X-Git-Url: https://git.rapsys.eu/airbundle/blobdiff_plain/558e8fc52bb6403cdeea8b45c9767a6678ca8905..05b55f89bc508b0d6c43c4d854fb5e9ffdf6484c:/Controller/UserController.php?ds=inline diff --git a/Controller/UserController.php b/Controller/UserController.php index 37ee540..b4f5765 100644 --- a/Controller/UserController.php +++ b/Controller/UserController.php @@ -1,93 +1,168 @@ - + * + * For the full copyright and license information, please view the LICENSE + * file that was distributed with this source code. + */ namespace Rapsys\AirBundle\Controller; +use Doctrine\Bundle\DoctrineBundle\Registry; +use Doctrine\ORM\EntityManagerInterface; use Symfony\Component\HttpFoundation\Request; +use Symfony\Component\HttpFoundation\Response; +use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface; + +use Rapsys\PackBundle\Util\SluggerUtil; -use Rapsys\AirBundle\Entity\Slot; -use Rapsys\AirBundle\Entity\Session; -use Rapsys\AirBundle\Entity\Location; -use Rapsys\AirBundle\Entity\User; +use Rapsys\UserBundle\Controller\DefaultController; class UserController extends DefaultController { /** - * List all sessions for the user - * - * @desc Display all sessions for the user with an application or login form - * - * @param Request $request The request instance - * @param int $id The user id - * - * @return Response The rendered view + * {@inheritdoc} */ - public function view(Request $request, $id) { - //Fetch doctrine - $doctrine = $this->getDoctrine(); - - //Fetch user - $user = $doctrine->getRepository(User::class)->findOneById($id); - - //Set section - $section = $user->getPseudonym(); - - //Set title - $title = $section.' - '.$this->translator->trans($this->config['site']['title']); - - //Init context - $context = []; - - //Create application form for role_guest - if ($this->isGranted('ROLE_GUEST')) { - //Create ApplicationType form - $application = $this->createForm('Rapsys\AirBundle\Form\ApplicationType', null, [ - //Set the action - 'action' => $this->generateUrl('rapsys_air_application_add'), - //Set the form attribute - 'attr' => [ 'class' => 'col' ], - //Set admin - 'admin' => $this->isGranted('ROLE_ADMIN'), - //Set default user to current - 'user' => $this->getUser()->getId(), - //Set default slot to evening - //XXX: default to Evening (3) - 'slot' => $doctrine->getRepository(Slot::class)->findOneById(3) - ]); + public function edit(Request $request, Registry $doctrine, UserPasswordEncoderInterface $encoder, EntityManagerInterface $manager, SluggerUtil $slugger, $mail, $hash): Response { + //With invalid hash + if ($hash != $slugger->hash($mail)) { + //Throw bad request + throw new BadRequestHttpException($this->translator->trans('Invalid %field% field: %value%', ['%field%' => 'hash', '%value%' => $hash])); + } + + //Get mail + $mail = $slugger->unshort($smail = $mail); + + //With existing subscriber + if (empty($user = $doctrine->getRepository($this->config['class']['user'])->findOneByMail($mail))) { + //Throw not found + //XXX: prevent slugger reverse engineering by not displaying decoded mail + throw $this->createNotFoundException($this->translator->trans('Unable to find account %mail%', ['%mail%' => $smail])); + } + + //Prevent access when not admin, user is not guest and not currently logged user + if (!$this->isGranted('ROLE_ADMIN') && $user != $this->getUser() || !$this->isGranted('IS_AUTHENTICATED_FULLY')) { + //Throw access denied + //XXX: prevent slugger reverse engineering by not displaying decoded mail + throw $this->createAccessDeniedException($this->translator->trans('Unable to access user: %mail%', ['%mail%' => $smail])); + } - //Add form to context - $context['application'] = $application->createView(); - //Create login form for anonymous - } elseif (!$this->isGranted('IS_AUTHENTICATED_REMEMBERED')) { - //Create ApplicationType form - $login = $this->createForm('Rapsys\UserBundle\Form\LoginType', null, [ - //Set the action - 'action' => $this->generateUrl('rapsys_user_login'), - //Set the form attribute - 'attr' => [ 'class' => 'col' ] + //Create the RegisterType form and give the proper parameters + $edit = $this->createForm($this->config['edit']['view']['edit'], $user, [ + //Set action to register route name and context + 'action' => $this->generateUrl($this->config['route']['edit']['name'], ['mail' => $smail, 'hash' => $slugger->hash($smail)]+$this->config['route']['edit']['context']), + //Set civility class + 'civility_class' => $this->config['class']['civility'], + //Set civility default + 'civility_default' => $doctrine->getRepository($this->config['class']['civility'])->findOneByTitle($this->config['default']['civility']), + //Disable