EP/myep
4
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: local password hashes

Browse Source
This commit is contained in:
Björn Fromme committed 2026-06-23 16:27:08 +02:00
1 parent 08f6633507
commit fe562e5e73
15 files changed
+541 -253
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/BusProNet/ApiClient.php
+115 -101
View File
@@ -35,20 +35,20 @@ use Symfony\Component\Serializer\SerializerInterface;
class ApiClient
{
public const TYPE_NOTIFICATION = 'HINWEIS';
public const TYPE_CUSTOMER_DATA = 'KUNDENKONTO';
public const TYPE_BASE_DATA_COUNTRIES = 'STAMMLAENDER';
public const TYPE_MUTABLE_DATA = 'MOEGLICHEAENDERUNGEN';
public const TYPE_AVAILABILITY = 'VERFUEGBARKEIT';
public const TYPE_AVAILABILITY_EXTENDED = 'VERFUEGBARKEIT2';
public const TYPE_AVAILABILITY_HOTEL = 'VERFUEGBARKEITHOTEL';
public const TYPE_BOOKING_UPDATE = 'BUCHUNGAENDERUNG';
public const TYPE_BOOKING = 'BUCHUNG';
public const TYPE_PRODUCTS = 'PRODUKTE';
public const TYPE_PRODUCT_DATA = 'PRODUKTDATEN';
public const TYPE_AGENCIES = 'AGENTUREN';
public const TYPE_PURCHASE_VOUCHER = 'GUTSCHEINPRUEFUNGEINLOESUNG';
public const TYPE_PROMO_VOUCHER = 'AKTIONSGUTSCHEIN';
public const string TYPE_NOTIFICATION = 'HINWEIS';
public const string TYPE_CUSTOMER_DATA = 'KUNDENKONTO';
public const string TYPE_BASE_DATA_COUNTRIES = 'STAMMLAENDER';
public const string TYPE_MUTABLE_DATA = 'MOEGLICHEAENDERUNGEN';
public const string TYPE_AVAILABILITY = 'VERFUEGBARKEIT';
public const string TYPE_AVAILABILITY_EXTENDED = 'VERFUEGBARKEIT2';
public const string TYPE_AVAILABILITY_HOTEL = 'VERFUEGBARKEITHOTEL';
public const string TYPE_BOOKING_UPDATE = 'BUCHUNGAENDERUNG';
public const string TYPE_BOOKING = 'BUCHUNG';
public const string TYPE_PRODUCTS = 'PRODUKTE';
public const string TYPE_PRODUCT_DATA = 'PRODUKTDATEN';
public const string TYPE_AGENCIES = 'AGENTUREN';
public const string TYPE_PURCHASE_VOUCHER = 'GUTSCHEINPRUEFUNGEINLOESUNG';
public const string TYPE_PROMO_VOUCHER = 'AKTIONSGUTSCHEIN';
/** @var array<string, mixed> */
private array $config;
@@ -73,16 +73,19 @@ class ApiClient
/**
* @throws ApiClientException
*/
public function getPersonalData(string $email, string $password): Notification|PersonalData
public function getPersonalData(string $email, ?int $addressId = null, ?int $personId = null): Notification|PersonalData
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_CUSTOMER_DATA),
'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
'art' => 'Adressdaten',
'email' => $email,
'passwort' => $password,
];
$data = $this->buildCustomerDataRequestData($email, 'Adressdaten', $addressId, $personId);
return $this->sendRequest(static::TYPE_CUSTOMER_DATA, $data);
}
/**
* @throws ApiClientException
*/
public function getPersonalDataWithPassword(string $email, string $password): Notification|PersonalData
{
$data = $this->buildCustomerDataRequestData($email, 'Adressdaten', password: $password);
return $this->sendRequest(static::TYPE_CUSTOMER_DATA, $data);
}
@@ -94,7 +97,7 @@ class ApiClient
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_CUSTOMER_DATA),
'key' => $this->createKey(static::TYPE_CUSTOMER_DATA),
'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
'art' => 'Adresse_Neu',
'adressdaten' => $registrationData->toPayload(),
@@ -110,7 +113,7 @@ class ApiClient
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_CUSTOMER_DATA),
'key' => $this->createKey(static::TYPE_CUSTOMER_DATA),
'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
'art' => 'Passwort_Anfrage',
'email' => $email,
@@ -124,21 +127,19 @@ class ApiClient
*/
public function updatePersonalData(
string $email,
string $password,
PersonalData $personalData,
bool $debug = false,
): Notification|PersonalData {
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_CUSTOMER_DATA),
