src/Controller/SecurityController.php line 109

Open in your IDE?
  1. <?php
  3. namespace App\Controller;
  5. use App\Entity\Book;
  6. use App\Entity\Subscription;
  7. use App\Entity\MagicToken;
  8. use App\Entity\Token;
  9. use App\Entity\User;
  10. use App\Entity\UserAttribute;
  11. use App\Entity\UserAttributeValue;
  12. use App\Entity\Country;
  13. use App\Entity\UserGroup;
  14. use App\Form\Model\Security\RegisterModel;
  15. use App\Form\Model\Security\ResetModel;
  16. use App\Form\Type\Security\RegisterType;
  17. use App\Form\Type\Security\ResetType;
  18. use App\Service\AccountLog;
  19. use App\Service\GeoIP2;
  20. use App\Service\Raynet;
  21. use App\Service\TeacherProfileService;
  22. use App\Utils\TokenUtil;
  23. use DateTime;
  24. use Doctrine\DBAL\Exception\UniqueConstraintViolationException;
  25. use Doctrine\ORM\EntityManagerInterface;
  26. use Exception;
  27. use Swift_Mailer;
  28. use Swift_Message;
  29. use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
  30. use Symfony\Component\HttpFoundation\JsonResponse;
  31. use Symfony\Component\HttpFoundation\Request;
  32. use Symfony\Component\HttpFoundation\Response;
  33. use Symfony\Component\Routing\Annotation\Route;
  34. use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
  35. use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
  36. use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface;
  37. use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
  38. use Symfony\Contracts\Translation\TranslatorInterface;
  40. /**
  41.  * @Route("/{_locale}", name="security_")
  42.  */
  43. class SecurityController extends AbstractController
  44. {
  45.     /**
  46.      * @var EntityManagerInterface
  47.      */
  48.     private $em;
  50.     /**
  51.      * @var TranslatorInterface
  52.      */
  53.     private $t;
  55.     /**
  56.      * @var UserPasswordEncoderInterface
  57.      */
  58.     private $encoder;
  60.     /**
  61.      * @var AccountLog
  62.      */
  63.     private $accountLog;
  65.     /**
  66.      * SecurityController constructor.
  67.      * @param EntityManagerInterface $em
  68.      * @param TranslatorInterface $t
  69.      * @param UserPasswordEncoderInterface $encoder
  70.      * @param AccountLog $accountLog
  71.      */
  72.     public function __construct(EntityManagerInterface $em, TranslatorInterface $t, UserPasswordEncoderInterface $encoder, AccountLog $accountLog)
  73.     {
  74.         $this->em = $em;
  75.         $this->t = $t;
  76.         $this->encoder = $encoder;
  77.         $this->accountLog = $accountLog;
  78.     }
  80.     /**
  81.      * @Route("/login/", name="login")
  82.      *
  83.      * @param AuthenticationUtils $authenticationUtils
  84.      * @return Response
  85.      */
  86.     public function loginAction(Request $request, AuthenticationUtils $authenticationUtils): Response
  87.     {
  88.         if ($this->get('security.authorization_checker')->isGranted('ROLE_USER')) {
  89.             return $this->redirect($this->generateUrl('app_library_index', $request->query->all()));
  90.         }
  92.         return $this->redirect($this->generateUrl('security_home', $request->query->all()));
  93.     }
  95.     /**
  96.      * @Route("/", name="home")
  97.      *
  98.      * @param Request $request
  99.      * @param AuthenticationUtils $authenticationUtils
  100.      * @return Response
  101.      */
  102.     public function appLoginAction(Request $request, AuthenticationUtils $authenticationUtils): Response
  103.     {
  104.         // TODO: redirect, when user is logged in?
  106.         $error = $authenticationUtils->getLastAuthenticationError();
  107.         $lastUsername = $authenticationUtils->getLastUsername();
  109.         $session = $this->get('session');
  110.         $redirect = $session->get('redirect_url') ?? $this->generateUrl('app_library_index', $request->query->all());
  112.         return $this->render('app/home.html.twig', [
  113.             'last_username' => $lastUsername,
  114.             'error' => $error,
  115.             'redirect' => $redirect,
  116.         ]);
  117.     }
  119.     /**
  120.      * Clean login page (login form + SSO + register link only), used as the OAuth2 /authorize landing page.
