EP/myep
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: encrypted user passwords

Browse Source
This commit is contained in:
Björn Fromme
2025-04-24 12:26:42 +02:00
parent 5fe88fc0f2
commit fb6665668b
16 changed files with 292 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Controller/Booking/DownloadController.php
+28 -11
View File
@@ -5,22 +5,29 @@ namespace App\Controller\Booking;
use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Model\Notification;
use App\BusProNet\Security\User;
use App\Controller\Traits\BookingDataTrait;
use App\Controller\Traits\CredentialsTrait;
use App\Security\Crypt;
use Psr\Log\LoggerInterface;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpFoundation\ResponseHeaderBag;
use Symfony\Component\HttpFoundation\StreamedResponse;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;
use Symfony\Contracts\Cache\CacheInterface;
use function Symfony\Component\String\u;
class DownloadController extends AbstractController
{
use CredentialsTrait;
use BookingDataTrait;
public function __construct(
private readonly ApiClient $apiClient,
private readonly Security $security,
private readonly CacheInterface $cache,
private readonly Crypt $crypt,
private readonly LoggerInterface $logger,
) {
}
@@ -38,13 +45,12 @@ class DownloadController extends AbstractController
defaults: ['fileType' => 'invoice']
)]
#[IsGranted("ROLE_USER")]
public function documents(int $id, string $fileType, Request $request): Response
public function documents(int $id, string $fileType): Response
{
$bpnUser = $request->getSession()->get('bpn_user');
if (null === $bpnUser) {
return $this->security->logout();
}
/** @var User $user */
$user = $this->getUser();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
$type = match ($fileType) {
'documents' => 'Dokumentdruck',
@@ -52,15 +58,26 @@ class DownloadController extends AbstractController
};
$this->logger->info('Initiated document download', [
'email' => $bpnUser->getEmail(),
'email' => $email,
'document_type' => $fileType,
'booking_id' => $id,
]);
// Fetch booking data via API and cache result for a short ttl to check permissions
$bookingData = $this->fetchBookingData($email, $password, $id);
if (null === $bookingData || $bookingData instanceof Notification) {
$this->addFlash('error', 'Buchungsdaten nicht (mehr) verfügbar');
return $this->redirectToRoute('app_bookings');
}
$this->denyAccessUnlessGranted('VIEW', $bookingData);
try {
$file = $this
->apiClient
->getDocuments($bpnUser->getEmail(), $bpnUser->getPassword(), $id, $type);
->getDocuments($email, $password, $id, $type);
} catch (ApiClientException $e) {
$file = null;
}
src/Controller/Booking/EditController.php
+21 -22
View File
@@ -4,12 +4,15 @@ namespace App\Controller\Booking;
use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Exception\ResponseParserException;
use App\BusProNet\Model\Notification;
use App\BusProNet\Security\User;
use App\BusProNet\XmlLoader\PickupLoader;
use App\BusProNet\XmlLoader\TravelLoader;
use App\Controller\Traits\BookingDataTrait;
use App\Controller\Traits\CredentialsTrait;
use App\Form\BookingType;
use App\Form\Model\BookingData;
use App\Security\Crypt;
use Psr\Cache\InvalidArgumentException;
use Psr\Log\LoggerInterface;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
@@ -19,16 +22,19 @@ use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;
use Symfony\Contracts\Cache\CacheInterface;
use Symfony\Contracts\Cache\ItemInterface;
class EditController extends AbstractController
{
use CredentialsTrait;
use BookingDataTrait;
public function __construct(
private readonly ApiClient $apiClient,
private readonly TravelLoader $travelDataLoader,
private readonly PickupLoader $pickupDataLoader,
private readonly CacheInterface $cache,
private readonly Security $security,
private readonly Crypt $crypt,
private readonly LoggerInterface $logger,
) {
}
@@ -37,30 +43,22 @@ class EditController extends AbstractController
#[IsGranted("ROLE_USER")]
public function edit(int $id, Request $request): Response
{
$bpnUser = $request->getSession()->get('bpn_user');
/** @var User $user */