'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
'art' => 'Adressdaten_Ändern',
'email' => $email,
'passwort' => $password,
'idadresse' => $personalData->addressId,
'adressdaten' => $personalData->toPayload(),
];
$data = array_merge(
$this->buildCustomerDataRequestData($email, 'Adressdaten_Ändern', $personalData->addressId, $personalData->personId),
$data
);
return $this->sendRequest(static::TYPE_CUSTOMER_DATA, $data, [], $debug);
}
@@ -151,7 +152,7 @@ class ApiClient
): RegistrationResponse|Notification {
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_CUSTOMER_DATA),
'key' => $this->createKey(static::TYPE_CUSTOMER_DATA),
'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
'art' => 'Adresse_Neu',
'adressdaten' => $personalData->toPayload(false),
@@ -164,21 +165,18 @@ class ApiClient
/**
* @throws ApiClientException
*/
public function updateNewsletterRegistration(string $email, string $password, PersonalData $personalData): Notification|PersonalData
public function updateNewsletterRegistration(string $email, PersonalData $personalData): Notification|PersonalData
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_CUSTOMER_DATA),
'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
$data = array_merge(
$this->buildCustomerDataRequestData($email, 'Newsletter', $personalData->addressId, $personalData->personId),
[
'art' => 'Newsletter',
'email' => $email,
'passwort' => $password,
'idadresse' => $personalData->addressId,
'newsletter' => [
'email' => $email,
'anmeldung' => $personalData->communication->newsletter ? 'True' : 'False',
],
];
]
);
return $this->sendRequest(static::TYPE_CUSTOMER_DATA, $data);
}
@@ -186,16 +184,9 @@ class ApiClient
/**
* @throws ApiClientException
*/
public function getBookings(string $email, string $password): Notification|BaseData
public function getBookings(string $email, ?int $addressId = null, ?int $personId = null): Notification|BaseData
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_CUSTOMER_DATA),
'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
'art' => 'Vorgänge',
'email' => $email,
'passwort' => $password,
];
$data = $this->buildCustomerDataRequestData($email, 'Vorgänge', $addressId, $personId);
return $this->sendRequest(static::TYPE_CUSTOMER_DATA, $data);
}
@@ -203,17 +194,14 @@ class ApiClient
/**
* @throws ApiClientException
*/
public function getBooking(string $email, string $password, int $id): Notification|Booking
public function getBooking(string $email, int $id, ?int $addressId = null, ?int $personId = null): Notification|Booking
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_CUSTOMER_DATA),
'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
'art' => 'Vorgang_Details',
'email' => $email,
'passwort' => $password,
'idbuchung' => $id,
];
$data = array_merge(
$this->buildCustomerDataRequestData($email, 'Vorgang_Details', $addressId, $personId),
[
'idbuchung' => $id,
]
);
return $this->sendRequest(static::TYPE_CUSTOMER_DATA, $data);
}
@@ -227,7 +215,7 @@ class ApiClient
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_BOOKING_UPDATE),
'key' => $this->createKey(static::TYPE_BOOKING_UPDATE),
'satz' => ['@typ' => static::TYPE_BOOKING_UPDATE],
'buchungsart' => Constants::BOOKING_TYPE_BOOKING,
...$payload,
@@ -255,7 +243,7 @@ class ApiClient
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_BOOKING),
'key' => $this->createKey(static::TYPE_BOOKING),
'satz' => ['@typ' => static::TYPE_BOOKING],
...$payload,
];
@@ -282,7 +270,7 @@ class ApiClient
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_BOOKING),
'key' => $this->createKey(static::TYPE_BOOKING),
'satz' => ['@typ' => static::TYPE_BOOKING],
...$payload,
];
@@ -297,7 +285,7 @@ class ApiClient
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_MUTABLE_DATA),
