src/Controller/SecurityController.php line 102

Open in your IDE?
  1. <?php
  3. namespace App\Controller;
  5. use App\Entity\Book;
  6. use App\Entity\Subscription;
  7. use App\Entity\MagicToken;
  8. use App\Entity\Token;
  9. use App\Entity\User;
  10. use App\Entity\UserAttribute;
  11. use App\Entity\UserAttributeValue;
  12. use App\Entity\Country;
  13. use App\Entity\UserGroup;
  14. use App\Form\Model\Security\RegisterModel;
  15. use App\Form\Model\Security\ResetModel;
  16. use App\Form\Type\Security\RegisterType;
  17. use App\Form\Type\Security\ResetType;
  18. use App\Service\GeoIP2;
  19. use App\Service\Raynet;
  20. use App\Service\TeacherProfileService;
  21. use App\Utils\TokenUtil;
  22. use DateTime;
  23. use Doctrine\DBAL\Exception\UniqueConstraintViolationException;
  24. use Doctrine\ORM\EntityManagerInterface;
  25. use Exception;
  26. use Swift_Mailer;
  27. use Swift_Message;
  28. use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
  29. use Symfony\Component\HttpFoundation\JsonResponse;
  30. use Symfony\Component\HttpFoundation\Request;
  31. use Symfony\Component\HttpFoundation\Response;
  32. use Symfony\Component\Routing\Annotation\Route;
  33. use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
  34. use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
  35. use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface;
  36. use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
  37. use Symfony\Contracts\Translation\TranslatorInterface;
  39. /**
  40.  * @Route("/{_locale}", name="security_")
  41.  */
  42. class SecurityController extends AbstractController
  43. {
  44.     /**
  45.      * @var EntityManagerInterface
  46.      */
  47.     private $em;
  49.     /**
  50.      * @var TranslatorInterface
  51.      */
  52.     private $t;
  54.     /**
  55.      * @var UserPasswordEncoderInterface
  56.      */
  57.     private $encoder;
  59.     /**
  60.      * SecurityController constructor.
  61.      * @param EntityManagerInterface $em
  62.      * @param TranslatorInterface $t
  63.      * @param UserPasswordEncoderInterface $encoder
  64.      */
  65.     public function __construct(EntityManagerInterface $em, TranslatorInterface $t, UserPasswordEncoderInterface $encoder)
  66.     {
  67.         $this->em = $em;
  68.         $this->t = $t;
  69.         $this->encoder = $encoder;
  70.     }
  72.     /**
  73.      * @Route("/login/", name="login")
  74.      *
  75.      * @param AuthenticationUtils $authenticationUtils
  76.      * @return Response
  77.      */
  78.     public function loginAction(Request $request, AuthenticationUtils $authenticationUtils): Response
  79.     {
  80.         if ($this->get('security.authorization_checker')->isGranted('ROLE_USER')) {
  81.             return $this->redirect($this->generateUrl('app_library_index', $request->query->all()));
  82.         }
  84.         return $this->redirect($this->generateUrl('security_home', $request->query->all()));
  85.     }
  87.     /**
  88.      * @Route("/", name="home")
  89.      *
  90.      * @param Request $request
  91.      * @param AuthenticationUtils $authenticationUtils
  92.      * @return Response
  93.      */
  94.     public function appLoginAction(Request $request, AuthenticationUtils $authenticationUtils): Response
  95.     {
  96.         // TODO: redirect, when user is logged in?
  98.         $error = $authenticationUtils->getLastAuthenticationError();
  99.         $lastUsername = $authenticationUtils->getLastUsername();
  101.         $session = $this->get('session');
  102.         $redirect = $session->get('redirect_url') ?? $this->generateUrl('app_library_index', $request->query->all());
  104.         return $this->render('app/home.html.twig', [
  105.             'last_username' => $lastUsername,
  106.             'error' => $error,
  107.             'redirect' => $redirect,
  108.         ]);
  109.     }
  111.     /**
  112.      * Clean login page (login form + SSO + register link only), used as the OAuth2 /authorize landing page.
