EP/myep
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: integrated OAuth2 server

Browse Source
This commit is contained in:
Björn Fromme
2025-04-24 20:28:27 +02:00
parent c418ae6399
commit adbfb49c11
84 changed files with 2542 additions and 312 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Controller/Api/CountryController.php
+3 -1
View File
@@ -6,8 +6,10 @@ use App\BusProNet\DataProvider\CountryDataProvider;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;
#[Route('/api')]
#[IsGranted('ROLE_OAUTH2_API')]
class CountryController extends AbstractController
{
public function __construct(private readonly CountryDataProvider $dataProvider)
@@ -21,4 +23,4 @@ class CountryController extends AbstractController
return $this->json($countries);
}
}
}
src/Controller/Api/CrmAttributesController.php → src/Controller/Api/CrmAttributeController.php
+12 -11
View File
@@ -5,28 +5,29 @@ namespace App\Controller\Api;
use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Model\Notification;
use App\Entity\User;
use App\Security\Crypt;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;
#[Route('/api')]
class CrmAttributesController extends AbstractController
#[IsGranted('ROLE_OAUTH2_PROFILE')]
class CrmAttributeController extends AbstractController
{
public function __construct(private readonly APiClient $apiClient)
public function __construct(private readonly ApiClient $apiClient, private readonly Crypt $crypt)
{
}
#[Route('/crm-attributes', name: 'api_crm_attributes', methods: ['GET'])]
public function index(Request $request): JsonResponse
public function index(): JsonResponse
{
$email = $request->headers->get('x-bpn-email');
$password = $request->headers->get('x-bpn-password');
if (null === $email || null === $password) {
return new JsonResponse(['message' => 'Invalid credentials'], Response::HTTP_BAD_REQUEST);
}
/** @var User $user */
$user = $this->getUser();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
try {
$data = $this->apiClient->getCrmAttributes($email, $password);
@@ -40,4 +41,4 @@ class CrmAttributesController extends AbstractController
return new JsonResponse(['message' => $e->getMessage()], Response::HTTP_BAD_REQUEST);
}
}
}
}
src/Controller/Api/HotelController.php
+4 -2
View File
@@ -7,15 +7,17 @@ use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;
#[Route('/api')]
#[IsGranted('ROLE_OAUTH2_API')]
class HotelController extends AbstractController
{
public function __construct(private readonly HotelLoader $xmlLoader)
{
}
#[Route('/hotels', name: 'api_hotel_all')]
#[Route('/hotels', name: 'api_hotels_all')]
public function index(): JsonResponse
{
$hotels = $this->xmlLoader->loadAll();
@@ -34,4 +36,4 @@ class HotelController extends AbstractController
return $this->json($hotel, Response::HTTP_OK, [], ['groups' => 'api:single']);
}
}
}
src/Controller/Api/PersonalDataController.php
-43
View File
@@ -1,43 +0,0 @@
<?php
namespace App\Controller\Api;
use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Model\Notification;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
#[Route('/api')]
class PersonalDataController extends AbstractController
{
public function __construct(private readonly APiClient $apiClient)
{
}
#[Route('/personal-data', name: 'api_personal_data', methods: ['GET'])]
public function index(Request $request): JsonResponse
{
$email = $request->headers->get('x-bpn-email');
$password = $request->headers->get('x-bpn-password');
if (null === $email || null === $password) {
return new JsonResponse(['message' => 'Invalid credentials'], Response::HTTP_BAD_REQUEST);
}
try {
$data = $this->apiClient->getPersonalData($email, $password);
if ($data instanceof Notification) {
return new JsonResponse(['message' => $data->message, 'code' => $data->code], Response::HTTP_BAD_REQUEST);
}
return $this->json($data);
} catch (ApiClientException $e) {
return new JsonResponse(['message' => $e->getMessage()], Response::HTTP_BAD_REQUEST);
}
}
}
src/Controller/Api/PickupController.php
+5 -3
View File
@@ -7,15 +7,17 @@ use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;
