Replace dropped calls with checker, factory and security replacements

[airbundle] / Controller / UserController.php

diff --git a/Controller/UserController.php b/Controller/UserController.php
index 223b4631e09c97790c4465c3023ab5a5bb52cee7..8dc6d65e82733928660a82af4fab01d6943973e4 100644 (file)
--- a/Controller/UserController.php
+++ b/Controller/UserController.php
@@ -1,88 +1,158 @@
-<?php
+<?php declare(strict_types=1);
+
+/*
+ * This file is part of the Rapsys AirBundle package.
+ *
+ * (c) Raphaël Gertz <symfony@rapsys.eu>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */

 
 namespace Rapsys\AirBundle\Controller;
 
 use Symfony\Component\HttpFoundation\Request;
 
 namespace Rapsys\AirBundle\Controller;
 
 use Symfony\Component\HttpFoundation\Request;

+use Symfony\Component\HttpFoundation\Response;

 
 

-use Rapsys\AirBundle\Entity\Slot;
-use Rapsys\AirBundle\Entity\Session;
-use Rapsys\AirBundle\Entity\User;
+use Rapsys\UserBundle\Controller\UserController as BaseUserController;

 
 

-class UserController extends DefaultController {
+class UserController extends BaseUserController {

        /**
        /**

-        * List all sessions for the user
-        *
-        * @desc Display all sessions for the user with an application or login form
-        *
-        * @param Request $request The request instance
-        * @param int $id The user id
-        *
-        * @return Response The rendered view
+        * {@inheritdoc}

         */
         */

-       public function view(Request $request, $id) {
-               //Fetch doctrine
-               $doctrine = $this->getDoctrine();
-
-               //Fetch user
-               $user = $doctrine->getRepository(User::class)->findOneById($id);
-
-               //Set section
-               $section = $user->getPseudonym();
-
-               //Set title
-               $title = $section.' - '.$this->translator->trans($this->config['site']['title']);
-
-               //Init context
-               $context = [];
-
-               //Create application form for role_guest
-               if ($this->isGranted('ROLE_GUEST')) {
-                       //Create ApplicationType form
-                       $application = $this->createForm('Rapsys\AirBundle\Form\ApplicationType', null, [
-                               //Set the action
-                               'action' => $this->generateUrl('rapsys_air_application_add'),
-                               //Set the form attribute
-                               'attr' => [ 'class' => 'col' ],
-                               //Set admin
-                               'admin' => $this->isGranted('ROLE_ADMIN'),
-                               //Set default user to current
-                               'user' => $this->getUser()->getId(),
-                               //Set default slot to evening
-                               //XXX: default to Evening (3)
-                               'slot' => $doctrine->getRepository(Slot::class)->findOneById(3)
-                       ]);
+       public function edit(Request $request, string $hash, string $mail): Response {
+               //With invalid hash
+               if ($hash != $this->slugger->hash($mail)) {
+                       //Throw bad request
+                       throw new BadRequestHttpException($this->translator->trans('Invalid %field% field: %value%', ['%field%' => 'hash', '%value%' => $hash]));
+               }
+
+               //Get mail
+               $mail = $this->slugger->unshort($smail = $mail);
+
+               //With existing subscriber
+               if (empty($user = $this->doctrine->getRepository($this->config['class']['user'])->findOneByMail($mail))) {
+                       //Throw not found
+                       //XXX: prevent slugger reverse engineering by not displaying decoded mail
+                       throw $this->createNotFoundException($this->translator->trans('Unable to find account %mail%', ['%mail%' => $smail]));
+               }

 
 

-                       //Add form to context
-                       $context['application'] = $application->createView();
-               //Create login form for anonymous
-               } elseif (!$this->isGranted('IS_AUTHENTICATED_REMEMBERED')) {
-                       //Create ApplicationType form
-                       $login = $this->createForm('Rapsys\UserBundle\Form\LoginType', null, [
-                               //Set the action
-                               'action' => $this->generateUrl('rapsys_user_login'),
-                               //Set the form attribute
-                               'attr' => [ 'class' => 'col' ]
+               //Prevent access when not admin, user is not guest and not currently logged user
+               if (!$this->isGranted('ROLE_ADMIN') && $user != $this->getUser() || !$this->isGranted('IS_AUTHENTICATED_FULLY')) {
+                       //Throw access denied
+                       //XXX: prevent slugger reverse engineering by not displaying decoded mail
+                       throw $this->createAccessDeniedException($this->translator->trans('Unable to access user: %mail%', ['%mail%' => $smail]));
+               }
+
+               //Create the RegisterType form and give the proper parameters
+               $edit = $this->createForm($this->config['edit']['view']['edit'], $user, [
+                       //Set action to register route name and context
+                       'action' => $this->generateUrl($this->config['route']['edit']['name'], ['mail' => $smail, 'hash' => $this->slugger->hash($smail)]+$this->config['route']['edit']['context']),
+                       //Set civility class
+                       'civility_class' => $this->config['class']['civility'],
+                       //Set civility default
+                       'civility_default' => $this->doctrine->getRepository($this->config['class']['civility'])->findOneByTitle($this->config['default']['civility']),
+                       //Set country class
+                       'country_class' => $this->config['class']['country'],
+                       //Set country default
+                       'country_default' => $this->doctrine->getRepository($this->config['class']['country'])->findOneByTitle($this->config['default']['country']),
+                       //Set country favorites
+                       'country_favorites' => $this->doctrine->getRepository($this->config['class']['country'])->findByTitle($this->config['default']['country_favorites']),
+                       //Disable mail
+                       'mail' => $this->isGranted('ROLE_ADMIN'),
+                       //Disable pseudonym
+                       'pseudonym' => $this->isGranted('ROLE_GUEST'),
+                       //Disable password
+                       'password' => false,
+                       //Set method
+                       'method' => 'POST'
+               ]+$this->config['edit']['field']);
+
+               //With admin role
+               if ($this->isGranted('ROLE_ADMIN')) {
+                       //Create the LoginType form and give the proper parameters
+                       $reset = $this->createForm($this->config['edit']['view']['reset'], $user, [
+                               //Set action to register route name and context
+                               'action' => $this->generateUrl($this->config['route']['edit']['name'], ['mail' => $smail, 'hash' => $this->slugger->hash($smail)]+$this->config['route']['edit']['context']),
+                               //Disable mail
+                               'mail' => false,
+                               //Set method
+                               'method' => 'POST'

