wip: initial commit

src/BusProNet/Security/Authenticator.php

@@ -0,0 +1,104 @@
+<?php
+
+namespace App\BusProNet\Security;
+
+use App\BusProNet\ApiClient;
+use App\BusProNet\Exception\ApiClientException;
+use App\BusProNet\Model\CrmAttributes;
+use App\BusProNet\Model\CrmAttributesResponse;
+use App\BusProNet\Model\PersonalData;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
+use Symfony\Component\Security\Http\Authenticator\AbstractLoginFormAuthenticator;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\CsrfTokenBadge;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\RememberMeBadge;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
+use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
+use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
+use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
+
+class Authenticator extends AbstractLoginFormAuthenticator implements AuthenticationEntryPointInterface
+{
+    public function __construct(
+        private readonly UrlGeneratorInterface $urlGenerator,
+        private readonly ApiClient $apiClient,
+        private readonly LoggerInterface $logger,
+    ) {
+    }
+
+    protected function getLoginUrl(Request $request): string
+    {
+        return $this->urlGenerator->generate('app_login');
+    }
+
+    public function authenticate(Request $request): Passport
+    {
+        $email = trim($request->request->getString('_username'));
+        $passwordPlain = trim($request->request->getString('_password'));
+
+        // Very lame hashing applied here as required by BPN
+        $password = md5($passwordPlain);
+
+        try {
+            $response = $this->apiClient->getPersonalData($email, $password);
+        } catch (ApiClientException $e) {
+            throw new CustomUserMessageAuthenticationException($e->getMessage());
+        }
+
+        if (false === $response instanceof PersonalData) {
+            throw new CustomUserMessageAuthenticationException('User not found');
+        }
+
+        $csrfToken = $request->request->getString('_csrf_token');
+
+        return new SelfValidatingPassport(
+            new UserBadge($email, function () use ($email, $password, $response, $request) {
+                $crmAttributes = $this->apiClient->getCrmAttributes($email, $password);
+                $roles = $this->collectRoles($crmAttributes);
+                $user = new User($email, $response->personId, $response->addressId, $password, $roles);
+
+                $request->getSession()->set('bpn_user', $user);
+
+                return $user;
+            }),
+            [
+                new CsrfTokenBadge('authenticate', $csrfToken),
+                new RememberMeBadge(),
+            ]
+        );
+    }
+
+    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
+    {
+        $this->logger->info('Login', [
+            'email' => $token->getUserIdentifier(),
+        ]);
+
+        return new RedirectResponse($this->urlGenerator->generate('app_personal_data'));
+    }
+
+    private function collectRoles(CrmAttributes $crmAttributes): array
+    {
+        // Collect user's roles from CRM attributes
+        $roles = [];
+
+        if ($crmAttributes->admin) {
+            $roles[] = 'ROLE_ADMIN';
+        } elseif ($crmAttributes->manager) {
+            $roles[] = 'ROLE_MANAGER';
+        } elseif ($crmAttributes->houseManager) {
+            $roles[] = 'ROLE_HOUSE_MANAGER';
+        }
+
+        if ($crmAttributes->teamer) {
+            $roles[] = 'ROLE_TEAMER';
+        }
+
+        return $roles;
+    }
+}