  113.      *
  114.      * @Route("/sign-in/", name="sign_in")
  115.      */
  116.     public function signInAction(Request $request, AuthenticationUtils $authenticationUtils): Response
  117.     {
  118.         $error = $authenticationUtils->getLastAuthenticationError();
  119.         $lastUsername = $authenticationUtils->getLastUsername();
  121.         $session = $this->get('session');
  122.         $redirect = $session->get('redirect_url') ?? $this->generateUrl('app_library_index', $request->query->all());
  124.         return $this->render('app/login.html.twig', [
  125.             'last_username' => $lastUsername,
  126.             'error' => $error,
  127.             'redirect' => $redirect,
  128.         ]);
  129.     }
  131.     /**
  132.      * Consumes a single-use magic token (from POST /api/account/session-bridge), logs the user
  133.      * into the web session and drops them on the locked-down standalone settings screen.
  134.      *
  135.      * @Route("/account/session-bridge/{token}", name="account_session_bridge", methods={"GET"})
  136.      */
  137.     public function sessionBridgeAction(Request $request, string $token): Response
  138.     {
  139.         $magic = $this->em->getRepository(MagicToken::class)->findOneBy(['code' => $token]);
  141.         if ($magic instanceof MagicToken) {
  142.             $expired = (new DateTime())->getTimestamp() > $magic->getExpiration()->getTimestamp();
  143.             $user = $magic->getUser();
  144.             // Single use: drop it whether valid or expired.
  145.             $this->em->remove($magic);
  146.             $this->em->flush();
  148.             if (!$expired) {
  149.                 $authToken = new UsernamePasswordToken($user, null, 'main', $user->getRoles());
  150.                 $this->get('security.token_storage')->setToken($authToken);
  152.                 $session = $request->getSession();
  153.                 $session->set('_security_main', serialize($authToken));
  154.                 $session->set('account_bridge', true);
  156.                 return $this->redirectToRoute('app_settings_index');
  157.             }
  158.         }
  160.         // Render the error on the standalone page instead of redirecting to the homepage:
  161.         // the app must not be able to fall back to a normal login that escapes the locked flow.
  162.         return $this->render('app/account_bridge_error.html.twig');
  163.     }
  165.     /**
  166.      * @Route("/new-password/", name="new_password")
  167.      *
  168.      * @return Response
  169.      */
  170.     public function newPasswordAction(): Response
  171.     {
  172.         return $this->render('security/password.new.html.twig');
  173.     }
  175.     /**
  176.      * @Route("/new-password/handle/", name="new_password_handle")
  177.      *
  178.      * @param Request $request
  179.      * @param Swift_Mailer $mailer
  180.      * @return Response
  181.      */
  182.     public function newPasswordHandleAction(Request $request, Swift_Mailer $mailer): Response
  183.     {
  184.         $email = $request->request->get('address') ?? $request->query->get('address');
  186.         $user = $this->em->getRepository(User::class)->findOneBy(['email' => $email]);
  187.         if (!$user instanceof User) {
  188.             $this->addFlash('danger', $this->t->trans('password.reset.mail.invalid'));
  190.             return $this->redirectToRoute('security_new_password');
  191.         }
  193.         try {
  194.             $tokenValue = TokenUtil::generate(64);
  196.             $token = $this->em->getRepository(Token::class)->findOneBy(['user' => $user]);
  197.             if (!$token instanceof Token) {
  198.                 $token = new Token();
  199.             }
  201.             $expirationDate = (new DateTime())->modify('+1 hour');
  202.             $token
  203.                 ->setCode($tokenValue)
  204.                 ->setUser($user)
  205.                 ->setExpiration($expirationDate);
  207.             $this->em->persist($token);
  208.             $this->em->flush();
  210.             $message = (new Swift_Message("Forgotten Password"))
  211.                 ->setFrom($_SERVER['MAILER_SENDER_EMAIL'], $_SERVER['MAILER_SENDER_NAME'])
  212.                 ->setTo($user->getEmail())
  213.                 ->setBody(
  214.                     $this->renderView('mail/password.reset.html.twig', [
  215.                         'magic_link' => $this->generateUrl('security_create_password', ['code' => $token->getCode()],
  216.                             UrlGeneratorInterface::ABSOLUTE_URL),
  217.                     ]),
  218.                     'text/html'
  219.                 );
