feat: encrypted user passwords

src/Controller/Booking/DownloadController.php

@@ -5,22 +5,29 @@ namespace App\Controller\Booking;
 use App\BusProNet\ApiClient;
 use App\BusProNet\Exception\ApiClientException;
 use App\BusProNet\Model\Notification;
+use App\BusProNet\Security\User;
+use App\Controller\Traits\BookingDataTrait;
+use App\Controller\Traits\CredentialsTrait;
+use App\Security\Crypt;
 use Psr\Log\LoggerInterface;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
-use Symfony\Bundle\SecurityBundle\Security;
-use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpFoundation\ResponseHeaderBag;
 use Symfony\Component\HttpFoundation\StreamedResponse;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
+use Symfony\Contracts\Cache\CacheInterface;
 use function Symfony\Component\String\u;
 
 class DownloadController extends AbstractController
 {
+    use CredentialsTrait;
+    use BookingDataTrait;
+
     public function __construct(
         private readonly ApiClient $apiClient,
-        private readonly Security $security,
+        private readonly CacheInterface $cache,
+        private readonly Crypt $crypt,
         private readonly LoggerInterface $logger,
     ) {
     }
@@ -38,13 +45,12 @@ class DownloadController extends AbstractController
         defaults: ['fileType' => 'invoice']
     )]
     #[IsGranted("ROLE_USER")]
-    public function documents(int $id, string $fileType, Request $request): Response
+    public function documents(int $id, string $fileType): Response
     {
-        $bpnUser = $request->getSession()->get('bpn_user');
-
-        if (null === $bpnUser) {
-            return $this->security->logout();
-        }
+        /** @var User $user */
+        $user = $this->getUser();
+        $email = $user->getEmail();
+        $password = $this->crypt->decrypt($user->getPassword());
 
         $type = match ($fileType) {
             'documents' => 'Dokumentdruck',
@@ -52,15 +58,26 @@ class DownloadController extends AbstractController
         };
 
         $this->logger->info('Initiated document download', [
-            'email' => $bpnUser->getEmail(),
+            'email' => $email,
             'document_type' => $fileType,
             'booking_id' => $id,
         ]);
 
+        // Fetch booking data via API and cache result for a short ttl to check permissions
+        $bookingData = $this->fetchBookingData($email, $password, $id);
+
+        if (null === $bookingData || $bookingData instanceof Notification) {
+            $this->addFlash('error', 'Buchungsdaten nicht (mehr) verfügbar');
+
+            return $this->redirectToRoute('app_bookings');
+        }
+
+        $this->denyAccessUnlessGranted('VIEW', $bookingData);
+
         try {
             $file = $this
                 ->apiClient
-                ->getDocuments($bpnUser->getEmail(), $bpnUser->getPassword(), $id, $type);
+                ->getDocuments($email, $password, $id, $type);
         } catch (ApiClientException $e) {
             $file = null;
         }