src/Bidcoz/Bundle/FrontendBundle/Controller/CampaignResettingController.php line 49

Open in your IDE?
  1. <?php
  3. namespace Bidcoz\Bundle\FrontendBundle\Controller;
  5. use Bidcoz\Bundle\CoreBundle\Controller\CoreController;
  6. use Bidcoz\Bundle\CoreBundle\Entity\Campaign;
  7. use Bidcoz\Bundle\CoreBundle\Entity\Organization;
  8. use FOS\UserBundle\Event\FilterUserResponseEvent;
  9. use FOS\UserBundle\Event\FormEvent;
  10. use FOS\UserBundle\Event\GetResponseUserEvent;
  11. use FOS\UserBundle\FOSUserEvents;
  12. use FOS\UserBundle\Util\TokenGeneratorInterface;
  13. use Symfony\Component\HttpFoundation\RedirectResponse;
  14. use Symfony\Component\HttpFoundation\Request;
  15. use Symfony\Component\HttpFoundation\Response;
  16. use Symfony\Component\Routing\Annotation\Route;
  17. use Symfony\Component\Routing\RouterInterface;
  18. use Symfony\Component\Security\Core\Security;
  20. /**
  21.  * CAU-350 Part 2: the in-campaign password-reset variant.
  22.  *
  23.  * Mirrors LoginController's org/campaign scoping (`/{orgSlug}/...` and
  24.  * `/{orgSlug}/{campaignSlug}/...`) so a donor who starts a reset from inside a
  25.  * campaign is never ejected to the generic `/resetting` flow — the campaign context
  26.  * is carried through the request page, the emailed link, and the "return to sign in"
  27.  * link. The reset LOGIC is identical to the standalone
  28.  * {@see \Bidcoz\Bundle\UserBundle\Controller\ResettingController}; only the surrounding
  29.  * links and the emailed URL differ, so the two stay behaviourally in step.
  30.  *
  31.  * "resetting" is a reserved slug (see Constants), so these literal paths are never
  32.  * mistaken for a campaign slug by the campaign catch-all routes.
  33.  *
  34.  * @Route("/{orgSlug}")
  35.  */
  36. class CampaignResettingController extends CoreController
  37. {
  38.     /**
  39.      * @Route("/resetting/request", name="organization_resetting_request", methods={"GET"})
  40.      */
  41.     public function organizationRequest(Request $request, Organization $organization)
  42.     {
  43.         return $this->doRequest($request, $organization);
  44.     }
  46.     /**
  47.      * @Route("/{campaignSlug}/resetting/request", name="campaign_resetting_request", methods={"GET"})
  48.      */
  49.     public function campaignRequest(Request $request, Organization $organization, Campaign $campaign)
  50.     {
  51.         return $this->doRequest($request, $organization, $campaign);
  52.     }
  54.     /**
  55.      * @Route("/resetting/send-email", name="organization_resetting_send_email", methods={"POST"})
  56.      */
  57.     public function organizationSendEmail(Request $request, Organization $organization, TokenGeneratorInterface $tokenGenerator)
  58.     {
  59.         return $this->doSendEmail($request, $tokenGenerator, $organization);
  60.     }
  62.     /**
  63.      * @Route("/{campaignSlug}/resetting/send-email", name="campaign_resetting_send_email", methods={"POST"})
  64.      */
  65.     public function campaignSendEmail(Request $request, Organization $organization, Campaign $campaign, TokenGeneratorInterface $tokenGenerator)
  66.     {
  67.         return $this->doSendEmail($request, $tokenGenerator, $organization, $campaign);
  68.     }
  70.     /**
  71.      * @Route("/resetting/check-email", name="organization_resetting_check_email", methods={"GET"})
  72.      */
  73.     public function organizationCheckEmail(Request $request, Organization $organization)
  74.     {
  75.         return $this->doCheckEmail($request, $organization);
  76.     }
  78.     /**
  79.      * @Route("/{campaignSlug}/resetting/check-email", name="campaign_resetting_check_email", methods={"GET"})
  80.      */
  81.     public function campaignCheckEmail(Request $request, Organization $organization, Campaign $campaign)
  82.     {
