Cadoles
/
hydra-sql
21
0
Fork 0
Code Issues 4 Pull Requests 1 Projects Releases Wiki Activity

Vérification challenge dans la session #31 #32

Merged
mlamalle merged 3 commits from issue-31 into develop 2024-04-25 11:27:01 +02:00
Conversation 7 Commits 3 Files Changed 10 +37 -30
3 changed files with 37 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit bcc91a17b4 - Show all commits

26
src/Controller/MainController.php
View File

@ -6,11 +6,12 @@ use App\Entity\User;
use App\Hydra\Client;
use App\Hydra\HydraService;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpFoundation\Session\SessionInterface;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\Finder\Exception\AccessDeniedException;
use Symfony\Component\HttpFoundation\Session\SessionInterface;
class MainController extends AbstractController
{
@ -26,7 +27,7 @@ class MainController extends AbstractController
}
#[Route('/', name: 'app_home')]
public function home(Request $request)
public function home(Request $request): RedirectResponse
{
return $this->hydra->handleLoginRequest($request);
}
@ -34,17 +35,24 @@ class MainController extends AbstractController
* Route de Healthcheck (notament pour kubernetes)
*/
#[Route('/health', name: 'health')]
public function health(Request $request)
public function health(Request $request): Response
{
return new Response('healthy', 200);
}
#[Route('/connect/login-accept', name: 'app_login_accept')]
public function loginAccept(Request $request)
#[Route('/connect/login-accept', name: 'app_login_accept', methods: ['GET'])]
public function loginAccept(Request $request): RedirectResponse
{
/** @var User */
$user = $this->getUser();
$loginAcceptRes = $this->client->acceptLoginRequest($this->session->get('challenge'), [
if (!$user instanceof User) {
throw new AccessDeniedException();
}
$challenge = $this->session->get('challenge');
if (!$challenge) {
return new RedirectResponse($this->getParameter('issuer_url'));
}
$loginAcceptRes = $this->client->acceptLoginRequest($challenge, [
'subject' => $user->getLogin(),
'remember' => true,
])->toArray();
@ -53,7 +61,7 @@ class MainController extends AbstractController
}
#[Route('/connect/consent', name: 'app_consent')]
public function consent(Request $request)
public function consent(Request $request): RedirectResponse
{
return $this->hydra->handleConsentRequest($request);
}

24
src/Hydra/HydraService.php
View File

@ -2,6 +2,7 @@
namespace App\Hydra;
use App\Entity\User;
use App\Hydra\Exception\InvalidChallengeException;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Exception\BadRequestException;
@ -9,13 +10,14 @@ use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Session\SessionInterface;
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
class HydraService extends AbstractController
{
public SessionInterface $session;
public Client $client;
public TokenStorageInterface $tokenStorage;
public string $baseUrl;
private SessionInterface $session;
private Client $client;
private TokenStorageInterface $tokenStorage;
private string $baseUrl;
public function __construct(Client $client, SessionInterface $session, TokenStorageInterface $tokenStorage, string $baseUrl)
{
@ -25,7 +27,7 @@ class HydraService extends AbstractController
$this->baseUrl = $baseUrl;
}
public function handleLoginRequest(Request $request)
public function handleLoginRequest(Request $request): RedirectResponse
{
$challenge = $request->query->get('login_challenge');
// S'il n'y a pas de challenge, on déclenche une bad request
@ -37,15 +39,15 @@ class HydraService extends AbstractController
$loginRequestInfo = $res->toArray();
if (200 !== $res->getStatusCode()) {
$this->session->clear();
throw new BadRequestException('pas de code 200');
throw new BadRequestException();
}
// si le challenge est validé par hydra, on le stocke en session pour l'utiliser par la suite et on redirige vers une route interne protégée qui va déclencher l'identification FranceConnect
$this->session->set('challenge', $loginRequestInfo['challenge']);
return new RedirectResponse($this->baseUrl.'/connect/login-accept');
return new RedirectResponse($this->baseUrl . '/connect/login-accept');
}
public function handleConsentRequest(Request $request)
public function handleConsentRequest(Request $request): RedirectResponse
{
$challenge = $request->query->get('consent_challenge');
if (!$challenge) {
@ -53,8 +55,10 @@ class HydraService extends AbstractController
}
$consentRequestInfo = $this->client->fetchConsentRequestInfo($challenge)->toArray();
/** @var User */
$user = $this->getUser();
if (!$user instanceof User) {
throw new AccessDeniedException('Utilisateur non autorisé.');
}
$consentAcceptResponse = $this->client->acceptConsentRequest($consentRequestInfo['challenge'], [
'grant_scope' => $consentRequestInfo['requested_scope'],
'session' => [
@ -65,7 +69,7 @@ class HydraService extends AbstractController
return new RedirectResponse($consentAcceptResponse['redirect_to']);
}
public function handleLogoutRequest(Request $request)
public function handleLogoutRequest(Request $request): RedirectResponse
{
$logoutChallenge = $request->get('logout_challenge');
if (empty($logoutChallenge)) {

9
src/Service/SQLLoginService.php
View File

@ -17,7 +17,7 @@ class SQLLoginService extends AbstractController
$this->sqlLoginRequest = $sqlLoginRequest;
}
public function fetchDatas($login)
public function fetchDatas(string $login)
{
try {
$dbh = $this->getConnection();
@ -36,12 +36,7 @@ class SQLLoginService extends AbstractController
return $datas;
}
/**
* @param mixed $login
*
* @return bool
*/
public function fetchPassword($login)
public function fetchPassword(string $login)
{
try {
$dbh = $this->getConnection();