From c37309b3c130d4828bcd7272b31207c86688763d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <fromme@dreipunktnull.com>
Date: Mon, 28 Apr 2025 11:10:35 +0200
Subject: [PATCH] feat: improved handling and logging of access denied errors

---
 config/packages/monolog.yaml               | 19 +++++++++++++++----
 src/EventListener/AccessDeniedListener.php | 18 ++++++++++++------
 src/Security/BpnAuthenticator.php          |  4 ++--
 3 files changed, 29 insertions(+), 12 deletions(-)

diff --git a/config/packages/monolog.yaml b/config/packages/monolog.yaml
index 9a2f4d8..de3f427 100644
--- a/config/packages/monolog.yaml
+++ b/config/packages/monolog.yaml
@@ -3,6 +3,7 @@ monolog:
         - deprecation # Deprecations are logged in the dedicated "deprecation" channel when it exists
         - bpn
         - core
+        - auth
 
 when@dev:
     monolog:
@@ -10,12 +11,17 @@ when@dev:
             database:
                 type: service
                 id: App\Logger\DatabaseHandler
-                channels: ["core", "bpn"]
+                channels: ["core", "bpn", "auth"]
             bpn:
                 type: stream
                 path: "%kernel.logs_dir%/%kernel.environment%.bpn.log"
                 level: debug
                 channels: ["bpn"]
+            auth:
+                type: stream
+                path: "%kernel.logs_dir%/%kernel.environment%.auth.log"
+                level: debug
+                channels: ["auth"]
             core:
                 type: stream
                 path: "%kernel.logs_dir%/%kernel.environment%.core.log"
@@ -25,7 +31,7 @@ when@dev:
                 type: stream
                 path: "%kernel.logs_dir%/%kernel.environment%.log"
                 level: debug
-                channels: ["!event", "!bpn", "!core"]
+                channels: ["!event", "!bpn", "!core", "!auth"]
             # uncomment to get logging in your browser
             # you may have to allow bigger header sizes in your Web server configuration
             #firephp:
@@ -59,13 +65,18 @@ when@prod:
             database:
                 type: service
                 id: App\Logger\DatabaseHandler
-                channels: ["core", "bpn"]
+                channels: ["core", "bpn", "auth"]
             bpn:
                 type: rotating_file
                 max_files: 7
                 path: "%kernel.logs_dir%/%kernel.environment%.bpn.log"
                 level: info
                 channels: ["bpn"]
+            auth:
+                type: stream
+                path: "%kernel.logs_dir%/%kernel.environment%.auth.log"
+                level: debug
+                channels: ["auth"]
             core:
                 type: rotating_file
                 max_files: 7
@@ -78,7 +89,7 @@ when@prod:
                 handler: nested
                 excluded_http_codes: [404, 405]
                 buffer_size: 50 # How many messages should be saved? Prevent memory leaks
-                channels: ["!bpn", "!core"]
+                channels: ["!bpn", "!core", "!auth"]
             nested:
                 type: rotating_file
                 path: "%kernel.logs_dir%/%kernel.environment%.framework.log"
diff --git a/src/EventListener/AccessDeniedListener.php b/src/EventListener/AccessDeniedListener.php
index f4059a6..a5e27fc 100644
--- a/src/EventListener/AccessDeniedListener.php
+++ b/src/EventListener/AccessDeniedListener.php
@@ -4,20 +4,26 @@ namespace App\EventListener;
 
 use Psr\Log\LoggerInterface;
 use Symfony\Bundle\SecurityBundle\Security;
-use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\HttpKernel\Event\ExceptionEvent;
 use Symfony\Component\HttpKernel\KernelEvents;
 use Symfony\Component\Security\Core\Exception\AccessDeniedException;
 
-#[AsEventListener(event: KernelEvents::EXCEPTION, method: 'onKernelException', priority: 2)]
-class AccessDeniedListener
+class AccessDeniedListener implements EventSubscriberInterface
 {
     public function __construct(
         private readonly Security $security,
-        private readonly LoggerInterface $logger,
+        private readonly LoggerInterface $authLogger,
     ) {
     }
 
+    public static function getSubscribedEvents(): array
+    {
+        return [
+            KernelEvents::EXCEPTION => ['onKernelException', 2],
+        ];
+    }
+
     public function onKernelException(ExceptionEvent $event): void
     {
         $exception = $event->getThrowable();
@@ -33,7 +39,7 @@ class AccessDeniedListener
         if (in_array($route, ['oauth2_authorize', 'oauth2_token'])) {
             $request->getSession()->getFlashBag()->add('info', 'Bitte melde dich an.');
 
-            $this->logger->info('OAuth2 authorization request', [
+            $this->authLogger->info('OAuth2 authorization request', [
                 'uri' => $request->getRequestUri(),
             ]);
 
@@ -48,7 +54,7 @@ class AccessDeniedListener
             $request->getSession()->remove('_security.main.target_path');
         }
 
-        $this->logger->warning('Access denied', [
+        $this->authLogger->warning('Access denied', [
             'uri' => $request->getRequestUri(),
         ]);
     }
diff --git a/src/Security/BpnAuthenticator.php b/src/Security/BpnAuthenticator.php
index 13470e1..756e796 100644
--- a/src/Security/BpnAuthenticator.php
+++ b/src/Security/BpnAuthenticator.php
@@ -33,7 +33,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
         private readonly ApiClient $apiClient,
         private readonly EntityManagerInterface $entityManager,
         private readonly Crypt $crypt,
-        private readonly LoggerInterface $logger,
+        private readonly LoggerInterface $authLogger,
     ) {
     }
 
@@ -106,7 +106,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
 
     public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
     {
-        $this->logger->info('Login', [
+        $this->authLogger->info('Login', [
             'email' => $token->getUserIdentifier(),
         ]);