  83.         return $this->doCheckEmail($request, $organization, $campaign);
  84.     }
  86.     /**
  87.      * @Route("/resetting/reset/{token}", name="organization_resetting_reset")
  88.      */
  89.     public function organizationReset(Request $request, Organization $organization, string $token)
  90.     {
  91.         return $this->doReset($request, $token, $organization);
  92.     }
  94.     /**
  95.      * @Route("/{campaignSlug}/resetting/reset/{token}", name="campaign_resetting_reset")
  96.      */
  97.     public function campaignReset(Request $request, Organization $organization, Campaign $campaign, string $token)
  98.     {
  99.         return $this->doReset($request, $token, $organization, $campaign);
  100.     }
  102.     protected function doRequest(Request $request, Organization $organization, ?Campaign $campaign = null): Response
  103.     {
  104.         $session      = $request->getSession();
  105.         $lastUsername = (null === $session) ? '' : $session->get(Security::LAST_USERNAME);
  107.         return $this->render('@FOSUser/Resetting/request.html.twig', [
  108.             'last_username'     => $lastUsername,
  109.             'organization'      => $organization,
  110.             'campaign'          => $campaign,
  111.             'send_email_action' => $this->scopedUrl('resetting_send_email', $organization, $campaign),
  112.             'sign_in_path'      => $this->loginUrl($organization, $campaign),
  113.         ]);
  114.     }
  116.     /**
  117.      * Mirrors FOSUser's sendEmailAction, but builds an org/campaign-scoped reset link
  118.      * and sends it through EmailManager (mechanism (a) — the standalone FOSMailer is
  119.      * left untouched). CAU-338 non-enumeration is preserved: the response is the same
  120.      * redirect to check-email whether or not an account exists.
  121.      */
  122.     protected function doSendEmail(Request $request, TokenGeneratorInterface $tokenGenerator, Organization $organization, ?Campaign $campaign = null): Response
  123.     {
  124.         $username = $request->request->get('username');
  125.         $user     = $this->getUserManager()->findUserByUsernameOrEmail($username);
  126.         $retryTtl = (int) $this->getParameter('fos_user.resetting.retry_ttl');
  128.         if (null !== $user && !$user->isPasswordRequestNonExpired($retryTtl)) {
  129.             if (null === $user->getConfirmationToken()) {
  130.                 $user->setConfirmationToken($tokenGenerator->generateToken());
  131.             }
  133.             $resetUrl = $this->scopedUrl(
  134.                 'resetting_reset',
  135.                 $organization,
  136.                 $campaign,
  137.                 ['token' => $user->getConfirmationToken()],
  138.                 RouterInterface::ABSOLUTE_URL
  139.             );
  141.             $this->getEmailManager()->sendEmail($organization, $user, 'user.reset_password', [
  142.                 'user'            => $user,
  143.                 'confirmationUrl' => $resetUrl,
  144.             ]);
  146.             $user->setPasswordRequestedAt(new \DateTime());
  147.             $this->getUserManager()->updateUser($user);
  148.         }
  150.         return new RedirectResponse(
  151.             $this->scopedUrl('resetting_check_email', $organization, $campaign, ['username' => $username])
  152.         );
  153.     }
  155.     protected function doCheckEmail(Request $request, Organization $organization, ?Campaign $campaign = null): Response
  156.     {
  157.         $username = $request->query->get('username');
  159.         // NO user lookup here, deliberately — same enumeration guard as the standalone
  160.         // flow (CAU-338). An empty username means the visitor did not arrive from the
  161.         // send-email step, so bounce back to the (scoped) request page.