  221.             if ($klerkId = $this->getParameter('klerk_forget')) {
  222.                 $message->getHeaders()->addTextHeader('X-CampaignID', $klerkId);
  223.             }
  225.             $mailer->send($message);
  226.             $this->addFlash('success', $this->t->trans('password.reset.mail.success'));
  228.             return $this->redirectToRoute('security_home');
  229.         } catch (Exception $e) {
  230.             $this->addFlash('danger', $this->t->trans('password.reset.error.internal'));
  232.             return $this->redirectToRoute('security_new_password');
  233.         }
  234.     }
  236.     /**
  237.      * @Route("/reset-password/{code}/", name="create_password")
  238.      *
  239.      * @param Request $request
  240.      * @param string $code
  241.      * @return Response
  242.      * @throws Exception
  243.      */
  244.     public function resetPasswordAction(Request $request, string $code): Response
  245.     {
  246.         $token = $this->em->getRepository(Token::class)->findOneBy(['code' => $code]);
  247.         if (!$token instanceof Token) {
  248.             $this->addFlash('danger', $this->t->trans('password.reset.notrequested'));
  250.             return $this->redirectToRoute('security_home');
  251.         }
  253.         if ((new DateTime())->getTimestamp() > $token->getExpiration()->getTimestamp()) {
  254.             $this->addFlash('danger', $this->t->trans('password.reset.expired'));
  256.             return $this->redirectToRoute('security_home');
  257.         }
  259.         $form = $this->createForm(ResetType::class);
  261.         $form->handleRequest($request);
  262.         if ($form->isSubmitted() && $form->isValid()) {
  263.             /** @var ResetModel $model */
  264.             $model = $form->getData();
  266.             try {
  267.                 $user = $token->getUser();
  268.                 $password = $this->encoder->encodePassword($user, $model->password);
  270.                 $user->setPassword($password);
  271.                 $user->setActive(true);
  272.                 $this->em->persist($user);
  273.                 $this->em->flush();
  275.                 $this->addFlash('success', $this->t->trans('password.reset.success'));
  277.                 return $this->redirectToRoute('security_home');
  278.             } catch (Exception $e) {
  279. //                $this->addFlash('danger', $this->t->trans('password.reset.error.internal'));
  280.                 throw $e;
  281.             }
  282.         }
  284.         return $this->render('security/password.reset.html.twig', [
  285.             'form' => $form->createView(),
  286.         ]);
  287.     }
  289.     /**
  290.      * Confirms a newly registered user's email address (reuses the password-reset Token).
  291.      *
  292.      * @Route("/verify-email/{code}/", name="verify_email")
  293.      *
  294.      * @param string $code
  295.      * @param Swift_Mailer $mailer
  296.      * @return Response
  297.      * @throws Exception
  298.      */
  299.     public function verifyEmailAction(string $code, Swift_Mailer $mailer): Response
  300.     {
  301.         $token = $this->em->getRepository(Token::class)->findOneBy(['code' => $code]);
  302.         if (!$token instanceof Token || (new DateTime())->getTimestamp() > $token->getExpiration()->getTimestamp()) {
  303.             $this->addFlash('danger', $this->t->trans('register.verify.invalid'));
  305.             return $this->redirectToRoute('security_home');
  306.         }
  308.         $user = $token->getUser();
  309.         $user->setActive(true);
  311.         $this->em->remove($token);
  312.         $this->em->flush();
  314.         //8.6.2026 na přání klienta vypnuto posílání uvítacího e-mailu na učitele
  315.         if (!in_array(UserGroup::ROLE_TEACHER, $user->getRoles(), true)) {
  316.             $message = (new Swift_Message($this->t->trans('registration.title', [], 'mailing')))
  317.                 ->setFrom($_SERVER['MAILER_SENDER_EMAIL'], $_SERVER['MAILER_SENDER_NAME'])
  318.                 ->setTo($user->getEmail())
  319.                 ->setBody(
  320.                     $this->renderView('mail/registration.html.twig'),
  321.                     'text/html'
  322.                 );
  324.             if ($klerkId = $this->getParameter('klerk_welcome')) {
  325.                 $message->getHeaders()->addTextHeader('X-CampaignID', $klerkId);
  326.             }
  328.             $mailer->send($message);
  329.         }
  331.         $this->addFlash('success', $this->t->trans('register.verify.success'));
  333.         return $this->redirectToRoute('security_home');
  334.     }
  336.     /**
  337.      * Autocomplete endpoint for the school select on the registration page.