  121.      *
  122.      * @Route("/sign-in/", name="sign_in")
  123.      */
  124.     public function signInAction(Request $request, AuthenticationUtils $authenticationUtils): Response
  125.     {
  126.         $error = $authenticationUtils->getLastAuthenticationError();
  127.         $lastUsername = $authenticationUtils->getLastUsername();
  129.         $session = $this->get('session');
  130.         $redirect = $session->get('redirect_url') ?? $this->generateUrl('app_library_index', $request->query->all());
  132.         return $this->render('app/login.html.twig', [
  133.             'last_username' => $lastUsername,
  134.             'error' => $error,
  135.             'redirect' => $redirect,
  136.         ]);
  137.     }
  139.     /**
  140.      * Consumes a single-use magic token (from POST /api/account/session-bridge), logs the user
  141.      * into the web session and drops them on the locked-down standalone settings screen.
  142.      *
  143.      * @Route("/account/session-bridge/{token}", name="account_session_bridge", methods={"GET"})
  144.      */
  145.     public function sessionBridgeAction(Request $request, string $token): Response
  146.     {
  147.         $magic = $this->em->getRepository(MagicToken::class)->findOneBy(['code' => $token]);
  149.         if ($magic instanceof MagicToken) {
  150.             $expired = (new DateTime())->getTimestamp() > $magic->getExpiration()->getTimestamp();
  151.             $user = $magic->getUser();
  152.             // Single use: drop it whether valid or expired.
  153.             $this->em->remove($magic);
  154.             $this->em->flush();
  156.             if (!$expired) {
  157.                 $authToken = new UsernamePasswordToken($user, null, 'main', $user->getRoles());
  158.                 $this->get('security.token_storage')->setToken($authToken);
  160.                 $session = $request->getSession();
  161.                 $session->set('_security_main', serialize($authToken));
  162.                 $session->set('account_bridge', true);
  164.                 return $this->redirectToRoute('app_settings_index');
  165.             }
  166.         }
  168.         // Render the error on the standalone page instead of redirecting to the homepage:
  169.         // the app must not be able to fall back to a normal login that escapes the locked flow.
  170.         return $this->render('app/account_bridge_error.html.twig');
  171.     }
  173.     /**
  174.      * @Route("/new-password/", name="new_password")
  175.      *
  176.      * @return Response
  177.      */
  178.     public function newPasswordAction(): Response
  179.     {
  180.         return $this->render('security/password.new.html.twig');
  181.     }
  183.     /**
  184.      * @Route("/new-password/handle/", name="new_password_handle")
  185.      *
  186.      * @param Request $request
  187.      * @param Swift_Mailer $mailer
  188.      * @return Response
  189.      */
  190.     public function newPasswordHandleAction(Request $request, Swift_Mailer $mailer): Response
  191.     {
  192.         $email = $request->request->get('address') ?? $request->query->get('address');
  194.         $user = $this->em->getRepository(User::class)->findOneBy(['email' => $email]);
  195.         if (!$user instanceof User) {
  196.             $this->accountLog->warning('Password reset requested for unknown e-mail.', null, ['requested_email' => $email]);
  197.             $this->addFlash('danger', $this->t->trans('password.reset.mail.invalid'));
  199.             return $this->redirectToRoute('security_new_password');
  200.         }
  202.         try {
  203.             $tokenValue = TokenUtil::generate(64);
  205.             $token = $this->em->getRepository(Token::class)->findOneBy(['user' => $user]);
  206.             if (!$token instanceof Token) {
  207.                 $token = new Token();
  208.             }
  210.             $expirationDate = (new DateTime())->modify('+1 hour');
  211.             $token
  212.                 ->setCode($tokenValue)
  213.                 ->setUser($user)
  214.                 ->setExpiration($expirationDate);
  216.             $this->em->persist($token);
  217.             $this->em->flush();
  219.             $message = (new Swift_Message("Forgotten Password"))
  220.                 ->setFrom($_SERVER['MAILER_SENDER_EMAIL'], $_SERVER['MAILER_SENDER_NAME'])
  221.                 ->setTo($user->getEmail())
  222.                 ->setBody(
  223.                     $this->renderView('mail/password.reset.html.twig', [
  224.                         'magic_link' => $this->generateUrl('security_create_password', ['code' => $token->getCode()],
  225.                             UrlGeneratorInterface::ABSOLUTE_URL),
  226.                     ]),
  227.                     'text/html'
  228.                 );
  230.             if ($klerkId = $this->getParameter('klerk_forget')) {
