feat: encrypted user passwords

src/Controller/Booking/EditController.php

@@ -4,12 +4,15 @@ namespace App\Controller\Booking;
 
 use App\BusProNet\ApiClient;
 use App\BusProNet\Exception\ApiClientException;
-use App\BusProNet\Exception\ResponseParserException;
 use App\BusProNet\Model\Notification;
+use App\BusProNet\Security\User;
 use App\BusProNet\XmlLoader\PickupLoader;
 use App\BusProNet\XmlLoader\TravelLoader;
+use App\Controller\Traits\BookingDataTrait;
+use App\Controller\Traits\CredentialsTrait;
 use App\Form\BookingType;
 use App\Form\Model\BookingData;
+use App\Security\Crypt;
 use Psr\Cache\InvalidArgumentException;
 use Psr\Log\LoggerInterface;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
@@ -19,16 +22,19 @@ use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Contracts\Cache\CacheInterface;
-use Symfony\Contracts\Cache\ItemInterface;
 
 class EditController extends AbstractController
 {
+    use CredentialsTrait;
+    use BookingDataTrait;
+
     public function __construct(
         private readonly ApiClient $apiClient,
         private readonly TravelLoader $travelDataLoader,
         private readonly PickupLoader $pickupDataLoader,
         private readonly CacheInterface $cache,
         private readonly Security $security,
+        private readonly Crypt $crypt,
         private readonly LoggerInterface $logger,
     ) {
     }
@@ -37,30 +43,22 @@ class EditController extends AbstractController
     #[IsGranted("ROLE_USER")]
     public function edit(int $id, Request $request): Response
     {
-        $bpnUser = $request->getSession()->get('bpn_user');
+        /** @var User $user */
+        $user = $this->getUser();
+        $email = $user->getEmail();
+        $password = $this->crypt->decrypt($user->getPassword());
 
-        if (null === $bpnUser) {
-            return $this->security->logout();
-        }
+        // Fetch original booking data via API and cache result for a short ttl
+        $bookingData = $this->fetchBookingData($email, $password, $id);
 
-        // Fetch original bookingData data via API and cache result for a short ttl
-        $cacheKey = sprintf('bpn_booking_%d', $id);
-        try {
-            $bookingData = $this->cache->get($cacheKey, function (ItemInterface $item) use ($bpnUser, $id) {
-                $item->expiresAfter(300);
-
-                return $this->apiClient->getBooking($bpnUser->getEmail(), $bpnUser->getPassword(), $id);
-            });
-        } catch (InvalidArgumentException $e) {
-            $bookingData = null;
-        }
-
-        if (null === $bookingData) {
+        if (null === $bookingData || $bookingData instanceof Notification) {
             $this->addFlash('error', 'Buchungsdaten nicht (mehr) verfügbar');
 
             return $this->redirectToRoute('app_bookings');
         }
 
+        $this->denyAccessUnlessGranted('EDIT', $bookingData);
+
         // Load according travel data
         $travelData = $this->travelDataLoader->loadById($bookingData->travelId);
 
@@ -104,7 +102,7 @@ class EditController extends AbstractController
 
         if ($form->isSubmitted() && $form->isValid()) {
             $this->logger->info('Initiated booking update', [
-                'email' => $bpnUser->getEmail(),
+                'email' => $email,
                 'booking_id' => $id,
             ]);
 
@@ -117,12 +115,13 @@ class EditController extends AbstractController
                         $this->addFlash('info', $response->message);
                     }
                     $this->logger->error('Booking update not successful', [
-                        'email' => $bpnUser->getEmail(),
+                        'email' => $email,
                         'booking_id' => $id,
                         'message' => $response->message,
                     ]);
                 } else {
                     try {
+                        $cacheKey = sprintf('bpn_booking_%d', $id);
                         $this->cache->delete($cacheKey);
                     } catch (InvalidArgumentException $e) {
                     }
@@ -130,7 +129,7 @@ class EditController extends AbstractController
                     $this->addFlash('success', 'Buchung erfolgreich aktualisiert');
 
                     $this->logger->info('Booking update successful', [
-                        'email' => $bpnUser->getEmail(),
+                        'email' => $email,
                         'booking_id' => $id,
                     ]);