'key' => $this->createKey(static::TYPE_MUTABLE_DATA),
'satz' => ['@typ' => static::TYPE_MUTABLE_DATA],
'idreise' => $dateId,
];
@@ -312,7 +300,7 @@ class ApiClient
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_AVAILABILITY),
'key' => $this->createKey(static::TYPE_AVAILABILITY),
'satz' => ['@typ' => static::TYPE_AVAILABILITY],
'idreise' => $dateId,
];
@@ -327,7 +315,7 @@ class ApiClient
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_AVAILABILITY_EXTENDED),
'key' => $this->createKey(static::TYPE_AVAILABILITY_EXTENDED),
'satz' => ['@typ' => static::TYPE_AVAILABILITY_EXTENDED],
'idreise' => $dateId,
];
@@ -342,7 +330,7 @@ class ApiClient
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_AVAILABILITY_HOTEL),
'key' => $this->createKey(static::TYPE_AVAILABILITY_HOTEL),
'satz' => ['@typ' => static::TYPE_AVAILABILITY_HOTEL],
'idreise' => $dateId,
'idpartner' => $hotelId,
@@ -355,16 +343,19 @@ class ApiClient
/**
* @throws ApiClientException
*/
public function getCrmAttributes(string $email, string $password): Notification|CrmAttributes
public function getCrmAttributes(string $email, ?int $addressId = null, ?int $personId = null): Notification|CrmAttributes
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_CUSTOMER_DATA),
'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
'art' => 'SelektionCRM',
'email' => $email,
'passwort' => $password,
];
$data = $this->buildCustomerDataRequestData($email, 'SelektionCRM', $addressId, $personId);
return $this->sendRequest(static::TYPE_CUSTOMER_DATA, $data);
}
/**
* @throws ApiClientException
*/
public function getCrmAttributesWithPassword(string $email, string $password): Notification|CrmAttributes
{
$data = $this->buildCustomerDataRequestData($email, 'SelektionCRM', password: $password);
return $this->sendRequest(static::TYPE_CUSTOMER_DATA, $data);
}
@@ -376,7 +367,7 @@ class ApiClient
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], $type),
'key' => $this->createKey($type),
'satz' => ['@typ' => $type],
];
@@ -386,17 +377,14 @@ class ApiClient
/**
* @throws ApiClientException
*/
public function getDocuments(string $email, string $password, int $bookingId, string $type): mixed
public function getDocuments(string $email, int $bookingId, string $type, ?int $addressId = null, ?int $personId = null): mixed
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_CUSTOMER_DATA),
'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
'art' => $type,
'email' => $email,
'passwort' => $password,
'idbuchung' => $bookingId,
];
$data = array_merge(
$this->buildCustomerDataRequestData($email, $type, $addressId, $personId),
[
'idbuchung' => $bookingId,
]
);
return $this->sendRequest(static::TYPE_CUSTOMER_DATA, $data);
}
@@ -408,7 +396,7 @@ class ApiClient
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_PRODUCT_DATA),
'key' => $this->createKey(static::TYPE_PRODUCT_DATA),
'satz' => ['@typ' => static::TYPE_PRODUCT_DATA],
'idprodukt' => $travelId,
];
@@ -432,7 +420,7 @@ class ApiClient
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_PRODUCT_DATA),
'key' => $this->createKey(static::TYPE_PRODUCT_DATA),
'satz' => ['@typ' => static::TYPE_PRODUCT_DATA],
'idprodukt' => $travelId,
];
@@ -447,7 +435,7 @@ class ApiClient
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_PRODUCTS),
'key' => $this->createKey(static::TYPE_PRODUCTS),
'satz' => ['@typ' => static::TYPE_PRODUCTS],
];
@@ -468,7 +456,7 @@ class ApiClient
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_AGENCIES),
'key' => $this->createKey(static::TYPE_AGENCIES),
'satz' => ['@typ' => static::TYPE_AGENCIES],
];
@@ -492,7 +480,7 @@ class ApiClient
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_PURCHASE_VOUCHER),
'key' => $this->createKey(static::TYPE_PURCHASE_VOUCHER),
'satz' => ['@typ' => static::TYPE_PURCHASE_VOUCHER],