  231.                 $message->getHeaders()->addTextHeader('X-CampaignID', $klerkId);
  232.             }
  234.             $mailer->send($message);
  235.             $this->accountLog->log('Password reset link sent.', $user);
  236.             $this->addFlash('success', $this->t->trans('password.reset.mail.success'));
  238.             return $this->redirectToRoute('security_home');
  239.         } catch (Exception $e) {
  240.             $this->addFlash('danger', $this->t->trans('password.reset.error.internal'));
  242.             return $this->redirectToRoute('security_new_password');
  243.         }
  244.     }
  246.     /**
  247.      * @Route("/reset-password/{code}/", name="create_password")
  248.      *
  249.      * @param Request $request
  250.      * @param string $code
  251.      * @return Response
  252.      * @throws Exception
  253.      */
  254.     public function resetPasswordAction(Request $request, string $code): Response
  255.     {
  256.         $token = $this->em->getRepository(Token::class)->findOneBy(['code' => $code]);
  257.         if (!$token instanceof Token) {
  258.             $this->addFlash('danger', $this->t->trans('password.reset.notrequested'));
  260.             return $this->redirectToRoute('security_home');
  261.         }
  263.         if ((new DateTime())->getTimestamp() > $token->getExpiration()->getTimestamp()) {
  264.             $this->addFlash('danger', $this->t->trans('password.reset.expired'));
  266.             return $this->redirectToRoute('security_home');
  267.         }
  269.         $form = $this->createForm(ResetType::class);
  271.         $form->handleRequest($request);
  272.         if ($form->isSubmitted() && $form->isValid()) {
  273.             /** @var ResetModel $model */
  274.             $model = $form->getData();
  276.             try {
  277.                 $user = $token->getUser();
  278.                 $password = $this->encoder->encodePassword($user, $model->password);
  280.                 $user->setPassword($password);
  281.                 $user->setActive(true);
  282.                 $this->em->persist($user);
  283.                 $this->em->flush();
  285.                 $this->accountLog->log('Password changed via reset link.', $user);
  286.                 $this->addFlash('success', $this->t->trans('password.reset.success'));
  288.                 return $this->redirectToRoute('security_home');
  289.             } catch (Exception $e) {
  290. //                $this->addFlash('danger', $this->t->trans('password.reset.error.internal'));
  291.                 throw $e;
  292.             }
  293.         }
  295.         return $this->render('security/password.reset.html.twig', [
  296.             'form' => $form->createView(),
  297.         ]);
  298.     }
  300.     /**
  301.      * Confirms a newly registered user's email address (reuses the password-reset Token).
  302.      *
  303.      * @Route("/verify-email/{code}/", name="verify_email")
  304.      *
  305.      * @param string $code
  306.      * @param Swift_Mailer $mailer
  307.      * @return Response
  308.      * @throws Exception
  309.      */
  310.     public function verifyEmailAction(string $code, Swift_Mailer $mailer): Response
  311.     {
  312.         $token = $this->em->getRepository(Token::class)->findOneBy(['code' => $code]);
  313.         if (!$token instanceof Token || (new DateTime())->getTimestamp() > $token->getExpiration()->getTimestamp()) {
  314.             $this->addFlash('danger', $this->t->trans('register.verify.invalid'));
  316.             return $this->redirectToRoute('security_home');
  317.         }
  319.         $user = $token->getUser();
  320.         $user->setActive(true);
  322.         $this->em->remove($token);
  323.         $this->em->flush();
  325.         $this->accountLog->log('E-mail address verified.', $user);
  327.         //8.6.2026 na přání klienta vypnuto posílání uvítacího e-mailu na učitele
  328.         if (!in_array(UserGroup::ROLE_TEACHER, $user->getRoles(), true)) {
  329.             $message = (new Swift_Message($this->t->trans('registration.title', [], 'mailing')))
  330.                 ->setFrom($_SERVER['MAILER_SENDER_EMAIL'], $_SERVER['MAILER_SENDER_NAME'])
  331.                 ->setTo($user->getEmail())
  332.                 ->setBody(
  333.                     $this->renderView('mail/registration.html.twig'),
  334.                     'text/html'
  335.                 );
  337.             if ($klerkId = $this->getParameter('klerk_welcome')) {
  338.                 $message->getHeaders()->addTextHeader('X-CampaignID', $klerkId);
  339.             }
  341.             $mailer->send($message);
  342.         }
  344.         $this->addFlash('success', $this->t->trans('register.verify.success'));
  346.         return $this->redirectToRoute('security_home');
  347.     }
  349.     /**
  350.      * Autocomplete endpoint for the school select on the registration page.
