107 lines
4.1 KiB
PHP
107 lines
4.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Controller\Admin\User;
|
|
|
|
use App\Controller\Traits\ReturnUrlTrait;
|
|
use App\Entity\User;
|
|
use App\Htmx\HxRedirectResponse;
|
|
use App\Security\Role;
|
|
use Doctrine\ORM\EntityManagerInterface;
|
|
use Psr\Log\LoggerInterface;
|
|
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
|
|
use Symfony\Component\HttpFoundation\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
use Symfony\Component\Routing\Attribute\Route;
|
|
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
|
|
use Symfony\Component\Security\Http\Attribute\IsGranted;
|
|
use Symfony\Component\Security\Http\Authenticator\Token\PostAuthenticationToken;
|
|
|
|
/**
|
|
* Turns a nomination from the BusPro CRM into an actual role.
|
|
*
|
|
* This is deliberately its own action rather than a field on a form: it grants a privilege, so
|
|
* it is confirmed on its own, logged on its own, and cannot happen as a side effect of saving
|
|
* something unrelated. The nomination is checked again on submit, so a sync that revoked the
|
|
* claim while the dialog was open cannot be approved through. Role::SELF_APPROVAL_FORBIDDEN is
|
|
* refused for your own account.
|
|
*/
|
|
#[IsGranted('ROLE_ADMIN')]
|
|
class ApproveRoleController extends AbstractController
|
|
{
|
|
use ReturnUrlTrait;
|
|
|
|
public function __construct(
|
|
private readonly EntityManagerInterface $entityManager,
|
|
private readonly LoggerInterface $logger,
|
|
private readonly TokenStorageInterface $tokenStorage,
|
|
) {
|
|
}
|
|
|
|
#[Route('/admin/user/{id}/approve/{role}', name: 'app_admin_user_approve_role', requirements: ['role' => 'ROLE_[A-Z_]+'])]
|
|
public function index(User $user, string $role, Request $request): Response
|
|
{
|
|
if ($user === $this->getUser() && \in_array($role, Role::SELF_APPROVAL_FORBIDDEN, true)) {
|
|
throw $this->createAccessDeniedException(sprintf('The role "%s" cannot be approved for your own account.', $role));
|
|
}
|
|
|
|
$nominated = Role::nominatedFrom($user->getRoles());
|
|
|
|
if (false === \array_key_exists($role, $nominated)) {
|
|
throw $this->createNotFoundException(sprintf('The account is not nominated for "%s".', $role));
|
|
}
|
|
|
|
$csrfTokenId = 'approve_user_role_'.$user->getId().'_'.$role;
|
|
|
|
if ($request->isMethod(Request::METHOD_POST)) {
|
|
if (false === $this->isCsrfTokenValid($csrfTokenId, $request->request->getString('_token'))) {
|
|
throw $this->createAccessDeniedException('Invalid CSRF token.');
|
|
}
|
|
|
|
$user->setRoles(Role::approve($user->getRoles(), $role));
|
|
|
|
$this->entityManager->flush();
|
|
|
|
$this->reissueOwnSecurityToken($user);
|
|
|
|
$this->addFlash('success', sprintf('Die Rolle %s wurde freigeschaltet', $nominated[$role]));
|
|
|
|
$this->logger->info('Approved user role', [
|
|
'email' => $user->getEmail(),
|
|
'role' => $role,
|
|
'roles' => $user->getRoles(),
|
|
]);
|
|
|
|
return new HxRedirectResponse($this->getReturnUrl($request, 'app_admin_user'));
|
|
}
|
|
|
|
return $this->render('admin/user/modal_approve_role.html.twig', [
|
|
'user' => $user,
|
|
'role_label' => $nominated[$role],
|
|
'csrf_token_id' => $csrfTokenId,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Keeps the approver signed in when they just approved a role for themselves.
|
|
*
|
|
* A token carries the role names it was issued with, and ContextListener ends the session
|
|
* as soon as the stored user no longer matches them — the safeguard that makes a revocation
|
|
* take effect at once. Here the grant is deliberate and just happened under ROLE_ADMIN, so
|
|
* the token is re-issued with the new roles instead of the session being dropped.
|
|
*/
|
|
private function reissueOwnSecurityToken(User $user): void
|
|
{
|
|
$token = $this->tokenStorage->getToken();
|
|
|
|
if (false === $token instanceof PostAuthenticationToken || $token->getUser() !== $user) {
|
|
return;
|
|
}
|
|
|
|
$this->tokenStorage->setToken(
|
|
new PostAuthenticationToken($user, $token->getFirewallName(), $user->getRoles()),
|
|
);
|
|
}
|
|
}
|