$user = $this->getUser();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
if (null === $bpnUser) {
return $this->security->logout();
}
// Fetch original booking data via API and cache result for a short ttl
$bookingData = $this->fetchBookingData($email, $password, $id);
// Fetch original bookingData data via API and cache result for a short ttl
$cacheKey = sprintf('bpn_booking_%d', $id);
try {
$bookingData = $this->cache->get($cacheKey, function (ItemInterface $item) use ($bpnUser, $id) {
$item->expiresAfter(300);
return $this->apiClient->getBooking($bpnUser->getEmail(), $bpnUser->getPassword(), $id);
});
} catch (InvalidArgumentException $e) {
$bookingData = null;
}
if (null === $bookingData) {
if (null === $bookingData || $bookingData instanceof Notification) {
$this->addFlash('error', 'Buchungsdaten nicht (mehr) verfügbar');
return $this->redirectToRoute('app_bookings');
}
$this->denyAccessUnlessGranted('EDIT', $bookingData);
// Load according travel data
$travelData = $this->travelDataLoader->loadById($bookingData->travelId);
@@ -104,7 +102,7 @@ class EditController extends AbstractController
if ($form->isSubmitted() && $form->isValid()) {
$this->logger->info('Initiated booking update', [
'email' => $bpnUser->getEmail(),
'email' => $email,
'booking_id' => $id,
]);
@@ -117,12 +115,13 @@ class EditController extends AbstractController
$this->addFlash('info', $response->message);
}
$this->logger->error('Booking update not successful', [
'email' => $bpnUser->getEmail(),
'email' => $email,
'booking_id' => $id,
'message' => $response->message,
]);
} else {
try {
$cacheKey = sprintf('bpn_booking_%d', $id);
$this->cache->delete($cacheKey);
} catch (InvalidArgumentException $e) {
}
@@ -130,7 +129,7 @@ class EditController extends AbstractController
$this->addFlash('success', 'Buchung erfolgreich aktualisiert');
$this->logger->info('Booking update successful', [
'email' => $bpnUser->getEmail(),
'email' => $email,
'booking_id' => $id,
]);
src/Controller/Booking/IndexController.php
+12 -8
View File
@@ -6,10 +6,12 @@ use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Model\BaseData;
use App\BusProNet\Model\Notification;
use App\BusProNet\Security\User;
use App\BusProNet\XmlLoader\TravelLoader;
use App\Controller\Traits\CredentialsTrait;
use App\Security\Crypt;
use Psr\Log\LoggerInterface;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
@@ -17,10 +19,12 @@ use Symfony\Component\Security\Http\Attribute\IsGranted;
class IndexController extends AbstractController
{
use CredentialsTrait;
public function __construct(
private readonly ApiClient $apiClient,
private readonly TravelLoader $travelDataLoader,
private readonly Security $security,
private readonly Crypt $crypt,
private readonly LoggerInterface $logger,
) {
}
@@ -29,14 +33,13 @@ class IndexController extends AbstractController
#[IsGranted("ROLE_USER")]
public function index(Request $request): Response
{
$bpnUser = $request->getSession()->get('bpn_user');
if (null === $bpnUser) {
return $this->security->logout();
}
/** @var User $user */
$user = $this->getUser();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
try {
$bookings = $this->apiClient->getBookings($bpnUser->getEmail(), $bpnUser->getPassword());
$bookings = $this->apiClient->getBookings($email, $password);
} catch (ApiClientException $e) {
$this->addFlash('error', 'Buchungen nicht abrufbar');
$bookings = new BaseData([]);
@@ -44,6 +47,7 @@ class IndexController extends AbstractController
if ($bookings instanceof Notification) {
$this->logger->error('Unable to fetch bookings data', [
'email' => $email,
'code' => $bookings->code,
'error' => $bookings->message,
]);
src/Controller/PersonalDataController.php
+21 -19
View File
@@ -6,10 +6,12 @@ use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Model\Notification;
use App\BusProNet\Model\PersonalData;
use App\BusProNet\Security\User;
use App\Controller\Traits\CredentialsTrait;
use App\Form\PersonalDataType;
use App\Security\Crypt;
use Psr\Log\LoggerInterface;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
@@ -17,9 +19,11 @@ use Symfony\Component\Security\Http\Attribute\IsGranted;