  162.         if (empty($username)) {
  163.             return new RedirectResponse($this->scopedUrl('resetting_request', $organization, $campaign));
  164.         }
  166.         return $this->render('@FOSUser/Resetting/check_email.html.twig', [
  167.             'tokenLifetime' => ceil($this->getParameter('fos_user.resetting.token_ttl') / 3600),
  168.             'organization'  => $organization,
  169.             'campaign'      => $campaign,
  170.             'sign_in_path'  => $this->loginUrl($organization, $campaign),
  171.         ]);
  172.     }
  174.     protected function doReset(Request $request, string $token, Organization $organization, ?Campaign $campaign = null): Response
  175.     {
  176.         $formFactory = $this->get('fos_user.resetting.form.factory');
  177.         $userManager = $this->getUserManager();
  178.         $dispatcher  = $this->getEventDispatcher();
  180.         $user = $userManager->findUserByConfirmationToken($token);
  182.         if (null === $user) {
  183.             // Expired, already used, or never valid — deliberately indistinguishable
  184.             // (CAU-349). 410 Gone, token never echoed back.
  185.             return $this->render('@FOSUser/Resetting/invalid_token.html.twig', [
  186.                 'organization' => $organization,
  187.                 'campaign'     => $campaign,
  188.                 'request_path' => $this->scopedUrl('resetting_request', $organization, $campaign),
  189.                 'sign_in_path' => $this->loginUrl($organization, $campaign),
  190.             ], new Response('', Response::HTTP_GONE));
  191.         }
  193.         $event = new GetResponseUserEvent($user, $request);
  194.         $dispatcher->dispatch($event, FOSUserEvents::RESETTING_RESET_INITIALIZE);
  196.         if (null !== $event->getResponse()) {
  197.             return $event->getResponse();
  198.         }
  200.         $form = $formFactory->createForm();
  201.         $form->setData($user);
  202.         $form->handleRequest($request);
  204.         if ($form->isSubmitted() && $form->isValid()) {
  205.             $event = new FormEvent($form, $request);
  206.             $dispatcher->dispatch($event, FOSUserEvents::RESETTING_RESET_SUCCESS);
  208.             $userManager->updateUser($user);
  210.             if (null === $response = $event->getResponse()) {
  211.                 // Land back inside the campaign/org the reset was started from.
  212.                 $response = new RedirectResponse($this->homeUrl($organization, $campaign));
  213.             }
  215.             $dispatcher->dispatch(new FilterUserResponseEvent($user, $request, $response), FOSUserEvents::RESETTING_RESET_COMPLETED);
  217.             return $response;
  218.         }
  220.         return $this->render('@FOSUser/Resetting/reset.html.twig', [
  221.             'token'        => $token,
  222.             'form'         => $form->createView(),
  223.             'organization' => $organization,
  224.             'campaign'     => $campaign,
  225.             'reset_action' => $this->scopedUrl('resetting_reset', $organization, $campaign, ['token' => $token]),
  226.             'sign_in_path' => $this->loginUrl($organization, $campaign),
  227.         ]);
  228.     }
  230.     /**
  231.      * Generate a scoped resetting URL, picking the organization_* or campaign_*
  232.      * route by whether a campaign is in play.
  233.      */
  234.     private function scopedUrl(string $suffix, Organization $organization, ?Campaign $campaign, array $extra = [], int $referenceType = RouterInterface::ABSOLUTE_PATH): string
  235.     {
  236.         $prefix = null === $campaign ? 'organization_' : 'campaign_';
  238.         return $this->getRouter()->generate($prefix.$suffix, $this->routeParams($organization, $campaign, $extra), $referenceType);
  239.     }
  241.     private function loginUrl(Organization $organization, ?Campaign $campaign): string
  242.     {
  243.         $route = null === $campaign ? 'organization_login_user' : 'campaign_login_user';
  245.         return $this->getRouter()->generate($route, $this->routeParams($organization, $campaign));
  246.     }
  248.     private function homeUrl(Organization $organization, ?Campaign $campaign): string
  249.     {
  250.         $route = null === $campaign ? 'organization_home' : 'campaign_home';
  252.         return $this->getRouter()->generate($route, $this->routeParams($organization, $campaign));
  253.     }
  255.     private function routeParams(Organization $organization, ?Campaign $campaign, array $extra = []): array
  256.     {
  257.         $params = array_merge(['orgSlug' => $organization->getSlug()], $extra);
  259.         if (null !== $campaign) {
  260.             $params['campaignSlug'] = $campaign->getSlug();
  261.         }
  263.         return $params;
  264.     }
  265. }