'einloesecode' => $redemptionCode,
];
@@ -521,7 +509,7 @@ class ApiClient
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey($this->config['bpn_username'], $this->config['bpn_password'], static::TYPE_PROMO_VOUCHER),
'key' => $this->createKey(static::TYPE_PROMO_VOUCHER),
'satz' => ['@typ' => static::TYPE_PROMO_VOUCHER],
'aktionsgutschein' => $promoCode,
'idreise' => $travelId,
@@ -531,6 +519,36 @@ class ApiClient
return $this->sendRequest(static::TYPE_PROMO_VOUCHER, $data);
}
/**
* @return array<string, mixed>
*/
private function buildCustomerDataRequestData(string $email, string $art, ?int $addressId = null, ?int $personId = null, ?string $password = null): array
{
$data = [
'user' => $this->config['bpn_username'],
'key' => $this->createKey(static::TYPE_CUSTOMER_DATA),
'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
'art' => $art,
'email' => $email,
'login' => 'J',
];
if (null !== $addressId) {
$data['idadresse'] = $addressId;
}
if (null !== $personId) {
$data['idadresseperson'] = $personId;
}
if (null !== $password) {
$data['passwort'] = $password;
unset($data['login']);
}
return $data;
}
/**
* Sends raw XML to the BPN API with key regeneration and automatic retry.
*
@@ -580,11 +598,7 @@ class ApiClient
throw new ApiClientException('Missing <key> element in XML');
}
$newKey = $this->createKey(
$this->config['bpn_username'],
$this->config['bpn_password'],
$type
);
$newKey = $this->createKey($type);
$keyNode->nodeValue = $newKey;
$body = $doc->saveXML();
@@ -800,11 +814,11 @@ class ApiClient
return $baseId.'_'.++$this->requestCounter;
}
private function createKey(string $username, string $password, string $type): string
private function createKey(string $type): string
{
$date = (new \DateTimeImmutable())->format('Ymd');
return md5($username.$password.$date.$type);
return md5($this->config['bpn_username'].$this->config['bpn_password'].$date.$type);
}
/**
src/Controller/Account/PersonalDataController.php
+2 -7
View File
@@ -13,7 +13,6 @@ use App\Exception\NewsletterProviderException;
use App\Form\PersonalDataType;
use App\Htmx\HxTrait;
use App\Model\NewsletterSubscriptionRequestResult;
use App\Security\Crypt;
use App\Service\BookingEditDataLoader;
use App\Service\NewsletterManager;
use App\Service\ProfileCompletenessChecker;
@@ -40,7 +39,6 @@ class PersonalDataController extends AbstractController
/**
* @param ApiClient $apiClient BusProNet API client for data operations
* @param Crypt $crypt Encryption service for password handling
* @param BookingEditDataLoader $dataLoader Data loader for cache invalidation
* @param ProfileCompletenessChecker $completenessChecker Profile validation service
* @param EntityManagerInterface $entityManager Entity manager for persisting user changes
@@ -49,7 +47,6 @@ class PersonalDataController extends AbstractController
*/
public function __construct(
private readonly ApiClient $apiClient,
private readonly Crypt $crypt,
private readonly BookingEditDataLoader $dataLoader,
private readonly ProfileCompletenessChecker $completenessChecker,
private readonly EntityManagerInterface $entityManager,
@@ -78,7 +75,6 @@ class PersonalDataController extends AbstractController
/** @var User $user */
$user = $this->getUser();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
$personalData = $this->loadPersonalData($user);
$newsletterSubscribed = $this->newsletterManager->hasConfirmedOptIn($email);
$newsletterPendingConfirmation = $this->newsletterManager->hasPendingConfirmation($email);
@@ -91,7 +87,7 @@ class PersonalDataController extends AbstractController
if ($personalDataForm->isSubmitted() && $personalDataForm->isValid()) {
try {
$this->apiClient->updatePersonalData($email, $password, $personalData);
$this->apiClient->updatePersonalData($email, $personalData);