  338.      * Reads the slim JSON produced by `app:import-schools` and returns
  339.      * matching rows in the shape Select2 expects.
  340.      *
  341.      * @Route("/register/schools-search/", name="register_schools_search", methods={"GET"})
  342.      */
  343.     public function registerSchoolsSearchAction(Request $request): JsonResponse
  344.     {
  345.         $query = trim((string) $request->query->get('q', ''));
  346.         $kindFilter = trim((string) $request->query->get('kind', '')); // '', 'zs', 'ms', 'zs_ms'
  347.         $limit = 30;
  349.         static $cache = null;
  350.         if ($cache === null) {
  351.             $path = $this->getParameter('kernel.project_dir') . '/var/data/skoly.json';
  352.             $cache = is_file($path)
  353.                 ? (json_decode((string) file_get_contents($path), true) ?: [])
  354.                 : [];
  355.         }
  357.         // Map UI kind onto accepted kinds in the data (OR within the array):
  358.         //   'zs'       → entry must have 'zs'
  359.         //   'ms'       → entry must have 'ms'
  360.         //   'zs_ms'    → entry must have 'zs' OR 'ms' (any of them)
  361.         //   ''/'other' → no filter
  362.         $anyOf = [];
  363.         if ($kindFilter === 'zs')    { $anyOf = ['zs']; }
  364.         if ($kindFilter === 'ms')    { $anyOf = ['ms']; }
  365.         if ($kindFilter === 'zs_ms') { $anyOf = ['zs', 'ms']; }
  367.         $normalize = static function (string $s): string {
  368.             $s = mb_strtolower($s, 'UTF-8');
  369.             if (function_exists('iconv')) {
  370.                 $ascii = @iconv('UTF-8', 'ASCII//TRANSLIT//IGNORE', $s);
  371.                 if ($ascii !== false) {
  372.                     $s = $ascii;
  373.                 }
  374.             }
  375.             return $s;
  376.         };
  378.         $needle = $normalize($query);
  380.         $matches = [];
  381.         foreach ($cache as $row) {
  382.             if ($anyOf) {
  383.                 $kinds = $row['kinds'] ?? '';
  384.                 $hit = false;
  385.                 foreach ($anyOf as $k) {
  386.                     if (strpos($kinds, $k) !== false) {
  387.                         $hit = true;
  388.                         break;
  389.                     }
  390.                 }
  391.                 if (!$hit) {
  392.                     continue;
  393.                 }
  394.             }
  395.             if ($needle !== '') {
  396.                 $hay = $normalize($row['name'] . ' ' . ($row['address'] ?? ''));
  397.                 if (strpos($hay, $needle) === false) {
  398.                     continue;
  399.                 }
  400.             }
  401.             $matches[] = [
  402.                 'id'      => $row['id'],
  403.                 'text'    => $row['name'] . ($row['address'] ? ' — ' . $row['address'] : ''),
  404.                 'name'    => $row['name'],
  405.                 'address' => $row['address'] ?? '',
  406.             ];
  407.             if (count($matches) >= $limit) {
  408.                 break;
  409.             }
  410.         }
  412.         return new JsonResponse(['results' => $matches]);
  413.     }
  415.     /**
  416.      * @Route("/register/teacher-info/", name="register_teacher_info")
  417.      *
  418.      * @param Request $request
  419.      * @param TeacherProfileService $teacherProfile
  420.      * @return Response
  421.      */
  422.     public function registerTeacherInfoAction(Request $request, TeacherProfileService $teacherProfile, GeoIP2 $geoIP2): Response
  423.     {
  424.         /** @var User|null $user */
  425.         $user = $this->getUser();
  426.         if (!$user instanceof User || !in_array(UserGroup::ROLE_TEACHER, $user->getRoles(), true)) {
  427.             return $this->redirectToRoute('security_home');
  428.         }
  430.         if ($request->isMethod('POST')) {
  431.             if (!$this->isCsrfTokenValid('teacher_info', $request->request->get('_token'))) {
  432.                 $this->addFlash('danger', $this->t->trans('register.error.internal'));