#[Route('/api')]
#[IsGranted('ROLE_OAUTH2_API')]
class PickupController extends AbstractController
{
public function __construct(private readonly PickupLoader $xmlLoader)
{
}
#[Route('/pickups', name: 'api_pickup_all')]
#[Route('/pickups', name: 'api_pickups_all')]
public function index(): JsonResponse
{
$pickups = $this->xmlLoader->loadAll();
@@ -23,11 +25,11 @@ class PickupController extends AbstractController
return $this->json($pickups, Response::HTTP_OK, [], ['groups' => 'api:list']);
}
#[Route('/pickups/{id}', name: 'api_pickup_single')]
#[Route('/pickups/{id}', name: 'api_pickups_single')]
public function single(int $id): JsonResponse
{
$pickup = $this->xmlLoader->loadById($id);
return $this->json($pickup, Response::HTTP_OK, [], ['groups' => 'api:list']);
}
}
}
src/Controller/Api/ResetPasswordController.php
-47
View File
@@ -1,47 +0,0 @@
<?php
namespace App\Controller\Api;
use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Validator\Constraints\Email;
use Symfony\Component\Validator\Validator\ValidatorInterface;
#[Route('/api')]
class ResetPasswordController extends AbstractController
{
public function __construct(private readonly ApiClient $apiClient, private readonly ValidatorInterface $validator)
{
}
#[Route('/reset-password', name: 'api_reset_password', methods: ['POST'])]
public function index(Request $request): Response
{
$payload = json_decode($request->getContent(), true);
$email = $payload['email'] ?? null;
if (null === $email) {
return new JsonResponse(['message' => 'Invalid email'], Response::HTTP_BAD_REQUEST);
}
$violationList = $this->validator->validate($email, [new Email([
'mode' => 'strict',
])]);
if (0 < count($violationList)) {
return new JsonResponse(['message' => 'Invalid email'], Response::HTTP_BAD_REQUEST);
}
try {
$this->apiClient->resetPassword($email);
} catch (ApiClientException $e) {
}
return $this->json(['message' => 'Password reset invoked']);
}
}
src/Controller/Api/TravelController.php
+6 -4
View File
@@ -11,16 +11,18 @@ use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;
use Symfony\Contracts\Cache\CacheInterface;
use Symfony\Contracts\Cache\ItemInterface;
#[Route('/api')]
#[IsGranted('ROLE_OAUTH2_API')]
class TravelController extends AbstractController
{
public function __construct(
private readonly TravelLoader $travelXmlLoader,
private readonly HotelLoader $hotelXmlLoader,
private readonly PickupLoader $pickupXmlLoader,
private readonly TravelLoader $travelXmlLoader,
private readonly HotelLoader $hotelXmlLoader,
private readonly PickupLoader $pickupXmlLoader,
private readonly CacheInterface $cache,
) {
}
@@ -90,4 +92,4 @@ class TravelController extends AbstractController
return $travel;
}
}
}
src/Controller/Api/UserinfoController.php
+74
View File
@@ -0,0 +1,74 @@
<?php
namespace App\Controller\Api;
use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Model\Notification;
use App\BusProNet\Model\PersonalData;
use App\Entity\User;
use App\Security\Crypt;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;
#[Route('/api')]
#[IsGranted('ROLE_OAUTH2_EMAIL')]
class UserinfoController extends AbstractController
{
public function __construct(private readonly ApiClient $apiClient, private readonly Crypt $crypt)
{
}
#[Route('/userinfo', name: 'api_userinfo', methods: ['GET'])]
public function index(): JsonResponse
{
// basic scopes applicable to all authenticated users
$scopes = ['email'];
// extend scopes depending on granted permissions
if ($this->isGranted('ROLE_OAUTH2_PROFILE')) {
$scopes[] = 'profile';
}
/** @var User $user */
$user = $this->getUser();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
try {
$data = $this->apiClient->getPersonalData($email, $password);
if ($data instanceof Notification) {
return new JsonResponse(['message' => $data->message, 'code' => $data->code], Response::HTTP_BAD_REQUEST);
}
// extract userdata for resulting claims
$userData = $this->getClaims($data, $scopes);
return $this->json($userData);
} catch (ApiClientException $e) {