// Invalidate cached bookings to ensure edit mode shows updated applicant data
$this->dataLoader->invalidateUserBookingCaches($user);
@@ -183,12 +179,11 @@ class PersonalDataController extends AbstractController
private function loadPersonalData(User $user): PersonalData
{
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
try {
$personalData = $this
->apiClient
->getPersonalData($email, $password);
->getPersonalData($email, $user->getAddressId(), $user->getPersonId());
} catch (ApiClientException $e) {
$this->addFlash('error', 'Deine persönlichen Daten konnten nicht abgerufen werden');
src/Controller/Api/CrmAttributeController.php
+2 -4
View File
@@ -6,7 +6,6 @@ use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Model\Notification;
use App\Entity\User;
use App\Security\Crypt;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Response;
@@ -17,7 +16,7 @@ use Symfony\Component\Security\Http\Attribute\IsGranted;
#[IsGranted('ROLE_OAUTH2_PROFILE')]
class CrmAttributeController extends AbstractController
{
public function __construct(private readonly ApiClient $apiClient, private readonly Crypt $crypt)
public function __construct(private readonly ApiClient $apiClient)
{
}
@@ -27,10 +26,9 @@ class CrmAttributeController extends AbstractController
/** @var User $user */
$user = $this->getUser();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
try {
$data = $this->apiClient->getCrmAttributes($email, $password);
$data = $this->apiClient->getCrmAttributes($email, $user->getAddressId(), $user->getPersonId());
if ($data instanceof Notification) {
return new JsonResponse(['message' => $data->message, 'code' => $data->code], Response::HTTP_BAD_REQUEST);
src/Controller/Api/UserinfoController.php
+2 -4
View File
@@ -7,7 +7,6 @@ use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Model\Notification;
use App\BusProNet\Model\PersonalData;
use App\Entity\User;
use App\Security\Crypt;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Response;
@@ -18,7 +17,7 @@ use Symfony\Component\Security\Http\Attribute\IsGranted;
#[IsGranted('ROLE_OAUTH2_EMAIL')]
class UserinfoController extends AbstractController
{
public function __construct(private readonly ApiClient $apiClient, private readonly Crypt $crypt)
public function __construct(private readonly ApiClient $apiClient)
{
}
@@ -42,10 +41,9 @@ class UserinfoController extends AbstractController
/** @var User $user */
$user = $this->getUser();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
try {
$data = $this->apiClient->getPersonalData($email, $password);
$data = $this->apiClient->getPersonalData($email, $user->getAddressId(), $user->getPersonId());
if ($data instanceof Notification) {
return new JsonResponse(['message' => $data->message, 'code' => $data->code], Response::HTTP_BAD_REQUEST);
src/Controller/Booking/DownloadController.php
+1 -4
View File
@@ -6,7 +6,6 @@ use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Model\Notification;
use App\Entity\User;
use App\Security\Crypt;
use Psr\Log\LoggerInterface;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Response;
@@ -21,7 +20,6 @@ class DownloadController extends AbstractController
{
public function __construct(
private readonly ApiClient $apiClient,
private readonly Crypt $crypt,
private readonly LoggerInterface $logger,
) {
}
@@ -44,7 +42,6 @@ class DownloadController extends AbstractController
/** @var User $user */
$user = $this->getUser();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
$type = match ($fileType) {
'documents' => 'Dokumentdruck',
@@ -61,7 +58,7 @@ class DownloadController extends AbstractController
try {
$file = $this
->apiClient
->getDocuments($email, $password, $id, $type);
->getDocuments($email, $id, $type, $user->getAddressId(), $user->getPersonId());
} catch (ApiClientException $e) {
$file = null;
}
