fix: handle access denied errors properly

src/EventListener/AccessDeniedListener.php

@@ -4,9 +4,12 @@ declare(strict_types=1);
 
 namespace App\EventListener;
 
+use App\Htmx\HxRedirectResponse;
+use App\Security\DefaultRouteResolver;
 use Psr\Log\LoggerInterface;
 use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Session\Session;
 use Symfony\Component\HttpKernel\Event\ExceptionEvent;
 use Symfony\Component\HttpKernel\KernelEvents;
@@ -19,12 +22,17 @@ use Symfony\Component\Security\Core\Exception\AccessDeniedException;
  * anonymous users, or "Access denied" for authenticated users. Clears target
  * path for authenticated denials to prevent redirect loops. OAuth2 routes are
  * logged but allowed to pass through without modification.
+ *
+ * Authenticated users are redirected to their default route, where the flash
+ * message is shown. Anonymous users keep falling through to the firewall entry
+ * point, which sends them to the login form and preserves the target path.
  */
 class AccessDeniedListener implements EventSubscriberInterface
 {
     public function __construct(
         private readonly Security $security,
         private readonly LoggerInterface $authLogger,
+        private readonly DefaultRouteResolver $defaultRouteResolver,
     ) {
     }
 
@@ -58,16 +66,33 @@ class AccessDeniedListener implements EventSubscriberInterface
         /** @var Session $session */
         $session = $request->getSession();
 
-        if (null === $this->security->getUser()) {
-            $session->getFlashBag()->add('info', 'Bitte melde dich an.');
-        } else {
-            $session->getFlashBag()->add('error', 'Zugriff verweigert');
-            // Unset potentially set target path to avoid access denied errors
-            $session->remove('_security.main.target_path');
-        }
-
         $this->authLogger->warning('Access denied', [
             'uri' => $request->getRequestUri(),
         ]);
+
+        if (null === $this->security->getUser()) {
+            $session->getFlashBag()->add('info', 'Bitte melde dich an.');
+
+            return;
+        }
+
+        $session->getFlashBag()->add('error', 'Zugriff verweigert');
+        // Unset potentially set target path to avoid access denied errors
+        $session->remove('_security.main.target_path');
+
+        $url = $this->defaultRouteResolver->resolveUrl();
+
+        // The default route denied access itself, redirecting there would loop
+        if ($url === $request->getPathInfo()) {
+            return;
+        }
+
+        $event->setResponse(
+            $request->headers->has('HX-Request')
+                ? new HxRedirectResponse($url)
+                : new RedirectResponse($url)
+        );
+        // HxRedirectResponse carries a 200; without this the kernel turns it into a 500
+        $event->allowCustomResponseCode();
     }
 }

src/Security/BpnAuthenticator.php

@@ -53,6 +53,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         private readonly Crypt $crypt,
         private readonly ProfileCompletenessChecker $completenessChecker,
         private readonly LoggerInterface $authLogger,
+        private readonly DefaultRouteResolver $defaultRouteResolver,
     ) {
     }
 
@@ -174,7 +175,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         ]);
 
         $targetPath = $this->getTargetPath($request->getSession(), $firewallName)
-            ?? $this->urlGenerator->generate('app_account');
+            ?? $this->defaultRouteResolver->resolveUrl();
 
         // When redirecting to admin from an HTMX request, force a full page navigation
         // to avoid layout issues between frontend (hx-boost) and EasyAdmin

src/Security/DefaultRouteResolver.php

@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Security;
+
+use App\Security\Voter\AdministrativeAccessVoter;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
+
+/**
+ * Resolves the route a user belongs to when no specific destination is known.
+ *
+ * Used after login (when no target path was stored) and when access to a page is
+ * denied, so users land somewhere they are actually allowed to be instead of on an
+ * error page.
+ */
+class DefaultRouteResolver
+{
+    public function __construct(
+        private readonly AuthorizationCheckerInterface $authorizationChecker,
+        private readonly UrlGeneratorInterface $urlGenerator,
+    ) {
+    }
+
+    public function resolveRoute(): string
+    {
+        if ($this->authorizationChecker->isGranted(AdministrativeAccessVoter::ADMINISTRATIVE_ACCESS)) {
+            return 'app_admin_dashboard';
+        }
+
+        return 'app_account';
+    }
+
+    public function resolveUrl(): string
+    {
+        return $this->urlGenerator->generate($this->resolveRoute());
+    }
+}