feat: adjust oauth2 implementation for TYPO3 backend login

config/packages/league_oauth2_server.yaml

@@ -11,7 +11,7 @@ league_oauth2_server:
     resource_server:
         public_key: '%env(resolve:OAUTH_PUBLIC_KEY)%'
     scopes:
-        available: ['email','profile','api']
+        available: ['email','id','profile','roles','api']
         default: ['email']
     persistence:
         doctrine: null

src/BusProNet/Model/PersonalData.php

@@ -49,6 +49,8 @@ class PersonalData
     #[Assert\Valid(groups: ['personal_data'])]
     public Communication $communication;
 
+    public array $roles = [];
+
     public function __construct()
     {
         $this->address = new Address();
@@ -124,7 +126,9 @@ class PersonalData
     public function getClaims(): array
     {
         return [
+            'id' => $this->personId,
             'email' => $this->communication->email,
+            'roles' => $this->roles,
             'profile' => [
                 'first_name' => $this->firstName,
                 'last_name' => $this->name,

src/Controller/Api/UserinfoController.php

@@ -29,9 +29,15 @@ class UserinfoController extends AbstractController
         $scopes = ['email'];
 
         // extend scopes depending on granted permissions
+        if ($this->isGranted('ROLE_OAUTH2_ID')) {
+            $scopes[] = 'id';
+        }
         if ($this->isGranted('ROLE_OAUTH2_PROFILE')) {
             $scopes[] = 'profile';
         }
+        if ($this->isGranted('ROLE_OAUTH2_ROLES')) {
+            $scopes[] = 'roles';
+        }
 
         /** @var User $user */
         $user = $this->getUser();
@@ -45,6 +51,9 @@ class UserinfoController extends AbstractController
                 return new JsonResponse(['message' => $data->message, 'code' => $data->code], Response::HTTP_BAD_REQUEST);
             }
 
+            // Patch current user's roles
+            $data->roles = $user->getRoles();
+
             // extract userdata for resulting claims
             $userData = $this->getClaims($data, $scopes);
 

src/Controller/SecurityController.php

@@ -43,9 +43,8 @@ class SecurityController extends AbstractController
         // authentication (see App\EventListener\AuthorizationCodeListener).
         $session = $request->getSession();
         $targetPath = $session->get('_security.main.target_path');
-        if (null !== $targetPath && str_contains($targetPath, '/authorize')) {
-            $session->set('_oauth2', true);
-        }
+        $isOauth2 = null !== $targetPath && str_contains($targetPath, '/authorize');
+        $session->set('_oauth2', $isOauth2);
 
         // For booking flow, set target path to Step 1 (after successful auth, redirect there)
         if (true === $isBookingFlow) {
@@ -71,6 +70,7 @@ class SecurityController extends AbstractController
             'travel_date_from' => $bookingDto?->travel->dateFrom,
             'travel_date_to' => $bookingDto?->travel->dateTo,
             'cmsData' => $cmsData,
+            'oauth2' => $isOauth2,
         ]);
     }
 

src/EventListener/AccessDeniedListener.php

@@ -37,8 +37,6 @@ class AccessDeniedListener implements EventSubscriberInterface
 
         // Treat OAuth2 routes differently
         if (in_array($route, ['oauth2_authorize', 'oauth2_token'])) {
-            $request->getSession()->getFlashBag()->add('info', 'Bitte melde dich an.');
-
             $this->authLogger->info('OAuth2 authorization request', [
                 'uri' => $request->getRequestUri(),
             ]);

src/Security/BpnAuthenticator.php

@@ -117,9 +117,12 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
 
     private function collectRoles(CrmAttributes $crmAttributes): array
     {
-        // Collect user's roles from CRM attributes
-        $roles = [];
+        // All users inherit the default role 'customer'
+        $roles = [
+            'ROLE_CUSTOMER',
+        ];
 
+        // Get user's base role from CRM attributes
         if ($crmAttributes->admin) {
             $roles[] = 'ROLE_ADMIN';
         } elseif ($crmAttributes->manager) {
@@ -128,6 +131,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
             $roles[] = 'ROLE_HOUSE_MANAGER';
         }
 
+        // All users can have role 'teamer' additionally
         if ($crmAttributes->teamer) {
             $roles[] = 'ROLE_TEAMER';
         }

templates/base.html.twig

@@ -11,7 +11,7 @@
             {{ encore_entry_script_tags('app') }}
         {% endblock %}
     </head>
-    <body class="bg-white text-gray-700 font-sans antialiased {{ booking_theme() }}" hx-boost="true">
+    <body class="bg-white text-gray-700 font-sans antialiased {{ booking_theme() }}"{% if not oauth2 %} hx-boost="true"{% endif %}>
         {% block body %}{% endblock %}
     </body>
 </html>