src/Controller/Booking/IndexController.php
+1 -4
View File
@@ -8,7 +8,6 @@ use App\BusProNet\Model\BaseData;
use App\BusProNet\Model\Notification;
use App\BusProNet\XmlLoader\TravelLoader;
use App\Entity\User;
use App\Security\Crypt;
use Psr\Log\LoggerInterface;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Request;
@@ -21,7 +20,6 @@ class IndexController extends AbstractController
public function __construct(
private readonly ApiClient $apiClient,
private readonly TravelLoader $travelDataLoader,
private readonly Crypt $crypt,
private readonly LoggerInterface $logger,
) {
}
@@ -33,10 +31,9 @@ class IndexController extends AbstractController
/** @var User $user */
$user = $this->getUser();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
try {
$bookings = $this->apiClient->getBookings($email, $password);
$bookings = $this->apiClient->getBookings($email, $user->getAddressId(), $user->getPersonId());
} catch (ApiClientException $e) {
$this->addFlash('error', 'Buchungen nicht abrufbar');
$bookings = new BaseData([]);
src/Entity/User.php
+11 -2
View File
@@ -93,16 +93,25 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
public function getPassword(): ?string
{
return base64_decode($this->password);
return $this->password;
}
public function setPassword(?string $password): static
{
$this->password = base64_encode($password);
$this->password = $password;
return $this;
}
public function hasLocalPasswordHash(): bool
{
if (null === $this->password || '' === $this->password) {
return false;
}
return null !== password_get_info($this->password)['algo'];
}
/**
* @return array<string>
*/
src/Security/BpnAuthenticator.php
+68 -38
View File
@@ -8,6 +8,7 @@ use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Exception\ImmediateConnectionCloseException;
use App\BusProNet\Exception\TimeoutException;
use App\BusProNet\Model\CrmAttributes;
use App\BusProNet\Model\PersonalData;
use App\Entity\User;
use App\Htmx\HxRedirectResponse;
@@ -18,6 +19,7 @@ use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
use Symfony\Component\Security\Http\Authenticator\AbstractLoginFormAuthenticator;
@@ -29,11 +31,11 @@ use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface
use Symfony\Component\Security\Http\Util\TargetPathTrait;
/**
* Authenticates users against the BPN API.
* Authenticates users against the local Symfony password hash.
*
* Validates credentials via BPN's getPersonalData endpoint, creates or updates
* local User entities, and retrieves CRM attributes (roles, hotel codes) for
* authorization. Passwords are stored encrypted with RSA for subsequent API calls.
* Legacy rows still store the old BPN-encrypted password. On first successful
* login, the authenticator migrates that value to a local password hash and
* updates the login timestamp.
*/
class BpnAuthenticator extends AbstractLoginFormAuthenticator implements AuthenticationEntryPointInterface
{
@@ -45,6 +47,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
private readonly EntityManagerInterface $entityManager,
private readonly Crypt $crypt,
private readonly ProfileCompletenessChecker $completenessChecker,
private readonly UserPasswordHasherInterface $passwordHasher,
private readonly LoggerInterface $authLogger,
) {
}
@@ -59,67 +62,76 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
$email = trim($request->request->getString('_username'));
$passwordPlain = trim($request->request->getString('_password'));
// Very lame hashing applied here as required by BPN
$password = md5($passwordPlain);
$userRepository = $this->entityManager->getRepository(User::class);
$user = $userRepository->findOneBy(['email' => $email]);
try {
$response = $this->apiClient->getPersonalData($email, $password);
} catch (ApiClientException $e) {
$message = $this->isConnectionError($e) ?
