isGranted('ROLE_OAUTH2_ID')) { $scopes[] = 'person_id'; $scopes[] = 'address_id'; } if ($this->isGranted('ROLE_OAUTH2_PROFILE')) { $scopes[] = 'profile'; } if ($this->isGranted('ROLE_OAUTH2_ROLES')) { $scopes[] = 'roles'; } /** @var User $user */ $user = $this->getUser(); $email = $user->getEmail(); $password = $this->crypt->decrypt($user->getPassword()); try { $data = $this->apiClient->getPersonalData($email, $password); if ($data instanceof Notification) { return new JsonResponse(['message' => $data->message, 'code' => $data->code], Response::HTTP_BAD_REQUEST); } // Patch the identity of the account that authenticated. BusPro accepts any of the // addresses on a person's record as a login and answers all of them with the same // ids and the same first contact address, so only the local account tells the staff // account and the private one apart — and they hold different roles. // // The uuid, not the primary key: consumers store this value and match their own // accounts on it, so it must not disclose how many accounts exist or let one // account's identifier be guessed from another's. $data->subject = $user->getUuid(); $data->loginEmail = $user->getEmail(); // Patch current user's roles. The implicit ROLE_USER says nothing about the // account — every authenticated user holds it — and is not exported. $data->roles = Role::effectiveOnly($user->getRoles()); // Patch current user's hotel codes $data->hotelCodes = $user->getHotelCodes(); // extract userdata for resulting claims $userData = $this->getClaims($data, $scopes); return $this->json($userData); } catch (ApiClientException $e) { return new JsonResponse(['message' => $e->getMessage()], Response::HTTP_BAD_REQUEST); } } /** * @param list $scopes * * @return array */ private function getClaims(PersonalData $data, array $scopes): array { // get all available claims $allClaims = $data->getClaims(); $keys = array_keys($allClaims); $claims = []; // filter claims by provided scopes foreach ($scopes as $scope) { if (false === in_array($scope, $keys)) { continue; } $claims[$scope] = $allClaims[$scope]; } return $claims; } }