  351.      * Reads the slim JSON produced by `app:import-schools` and returns
  352.      * matching rows in the shape Select2 expects.
  353.      *
  354.      * @Route("/register/schools-search/", name="register_schools_search", methods={"GET"})
  355.      */
  356.     public function registerSchoolsSearchAction(Request $request): JsonResponse
  357.     {
  358.         $query = trim((string) $request->query->get('q', ''));
  359.         $kindFilter = trim((string) $request->query->get('kind', '')); // '', 'zs', 'ms', 'zs_ms'
  360.         $limit = 30;
  362.         static $cache = null;
  363.         if ($cache === null) {
  364.             $path = $this->getParameter('kernel.project_dir') . '/var/data/skoly.json';
  365.             $cache = is_file($path)
  366.                 ? (json_decode((string) file_get_contents($path), true) ?: [])
  367.                 : [];
  368.         }
  370.         // Map UI kind onto accepted kinds in the data (OR within the array):
  371.         //   'zs'       → entry must have 'zs'
  372.         //   'ms'       → entry must have 'ms'
  373.         //   'zs_ms'    → entry must have 'zs' OR 'ms' (any of them)
  374.         //   ''/'other' → no filter
  375.         $anyOf = [];
  376.         if ($kindFilter === 'zs')    { $anyOf = ['zs']; }
  377.         if ($kindFilter === 'ms')    { $anyOf = ['ms']; }
  378.         if ($kindFilter === 'zs_ms') { $anyOf = ['zs', 'ms']; }
  380.         $normalize = static function (string $s): string {
  381.             $s = mb_strtolower($s, 'UTF-8');
  382.             if (function_exists('iconv')) {
  383.                 $ascii = @iconv('UTF-8', 'ASCII//TRANSLIT//IGNORE', $s);
  384.                 if ($ascii !== false) {
  385.                     $s = $ascii;
  386.                 }
  387.             }
  388.             return $s;
  389.         };
  391.         $needle = $normalize($query);
  393.         $matches = [];
  394.         foreach ($cache as $row) {
  395.             if ($anyOf) {
  396.                 $kinds = $row['kinds'] ?? '';
  397.                 $hit = false;
  398.                 foreach ($anyOf as $k) {
  399.                     if (strpos($kinds, $k) !== false) {
  400.                         $hit = true;
  401.                         break;
  402.                     }
  403.                 }
  404.                 if (!$hit) {
  405.                     continue;
  406.                 }
  407.             }
  408.             if ($needle !== '') {
  409.                 $hay = $normalize($row['name'] . ' ' . ($row['address'] ?? ''));
  410.                 if (strpos($hay, $needle) === false) {
  411.                     continue;
  412.                 }
  413.             }
  414.             $matches[] = [
  415.                 'id'      => $row['id'],
  416.                 'text'    => $row['name'] . ($row['address'] ? ' — ' . $row['address'] : ''),
  417.                 'name'    => $row['name'],
  418.                 'address' => $row['address'] ?? '',
  419.             ];
  420.             if (count($matches) >= $limit) {
  421.                 break;
  422.             }
  423.         }
  425.         return new JsonResponse(['results' => $matches]);
  426.     }
  428.     /**
  429.      * @Route("/register/teacher-info/", name="register_teacher_info")
  430.      *
  431.      * @param Request $request
  432.      * @param TeacherProfileService $teacherProfile
  433.      * @return Response
  434.      */
  435.     public function registerTeacherInfoAction(Request $request, TeacherProfileService $teacherProfile, GeoIP2 $geoIP2): Response
  436.     {
  437.         /** @var User|null $user */
  438.         $user = $this->getUser();
  439.         if (!$user instanceof User || !in_array(UserGroup::ROLE_TEACHER, $user->getRoles(), true)) {
  440.             return $this->redirectToRoute('security_home');
  441.         }
  443.         if ($request->isMethod('POST')) {
  444.             if (!$this->isCsrfTokenValid('teacher_info', $request->request->get('_token'))) {
  445.                 $this->addFlash('danger', $this->t->trans('register.error.internal'));
  447.                 return $this->redirectToRoute('security_register_teacher_info');