'Der Server ist momentan nicht erreichbar. Bitte versuche es später erneut.' : $e->getMessage();
throw new CustomUserMessageAuthenticationException($message);
if (null === $user) {
// First login for this email: prove credentials against BPN,
// then create the local account from the returned customer data.
$user = $this->bootstrapUser($email, $passwordPlain);
} else {
if (true === $user->hasLocalPasswordHash()) {
if (false === $this->passwordHasher->isPasswordValid($user, $passwordPlain)) {
throw new CustomUserMessageAuthenticationException('Benutzername oder Passwort ist nicht korrekt.');
}
} else {
// Legacy accounts still carry the old encrypted BPN secret as a md5 hash
// in the password column. We validate that old value once, then replace it
// with a local Symfony hash on success.
$legacyPasswordHash = $this->decryptLegacyPassword($user->getPassword());
if ($legacyPasswordHash !== md5($passwordPlain)) {
throw new CustomUserMessageAuthenticationException('Benutzername oder Passwort ist nicht korrekt.');
}
$user->setPassword($this->passwordHasher->hashPassword($user, $passwordPlain));
}
}
if (false === $response instanceof PersonalData) {
throw new CustomUserMessageAuthenticationException('Benutzername oder Passwort ist nicht korrekt.');
}
$user->setLastLoginAt(new \DateTimeImmutable());
$this->entityManager->flush();
$csrfToken = $request->request->getString('_csrf_token');
return new SelfValidatingPassport(
new UserBadge($email, function () use ($email, $password, $response) {
return $this->createOrUpdateLocalUser($email, $password, $response);
}),
new UserBadge($email, fn () => $user),
[
new CsrfTokenBadge('authenticate', $csrfToken),
]
);
}
private function createOrUpdateLocalUser(string $email, string $password, PersonalData $personalData): User
private function bootstrapUser(string $email, string $passwordPlain): User
{
try {
$crmAttributes = $this->apiClient->getCrmAttributes($email, $password);
$personalData = $this->apiClient->getPersonalDataWithPassword($email, $passwordPlain);
$crmAttributes = $this->apiClient->getCrmAttributesWithPassword($email, $passwordPlain);
} catch (ApiClientException $e) {
$message = $this->isConnectionError($e) ?
'Der Server ist momentan nicht erreichbar. Bitte versuche es später erneut. :(' : $e->getMessage();
$message = $this->isConnectionError($e)
? 'Der Server ist momentan nicht erreichbar. Bitte versuche es später erneut.'
: $e->getMessage();
throw new CustomUserMessageAuthenticationException($message);
}
$roles = $crmAttributes->roles;
$hotelCodes = $crmAttributes->hotelCodes;
$encryptedPassword = $this->crypt->encrypt($password);
$userRepository = $this->entityManager->getRepository(User::class);
if (null === $user = $userRepository->findOneBy(['email' => $email])) {
$user = new User($email);
$this->entityManager->persist($user);
if (false === $personalData instanceof PersonalData || false === $crmAttributes instanceof CrmAttributes) {
throw new CustomUserMessageAuthenticationException('Benutzername oder Passwort ist nicht korrekt.');
}
$user = new User($email);
$this->entityManager->persist($user);
$user
->setPassword($encryptedPassword)
// Persist the local hash immediately so subsequent logins no longer
// depend on the legacy BPN password format.