                        ]);
 
                        ]);
 

-                       //Add form to context
-                       $context['login'] = $login->createView();
+                       //With post method
+                       if ($request->isMethod('POST')) {
+                               //Refill the fields in case the form is not valid.
+                               $reset->handleRequest($request);
+
+                               //With reset submitted and valid
+                               if ($reset->isSubmitted() && $reset->isValid()) {
+                                       //Set data
+                                       $data = $reset->getData();
+
+                                       //Set password
+                                       $data->setPassword($this->hasher->hashPassword($data, $data->getPassword()));
+
+                                       //Queue snippet save
+                                       $this->manager->persist($data);
+
+                                       //Flush to get the ids
+                                       $this->manager->flush();
+
+                                       //Add notice
+                                       $this->addFlash('notice', $this->translator->trans('Account %mail% password updated', ['%mail%' => $mail = $data->getMail()]));
+
+                                       //Redirect to cleanup the form
+                                       return $this->redirectToRoute($this->config['route']['edit']['name'], ['mail' => $smail = $this->slugger->short($mail), 'hash' => $this->slugger->hash($smail)]+$this->config['route']['edit']['context']);
+                               }
+                       }
+
+                       //Add reset view
+                       $this->config['edit']['view']['context']['reset'] = $reset->createView();

                }
 
                }
 

-               //Compute period
-               $period = new \DatePeriod(
-                       //Start from first monday of week
-                       new \DateTime('Monday this week'),
-                       //Iterate on each day
-                       new \DateInterval('P1D'),
-                       //End with next sunday and 4 weeks
-                       new \DateTime('Monday this week + 5 week')
-               );
+               //With post method
+               if ($request->isMethod('POST')) {
+                       //Refill the fields in case the form is not valid.
+                       $edit->handleRequest($request);
+
+                       //With edit submitted and valid
+                       if ($edit->isSubmitted() && $edit->isValid()) {
+                               //Set data
+                               $data = $edit->getData();

 
 

-               //Fetch calendar
-               //TODO: highlight with current session route parameter
-               $calendar = $doctrine->getRepository(Session::class)->fetchUserCalendarByDatePeriod($this->translator, $period, $id, $request->get('session'));
+                               //Queue snippet save
+                               $this->manager->persist($data);

 
 

-               //Render the view
-               return $this->render('@RapsysAir/user/view.html.twig', ['id' => $id, 'title' => $title, 'section' => $section, 'calendar' => $calendar]+$context+$this->context);
+                               //Try saving in database
+                               try {
+                                       //Flush to get the ids
+                                       $this->manager->flush();
+
+                                       //Add notice
+                                       $this->addFlash('notice', $this->translator->trans('Account %mail% updated', ['%mail%' => $mail = $data->getMail()]));
+
+                                       //Redirect to cleanup the form
+                                       return $this->redirectToRoute($this->config['route']['edit']['name'], ['mail' => $smail = $this->slugger->short($mail), 'hash' => $this->slugger->hash($smail)]+$this->config['route']['edit']['context']);
+                               //Catch double slug or mail
+                               } catch (UniqueConstraintViolationException $e) {
+                                       //Add error message mail already exists
+                                       $this->addFlash('error', $this->translator->trans('Account %mail% already exists', ['%mail%' => $data->getMail()]));
+                               }
+                       }
+               //Without admin role
+               //XXX: prefer a reset on login to force user unspam action
+               } elseif (!$this->isGranted('ROLE_ADMIN')) {
+                       //Add notice
+                       $this->addFlash('notice', $this->translator->trans('To change your password login with your mail and any password then follow the procedure'));
+               }
+
+               //Render view
+               return $this->render(
+                       //Template
+                       $this->config['edit']['view']['name'],
+                       //Context
+                       ['edit' => $edit->createView(), 'sent' => $request->query->get('sent', 0)]+$this->config['edit']['view']['context']
+               );

        }
 }
        }
 }