  448.             }
  450.             $teacherProfile->apply($user, $request);
  452.             $countryCode = trim((string) $request->request->get('teacher_country', ''));
  453.             if ($countryCode !== '') {
  454.                 $country = $this->em->getRepository(Country::class)->findOneBy(['code' => $countryCode]);
  455.                 if ($country instanceof Country) {
  456.                     $user->setCountry($country);
  457.                 }
  458.             }
  460.             $this->em->flush();
  462.             if (!$teacherProfile->isComplete($user)) {
  463.                 $this->addFlash('danger', $this->t->trans('teacher.info.incomplete'));
  465.                 return $this->redirectToRoute('security_register_teacher_info');
  466.             }
  468.             $this->accountLog->log('Teacher profile completed.', $user);
  469.             $this->addFlash('success', $this->t->trans('settings.success'));
  471.             return $this->redirectToRoute('app_library_index');
  472.         }
  474.         $country = $user->getCountry();
  476.         return $this->render('app/register_teacher_info.html.twig', [
  477.             'prefill' => $teacherProfile->getPrefill($user),
  478.             'cz' => $country !== null && $country->getCode() === 'CZ',
  479.             'countries' => $this->em->getRepository(Country::class)->findBy([], ['name' => 'ASC']),
  480.             'current_country' => $country?->getCode() ?? $geoIP2->getCountry()?->getCode(),
  481.         ]);
  482.     }
  484.     /**
  485.      * @Route("/register/", name="register")
  486.      *
  487.      * @param Request $request
  488.      * @param Swift_Mailer $mailer
  489.      * @param GeoIP2 $geoIP2
  490.      * @return Response
  491.      */
  492.     public function registerAction(Request $request, Swift_Mailer $mailer, GeoIP2 $geoIP2, Raynet $raynet, TeacherProfileService $teacherProfile): Response
  493.     {
  494.         $form = $this->createForm(RegisterType::class, new RegisterModel($geoIP2->getCountry()));
  496.         $form->handleRequest($request);
  497.         if ($form->isSubmitted() && $form->isValid()) {
  498.             /** @var RegisterModel $model */
  499.             $model = $form->getData();
  501.             if ($model->emailConfirm !== null) {
  502.                 return $this->redirectToRoute('security_register');
  503.             }
  505.             if (!$request->request->get('cf-turnstile-response') || !$this->validateTurnstile($request->request->get('cf-turnstile-response'))) {
  506.                 $this->addFlash('danger', $this->t->trans('register.error.internal'));
  507.                 return $this->redirectToRoute('security_register');
  508.             }
  510.             try {
  511.                 $group = $this->em->getRepository(UserGroup::class)->findOneBy(['role' => $model->role]);
  512.                 $user = (new User())
  513.                     ->setUsername($model->email)
  514.                     ->setEmail($model->email)
  515.                     ->setGroup($group)
  516.                     ->setCountry($model->country)
  517.                     ->setActive(false);
  519.                 $password = $this->encoder->encodePassword($user, $model->password);
  520.                 $user->setPassword($password);
  522.                 $firstnameAttr = $this->em->getRepository(UserAttribute::class)->findOneBy(['name' => 'firstname']);
  523.                 $lastnameAttr = $this->em->getRepository(UserAttribute::class)->findOneBy(['name' => 'lastname']);
  525.                 $firstnameAttrValue = (new UserAttributeValue())
  526.                     ->setUser($user)
  527.                     ->setAttribute($firstnameAttr)
  528.                     ->setValue($model->firstname);
  530.                 $lastnameAttrValue = (new UserAttributeValue())
  531.                     ->setUser($user)
  532.                     ->setAttribute($lastnameAttr)
  533.                     ->setValue($model->lastname);
  535.                 $this->em->persist($user);
  536.                 $this->em->persist($firstnameAttrValue);
  537.                 $this->em->persist($lastnameAttrValue);