->setPassword($this->passwordHasher->hashPassword($user, $passwordPlain))
->setPersonId($personalData->personId)
->setAddressId($personalData->addressId)
->setRoles($roles)
->setHotelCodes($hotelCodes)
->setLastLoginAt(new \DateTimeImmutable())
->setRoles($crmAttributes->roles)
->setHotelCodes($crmAttributes->hotelCodes)
->setProfileComplete($this->completenessChecker->isComplete($personalData))
;
$this->entityManager->flush();
return $user;
}
@@ -141,6 +153,24 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
return new RedirectResponse($targetPath);
}
private function decryptLegacyPassword(?string $storedPassword): string
{
if (null === $storedPassword || '' === $storedPassword) {
throw new CustomUserMessageAuthenticationException('Benutzername oder Passwort ist nicht korrekt.');
}
$ciphertext = base64_decode($storedPassword, true);
if (false === $ciphertext) {
$ciphertext = $storedPassword;
}
try {
return $this->crypt->decrypt($ciphertext);
} catch (\Throwable) {
throw new CustomUserMessageAuthenticationException('Benutzername oder Passwort ist nicht korrekt.');
}
}
private function isConnectionError(ApiClientException $e): bool
{
if ($e instanceof TimeoutException || $e instanceof ImmediateConnectionCloseException) {
src/Service/BookingEditDataLoader.php
+2 -5
View File
@@ -11,7 +11,6 @@ use App\BusProNet\Model\Notification;
use App\BusProNet\XmlLoader\AgencyLoader;
use App\Entity\User;
use App\Form\Model\BookingDto;
use App\Security\Crypt;
use Psr\Cache\InvalidArgumentException;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Contracts\Cache\ItemInterface;
@@ -37,7 +36,6 @@ class BookingEditDataLoader
private readonly TravelDataProvider $travelDataService,
private readonly BookingEditDraftManager $draftService,
private readonly AgencyLoader $agencyLoader,
private readonly Crypt $crypt,
private readonly TagAwareCacheInterface $bpnCache,
) {
}
@@ -179,14 +177,13 @@ class BookingEditDataLoader
$cacheKey = $this->getBookingCacheKey($bookingId, $user);
$userTag = self::CACHE_TAG_USER_PREFIX.$user->getId();
$email = $user->getEmail();
$password = $this->crypt->decrypt($user->getPassword());
try {
return $this->bpnCache->get($cacheKey, function (ItemInterface $item) use ($email, $password, $bookingId, $userTag) {
return $this->bpnCache->get($cacheKey, function (ItemInterface $item) use ($email, $bookingId, $userTag, $user) {
$item->expiresAfter(300);
$item->tag([$userTag]);
return $this->apiClient->getBooking($email, $password, $bookingId);
return $this->apiClient->getBooking($email, $bookingId, $user->getAddressId(), $user->getPersonId());
});
} catch (InvalidArgumentException) {
return null;
src/Service/ParticipantDataPrefiller.php
+2 -6
View File
@@ -10,7 +10,6 @@ use App\BusProNet\Model\Notification;
use App\Entity\User;
use App\Form\Model\BookingDto;
use App\Form\Model\ParticipantDto;
use App\Security\Crypt;
use Carbon\CarbonImmutable;
use Psr\Log\LoggerInterface;
@@ -27,7 +26,6 @@ class ParticipantDataPrefiller
public function __construct(
private readonly ApiClient $apiClient,
private readonly Crypt $crypt,
private readonly LoggerInterface $logger,
) {
}
@@ -48,12 +46,10 @@ class ParticipantDataPrefiller
public function prefillApplicantFromUser(User $user, ParticipantDto $applicant): ParticipantDto
{
try {
// Decrypt user password for API authentication
$password = $this->crypt->decrypt($user->getPassword());
$email = $user->getEmail();
// Fetch personal data from API
$result = $this->apiClient->getPersonalData($email, $password);
$result = $this->apiClient->getPersonalData($email, $user->getAddressId(), $user->getPersonId());
// Handle API error response
if ($result instanceof Notification) {
@@ -90,7 +86,7 @@ class ParticipantDataPrefiller
return $applicant;
} catch (\Exception $e) {
// Catch any unexpected exceptions (decryption failure, API errors, etc.)
// Catch any unexpected exceptions (API errors, etc.)
$this->logger->error('Exception during applicant prepopulation', [
'error' => $e->getMessage(),
'email' => $user->getEmail(),