mail + 'mail' => $this->isGranted('ROLE_ADMIN'), + //Disable pseudonym + 'pseudonym' => $this->isGranted('ROLE_GUEST'), + //Disable slug + 'slug' => $this->isGranted('ROLE_ADMIN'), + //Disable password + 'password' => false, + //Set method + 'method' => 'POST' + ]+$this->config['edit']['field']); + + //With admin role + if ($this->isGranted('ROLE_ADMIN')) { + //Create the LoginType form and give the proper parameters + $reset = $this->createForm($this->config['edit']['view']['reset'], $user, [ + //Set action to register route name and context + 'action' => $this->generateUrl($this->config['route']['edit']['name'], ['mail' => $smail, 'hash' => $slugger->hash($smail)]+$this->config['route']['edit']['context']), + //Disable mail + 'mail' => false, + //Set method + 'method' => 'POST' ]); - //Add form to context - $context['login'] = $login->createView(); + //With post method + if ($request->isMethod('POST')) { + //Refill the fields in case the form is not valid. + $reset->handleRequest($request); + + //With reset submitted and valid + if ($reset->isSubmitted() && $reset->isValid()) { + //Set data + $data = $reset->getData(); + + //Set password + $data->setPassword($encoder->encodePassword($data, $data->getPassword())); + + //Queue snippet save + $manager->persist($data); + + //Flush to get the ids + $manager->flush(); + + //Add notice + $this->addFlash('notice', $this->translator->trans('Account %mail% password updated', ['%mail%' => $mail = $data->getMail()])); + + //Redirect to cleanup the form + return $this->redirectToRoute($this->config['route']['edit']['name'], ['mail' => $smail = $slugger->short($mail), 'hash' => $slugger->hash($smail)]+$this->config['route']['edit']['context']); + } + } + + //Add reset view + $this->config['edit']['view']['context']['reset'] = $reset->createView(); } - //Compute period - $period = new \DatePeriod( - //Start from first monday of week - new \DateTime('Monday this week'), - //Iterate on each day - new \DateInterval('P1D'), - //End with next sunday and 4 weeks - new \DateTime('Monday this week + 5 week') - ); + //With post method + if ($request->isMethod('POST')) { + //Refill the fields in case the form is not valid. + $edit->handleRequest($request); - //Fetch calendar - //TODO: highlight with current session route parameter - $calendar = $doctrine->getRepository(Session::class)->fetchUserCalendarByDatePeriod($this->translator, $period, $id, $request->get('session')); + //With edit submitted and valid + if ($edit->isSubmitted() && $edit->isValid()) { + //Set data + $data = $edit->getData(); - //Fetch locations - //XXX: we want to display all active locations anyway - $locations = $doctrine->getRepository(Location::class)->fetchTranslatedUserLocationByDatePeriod($this->translator, $period, $id); + //With admin + if ($this->isGranted('ROLE_ADMIN')) { + //With pseudonym and without slug + if (!empty($pseudonym = $data->getPseudonym()) && empty($data->getSlug())) { + //Set slug + $data->setSlug($slugger->slug($pseudonym)); + } + } - //Render the view - return $this->render('@RapsysAir/user/view.html.twig', ['id' => $id, 'title' => $title, 'section' => $section, 'calendar' => $calendar, 'locations' => $locations]+$context+$this->context); + //Queue snippet save + $manager->persist($data); + + //Try saving in database + try { + //Flush to get the ids + $manager->flush(); + + //Add notice + $this->addFlash('notice', $this->translator->trans('Account %mail% updated', ['%mail%' => $mail = $data->getMail()])); + + //Redirect to cleanup the form + return $this->redirectToRoute($this->config['route']['edit']['name'], ['mail' => $smail = $slugger->short($mail), 'hash' => $slugger->hash($smail)]+$this->config['route']['edit']['context']); + //Catch double slug or mail + } catch (UniqueConstraintViolationException $e) { + //Add error message mail already exists + $this->addFlash('error', $this->translator->trans('Account %mail% already exists', ['%mail%' => $data->getMail()])); + } + } + //Without admin role + //XXX: prefer a reset on login to force user unspam action + } elseif (!$this->isGranted('ROLE_ADMIN')) { + //Add notice + $this->addFlash('notice', $this->translator->trans('To change your password login with your mail and any password then follow the procedure')); + } + + //Render view + return $this->render( + //Template + $this->config['edit']['view']['name'], + //Context + ['edit' => $edit->createView(), 'sent' => $request->query->get('sent', 0)]+$this->config['edit']['view']['context'] + ); } }