return new JsonResponse(['message' => $e->getMessage()], Response::HTTP_BAD_REQUEST);
}
}
private function getClaims(PersonalData $data, array $scopes): array
{
// get all available claims
$allClaims = $data->getClaims();
$keys = array_keys($allClaims);
$claims = [];
// filter claims by provided scopes
foreach ($scopes as $scope) {
if (false === in_array($scope, $keys)) {
continue;
}
$claims[$scope] = $allClaims[$scope];
}
return $claims;
}
}
src/Controller/Booking/DownloadController.php
+2 -1
View File
@@ -16,6 +16,7 @@ use Symfony\Component\HttpFoundation\StreamedResponse;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;
use Symfony\Contracts\Cache\CacheInterface;
use function Symfony\Component\String\u;
class DownloadController extends AbstractController
@@ -42,7 +43,7 @@ class DownloadController extends AbstractController
requirements: ['id' => '\d+'],
defaults: ['fileType' => 'invoice']
)]
#[IsGranted("ROLE_USER")]
#[IsGranted('ROLE_USER')]
public function documents(int $id, string $fileType): Response
{
/** @var User $user */
src/Controller/Booking/EditController.php
+1 -1
View File
@@ -38,7 +38,7 @@ class EditController extends AbstractController
}
#[Route('/bookings/{id}/edit', name: 'app_booking_edit', requirements: ['id' => '\d+'])]
#[IsGranted("ROLE_USER")]
#[IsGranted('ROLE_USER')]
public function edit(int $id, Request $request): Response
{
/** @var User $user */
src/Controller/Booking/IndexController.php
+1 -1
View File
@@ -27,7 +27,7 @@ class IndexController extends AbstractController
}
#[Route('/bookings', name: 'app_bookings')]
#[IsGranted("ROLE_USER")]
#[IsGranted('ROLE_USER')]
public function index(Request $request): Response
{
/** @var User $user */
src/Controller/RegistrationController.php
+1 -1
View File
@@ -26,7 +26,7 @@ class RegistrationController extends AbstractController
public function index(Request $request): Response
{
$registrationData = new RegistrationData();
$form = $this->createForm(RegistrationType::class, $registrationData,[
$form = $this->createForm(RegistrationType::class, $registrationData, [
'action' => $this->generateUrl('app_registration'),
]);
$form->handleRequest($request);
src/Controller/ResetPasswordController.php
+1 -2
View File
@@ -4,7 +4,6 @@ namespace App\Controller;
use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Exception\ResponseParserException;
use Psr\Log\LoggerInterface;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\Form\Extension\Core\Type\EmailType;
@@ -38,7 +37,7 @@ class ResetPasswordController extends AbstractController
new Email([
'mode' => 'strict',
'message' => 'Bitte eine gültige E-Mail Adresse angeben',
])
]),
],
])
->getForm()
src/Controller/SecurityController.php
+14 -3
View File
@@ -3,6 +3,7 @@
namespace App\Controller;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;
@@ -12,7 +13,7 @@ class SecurityController extends AbstractController
{
#[Route('/', name: 'app_login')]
#[IsGranted('PUBLIC_ACCESS')]
public function login(AuthenticationUtils $authenticationUtils): Response
public function login(AuthenticationUtils $authenticationUtils, Request $request): Response
{
if (null !== $this->getUser()) {
return $this->redirectToRoute('app_personal_data');
@@ -21,6 +22,15 @@ class SecurityController extends AbstractController
$error = $authenticationUtils->getLastAuthenticationError();
$lastUsername = $authenticationUtils->getLastUsername();
// flag this request in the session as external OAuth2 request if
// applicable to immediately logout the current user after successful
// authentication (see App\EventListener\AuthorizationCodeListener).
$session = $request->getSession();
$targetPath = $session->get('_security.main.target_path');
if (str_contains($targetPath, '/authorize')) {
$session->set('_oauth2', true);
}
return $this->render('security/login.html.twig', [
'last_username' => $lastUsername,
'error' => $error,
@@ -30,5 +40,6 @@ class SecurityController extends AbstractController
#[Route('/logout', name: 'app_logout')]
#[IsGranted('ROLE_USER')]
public function logout(): void
{}
}
{
}
}