feat: password grant

config/packages/league_oauth2_server.yaml

@@ -5,8 +5,8 @@ league_oauth2_server:
         encryption_key: '%env(resolve:OAUTH_ENCRYPTION_KEY)%'
         enable_client_credentials_grant: true
         enable_auth_code_grant: true
-        enable_refresh_token_grant: false
-        enable_password_grant: false
+        enable_refresh_token_grant: true
+        enable_password_grant: true
         access_token_ttl: PT10M
     resource_server:
         public_key: '%env(resolve:OAUTH_PUBLIC_KEY)%'

config/services.yaml

@@ -261,3 +261,7 @@ services:
             $apiBaseUrl: '%env(default::MAILJET_API_BASE_URL)%'
             $defaultListId: '%env(default::MAILJET_DEFAULT_LIST_ID)%'
             $contactMetadataFields: '%mailjet_contact_metadata_fields%'
+
+    App\EventListener\UserResolverListener:
+        arguments:
+            $userProvider: '@security.user_providers'

src/EventListener/UserResolverListener.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\EventListener;
+
+use App\Security\Crypt;
+use League\Bundle\OAuth2ServerBundle\Event\UserResolveEvent;
+use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
+use Symfony\Component\Security\Core\User\UserProviderInterface;
+
+#[AsEventListener(event: 'league.oauth2_server.event.user_resolve', method: 'onUserResolve')]
+final class UserResolverListener
+{
+    public function __construct(
+        private readonly UserProviderInterface $userProvider,
+        private readonly Crypt $crypt,
+    ) {
+    }
+
+    public function onUserResolve(UserResolveEvent $event): void
+    {
+        try {
+            $user = $this->userProvider->loadUserByIdentifier($event->getUsername());
+        } catch (AuthenticationException $e) {
+            return;
+        }
+
+        if (!$user instanceof PasswordAuthenticatedUserInterface) {
+            return;
+        }
+
+        $passwordHash = $this->crypt->decrypt($user->getPassword());
+
+        if ($passwordHash !== md5($event->getPassword())) {
+            return;
+        }
+
+        $event->setUser($user);
+    }
+}