuthenticationException $e) {
-            return;
-        }
-
-        if (!$user instanceof PasswordAuthenticatedUserInterface) {
-            return;
-        }
-
-        $passwordHash = $this->crypt->decrypt($user->getPassword());
-
-        if ($passwordHash !== md5($event->getPassword())) {
-            return;
-        }
-
-        $event->setUser($user);
-    }
-}