  434.                 return $this->redirectToRoute('security_register_teacher_info');
  435.             }
  437.             $teacherProfile->apply($user, $request);
  439.             $countryCode = trim((string) $request->request->get('teacher_country', ''));
  440.             if ($countryCode !== '') {
  441.                 $country = $this->em->getRepository(Country::class)->findOneBy(['code' => $countryCode]);
  442.                 if ($country instanceof Country) {
  443.                     $user->setCountry($country);
  444.                 }
  445.             }
  447.             $this->em->flush();
  449.             if (!$teacherProfile->isComplete($user)) {
  450.                 $this->addFlash('danger', $this->t->trans('teacher.info.incomplete'));
  452.                 return $this->redirectToRoute('security_register_teacher_info');
  453.             }
  455.             $this->addFlash('success', $this->t->trans('settings.success'));
  457.             return $this->redirectToRoute('app_library_index');
  458.         }
  460.         $country = $user->getCountry();
  462.         return $this->render('app/register_teacher_info.html.twig', [
  463.             'prefill' => $teacherProfile->getPrefill($user),
  464.             'cz' => $country !== null && $country->getCode() === 'CZ',
  465.             'countries' => $this->em->getRepository(Country::class)->findBy([], ['name' => 'ASC']),
  466.             'current_country' => $country?->getCode() ?? $geoIP2->getCountry()?->getCode(),
  467.         ]);
  468.     }
  470.     /**
  471.      * @Route("/register/", name="register")
  472.      *
  473.      * @param Request $request
  474.      * @param Swift_Mailer $mailer
  475.      * @param GeoIP2 $geoIP2
  476.      * @return Response
  477.      */
  478.     public function registerAction(Request $request, Swift_Mailer $mailer, GeoIP2 $geoIP2, Raynet $raynet, TeacherProfileService $teacherProfile): Response
  479.     {
  480.         $form = $this->createForm(RegisterType::class, new RegisterModel($geoIP2->getCountry()));
  482.         $form->handleRequest($request);
  483.         if ($form->isSubmitted() && $form->isValid()) {
  484.             /** @var RegisterModel $model */
  485.             $model = $form->getData();
  487.             if ($model->emailConfirm !== null) {
  488.                 return $this->redirectToRoute('security_register');
  489.             }
  491.             if (!$request->request->get('cf-turnstile-response') || !$this->validateTurnstile($request->request->get('cf-turnstile-response'))) {
  492.                 $this->addFlash('danger', $this->t->trans('register.error.internal'));
  493.                 return $this->redirectToRoute('security_register');
  494.             }
  496.             try {
  497.                 $group = $this->em->getRepository(UserGroup::class)->findOneBy(['role' => $model->role]);
  498.                 $user = (new User())
  499.                     ->setUsername($model->email)
  500.                     ->setEmail($model->email)
  501.                     ->setGroup($group)
  502.                     ->setCountry($model->country)
  503.                     ->setActive(false);
  505.                 $password = $this->encoder->encodePassword($user, $model->password);
  506.                 $user->setPassword($password);
  508.                 $firstnameAttr = $this->em->getRepository(UserAttribute::class)->findOneBy(['name' => 'firstname']);
  509.                 $lastnameAttr = $this->em->getRepository(UserAttribute::class)->findOneBy(['name' => 'lastname']);
  511.                 $firstnameAttrValue = (new UserAttributeValue())
  512.                     ->setUser($user)
  513.                     ->setAttribute($firstnameAttr)
  514.                     ->setValue($model->firstname);
  516.                 $lastnameAttrValue = (new UserAttributeValue())
  517.                     ->setUser($user)
  518.                     ->setAttribute($lastnameAttr)
  519.                     ->setValue($model->lastname);
  521.                 $this->em->persist($user);
  522.                 $this->em->persist($firstnameAttrValue);