class PersonalDataController extends AbstractController
{
use CredentialsTrait;
public function __construct(
private readonly ApiClient $apiClient,
private readonly Security $security,
private readonly Crypt $crypt,
private readonly LoggerInterface $logger,
) {
}
@@ -28,16 +32,15 @@ class PersonalDataController extends AbstractController
#[IsGranted('ROLE_USER')]
public function index(Request $request): Response
{
$bpnUser = $request->getSession()->get('bpn_user');
if (null === $bpnUser) {
return $this->security->logout();
}
/** @var User $user */
$user = $this->getUser();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
try {
$personalData = $this
->apiClient
->getPersonalData($bpnUser->getEmail(), $bpnUser->getPassword());
->getPersonalData($email, $password);
} catch (ApiClientException $e) {
$this->addFlash('error', 'Deine persönlichen Daten konnten nicht abgerufen werden');
$personalData = new PersonalData();
@@ -61,10 +64,10 @@ class PersonalDataController extends AbstractController
if ($personalDataForm->isSubmitted() && $personalDataForm->isValid()) {
try {
$this->apiClient->updatePersonalData($bpnUser->getEmail(), $bpnUser->getPassword(), $personalData);
$this->apiClient->updatePersonalData($email, $password, $personalData);
$this->addFlash('success', 'Deine persönlichen Daten wurden aktualisiert');
$this->logger->info('Updated personal data', [
'email' => $bpnUser->getEmail(),
'email' => $user->getEmail(),
]);
} catch (ApiClientException $e) {
$this->addFlash('error', $e->getMessage());
@@ -81,18 +84,17 @@ class PersonalDataController extends AbstractController
#[Route('/personal-data/newsletter', name: 'app_personal_data_newsletter', methods: ['POST'])]
#[IsGranted('ROLE_USER')]
public function newsletter(Request $request): Response
public function newsletter(): Response
{
$bpnUser = $request->getSession()->get('bpn_user');
if (null === $bpnUser) {
return $this->security->logout();
}
/** @var User $user */
$user = $this->getUser();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
try {
$personalData = $this
->apiClient
->getPersonalData($bpnUser->getEmail(), $bpnUser->getPassword());
->getPersonalData($email, $password);
} catch (ApiClientException $e) {
$this->addFlash('error', 'Deine persönlichen Daten konnten nicht abgerufen werden');
$personalData = new PersonalData();
@@ -101,10 +103,10 @@ class PersonalDataController extends AbstractController
$personalData->communication->newsletter = !$personalData->communication->newsletter;
try {
$this->apiClient->updateNewsletterRegistration($bpnUser->getEmail(), $bpnUser->getPassword(), $personalData);
$this->apiClient->updateNewsletterRegistration($email, $password, $personalData);
$this->addFlash('success', 'Deine Anmeldung zum Newsletter wurde aktualisiert');
$this->logger->info('Updated newsletter registration', [
'email' => $bpnUser->getEmail(),
'email' => $user->getEmail(),
]);
} catch (ApiClientException $e) {
$this->addFlash('error', $e->getMessage());
src/Controller/Traits/BookingDataTrait.php
+28
View File
@@ -0,0 +1,28 @@
<?php
namespace App\Controller\Traits;
use App\BusProNet\Model\Booking;
use App\BusProNet\Model\Notification;
use Psr\Cache\InvalidArgumentException;
use Symfony\Contracts\Cache\ItemInterface;
trait BookingDataTrait
{
public function fetchBookingData(string $email, string $password, int $id): Booking|Notification|null
{
// Fetch booking data via API and cache result for a short ttl to check permissions
$cacheKey = sprintf('bpn_booking_%d', $id);
try {
$bookingData = $this->cache->get($cacheKey, function (ItemInterface $item) use ($email, $password, $id) {
$item->expiresAfter(300);
return $this->apiClient->getBooking($email, $password, $id);
});
} catch (InvalidArgumentException $e) {
$bookingData = null;
}
return $bookingData;
}
}
src/Controller/Traits/CredentialsTrait.php
+16
View File
@@ -0,0 +1,16 @@
<?php
namespace App\Controller\Traits;
use App\BusProNet\Security\User;
use App\Security\Crypt;
trait CredentialsTrait
{
public function getPasswordPlain(User $bpnUser, string $pathToKeys): string
{
$crypt = new Crypt($pathToKeys);
return $crypt->decrypt($bpnUser->getPassword());
}
}