  539.                 if ($model->role === UserGroup::ROLE_TEACHER) {
  540.                     $teacherProfile->apply($user, $request);
  541.                 }
  543.                 //temporarily add 1 month subscription of all books here
  544.                 $books = $this->em->getRepository(Book::class)->findAll();
  545.                 foreach ($books as $book) {
  546.                     $subscription = new Subscription($user, $book, new DateTime('+1 month'), null, true, false, false);
  547.                     $this->em->persist($subscription);
  548.                 }
  550.                 try {
  551.                     $this->em->flush();
  552.                 } catch (UniqueConstraintViolationException $e) {
  553.                     $this->addFlash('danger', $this->t->trans('register.error.existing'));
  555.                     return $this->redirectToRoute('security_home');
  556.                 }
  558.                 $this->addFlash('success', $this->t->trans('register.verify.sent'));
  560.                 $verificationToken = (new Token())
  561.                     ->setCode(TokenUtil::generate(64))
  562.                     ->setUser($user)
  563.                     ->setExpiration((new DateTime())->modify('+1 week'));
  565.                 $this->em->persist($verificationToken);
  566.                 $this->em->flush();
  568.                 $this->accountLog->log('Account registered.', $user, ['role' => $model->role]);
  570.                 $message = (new Swift_Message($this->t->trans('register.verify.title', [], 'mailing')))
  571.                     ->setFrom($_SERVER['MAILER_SENDER_EMAIL'], $_SERVER['MAILER_SENDER_NAME'])
  572.                     ->setTo($user->getEmail())
  573.                     ->setBody(
  574.                         $this->renderView('mail/password.reset.html.twig', [
  575.                             'magic_link' => $this->generateUrl('security_verify_email', ['code' => $verificationToken->getCode()],
  576.                                 UrlGeneratorInterface::ABSOLUTE_URL),
  577.                             'content_key' => 'register.verify.mailcontent',
  578.                         ]),
  579.                         'text/html'
  580.                     );
  582.                 $mailer->send($message);
  584.                 //send to raynet
  585.                 if (($model->role === UserGroup::ROLE_TEACHER) && ($_SERVER['APP_ENV'] === 'prod')) {
  586.                     $raynet->insertLead(
  587.                         'Contact from MyWow!',
  588.                         $model->firstname,
  589.                         $model->lastname,
  590.                         $model->email,
  591.                         '',
  592.                         $model->country->getCode()
  593.                     );
  594.                 }
  596.                 return $this->redirectToRoute('security_home');
  597.             } catch (Exception $e) {
  598.                 $this->addFlash('danger', $this->t->trans('register.error.internal'));
  600.                 return $this->redirectToRoute('security_home');
  601.             }
  602.         }
  604.         return $this->render('app/register.html.twig', [
  605.             'form' => $form->createView(),
  606.         ]);
  607.     }
  609.     private function validateTurnstile($token) {
  610.         $url = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
  612.         $data = [
  613.             'secret' => $this->getParameter('cf_turnstile_secret'),
  614.             'response' => $token,
  615.             'remoteip' => $_SERVER['REMOTE_ADDR']
  616.         ];
  618.         $options = [
  619.             'http' => [
  620.                 'header' => "Content-type: application/x-www-form-urlencoded\r\n",
  621.                 'method' => 'POST',
  622.                 'content' => http_build_query($data)
  623.             ]
  624.         ];
  626.         $context = stream_context_create($options);
  627.         $response = file_get_contents($url, false, $context);
  629.         if ($response === FALSE) {
  630.             return false;
  631.         }
  633.         return json_decode($response, true)['success'] ?? false;
  634.     }
  635. }