  523.                 $this->em->persist($lastnameAttrValue);
  525.                 if ($model->role === UserGroup::ROLE_TEACHER) {
  526.                     $teacherProfile->apply($user, $request);
  527.                 }
  529.                 //temporarily add 1 month subscription of all books here
  530.                 $books = $this->em->getRepository(Book::class)->findAll();
  531.                 foreach ($books as $book) {
  532.                     $subscription = new Subscription($user, $book, new DateTime('+1 month'), null, true, false, false);
  533.                     $this->em->persist($subscription);
  534.                 }
  536.                 try {
  537.                     $this->em->flush();
  538.                 } catch (UniqueConstraintViolationException $e) {
  539.                     $this->addFlash('danger', $this->t->trans('register.error.existing'));
  541.                     return $this->redirectToRoute('security_home');
  542.                 }
  544.                 $this->addFlash('success', $this->t->trans('register.verify.sent'));
  546.                 $verificationToken = (new Token())
  547.                     ->setCode(TokenUtil::generate(64))
  548.                     ->setUser($user)
  549.                     ->setExpiration((new DateTime())->modify('+1 week'));
  551.                 $this->em->persist($verificationToken);
  552.                 $this->em->flush();
  554.                 $message = (new Swift_Message($this->t->trans('register.verify.title', [], 'mailing')))
  555.                     ->setFrom($_SERVER['MAILER_SENDER_EMAIL'], $_SERVER['MAILER_SENDER_NAME'])
  556.                     ->setTo($user->getEmail())
  557.                     ->setBody(
  558.                         $this->renderView('mail/password.reset.html.twig', [
  559.                             'magic_link' => $this->generateUrl('security_verify_email', ['code' => $verificationToken->getCode()],
  560.                                 UrlGeneratorInterface::ABSOLUTE_URL),
  561.                             'content_key' => 'register.verify.mailcontent',
  562.                         ]),
  563.                         'text/html'
  564.                     );
  566.                 $mailer->send($message);
  568.                 //send to raynet
  569.                 if (($model->role === UserGroup::ROLE_TEACHER) && ($_SERVER['APP_ENV'] === 'prod')) {
  570.                     $raynet->insertLead(
  571.                         'Contact from MyWow!',
  572.                         $model->firstname,
  573.                         $model->lastname,
  574.                         $model->email,
  575.                         '',
  576.                         $model->country->getCode()
  577.                     );
  578.                 }
  580.                 return $this->redirectToRoute('security_home');
  581.             } catch (Exception $e) {
  582.                 $this->addFlash('danger', $this->t->trans('register.error.internal'));
  584.                 return $this->redirectToRoute('security_home');
  585.             }
  586.         }
  588.         return $this->render('app/register.html.twig', [
  589.             'form' => $form->createView(),
  590.         ]);
  591.     }
  593.     private function validateTurnstile($token) {
  594.         $url = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
  596.         $data = [
  597.             'secret' => $this->getParameter('cf_turnstile_secret'),
  598.             'response' => $token,
  599.             'remoteip' => $_SERVER['REMOTE_ADDR']
  600.         ];
  602.         $options = [
  603.             'http' => [
  604.                 'header' => "Content-type: application/x-www-form-urlencoded\r\n",
  605.                 'method' => 'POST',
  606.                 'content' => http_build_query($data)
  607.             ]
  608.         ];
  610.         $context = stream_context_create($options);
  611.         $response = file_get_contents($url, false, $context);
  613.         if ($response === FALSE) {
  614.             return false;
  615.         }
  617.         return json_decode($response, true)['success'] ?? false;
  618.     }
  619. }