CODEWITHSUNDEEP
phpmysqlsymfony
Maciej
Maciej

Reputation: 65

Deny access if user is not confirmed on Symfony

I find it difficult to figure out how to deny access to site for some users that have is_active set to false in the database. How can I modify the current LoginController to check the database for the value and throw some AccessDenied exception?

Below is LoginController.php

namespace App\Controller\User;

use App\Form\User\LoginType;
use Symfony\Bundle\FrameworkBundle\Controller\Controller;
use Symfony\Component\Form\FormError;
use Symfony\Component\Form\FormFactoryInterface;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
use Twig\Environment;

/**
 * @Route("/login", name="login")
 */
final class LoginController extends Controller
{
    public function __invoke(
        Environment $twig,
        FormFactoryInterface $formFactory,
        AuthenticationUtils $authenticationUtils
    ): Response {
        if ($this->get('security.authorization_checker')->isGranted('IS_AUTHENTICATED_FULLY')) {
            return new RedirectResponse('/profile');
        }

        $form = $formFactory->createNamed('', LoginType::class, [
            'email' => $authenticationUtils->getLastUsername(),
        ]);

        if (null !== $error = $authenticationUtils->getLastAuthenticationError(true)) {
            $form->addError(new FormError($error->getMessage(), $error->getMessageKey(), $error->getMessageData()));
        }

        return new Response($twig->render('user/login.html.twig', [
            'form' => $form->createView(),
        ]));
    }
}

My database has a table "user": 

+----+---------+----------------+-----------+------------+--------------------------+--------------------------+------------+-----------+-----------+-----------+------------+----------------------+-------------------------------------+--------------------------------------------------------------+----------------------+-----------------------+------------------------------------------------------------------+--------------+
| id | type_id | upline_user_id | is_active | trainer_id | upline_token             | upline_user_token        | first_name | last_name | file_name | file_size | updated_at | unread_notifications | credential_email                    | credential_password                                          | password_reset_token | password_requested_at | confirmation_token                                               | confirmed_at |
+----+---------+----------------+-----------+------------+--------------------------+--------------------------+------------+-----------+-----------+-----------+------------+----------------------+-------------------------------------+--------------------------------------------------------------+----------------------+-----------------------+------------------------------------------------------------------+--------------+

Upvotes: 0

Views: 1499

Answers (2)

maybemabe
maybemabe

Reputation: 33

You are checking if user is authenticated fully and then redirecting them to profile. There you could also check if user is active and then throw exception if not. I assume your user entity has a isActive() or getActive() getter.

    if ($this->get('security.authorization_checker')->isGranted('IS_AUTHENTICATED_FULLY')) {
        if (!$this->getUser()->isActive()) {
            throw new HttpException(403, 'Access denied.');
        } else {
            return new RedirectResponse('/profile');
        }
    }

Upvotes: 0

cretthie
cretthie

Reputation: 349

I think that the solution is that : https://symfony.com/doc/current/security/user_checkers.html

That replace : https://symfony.com/blog/new-in-symfony-4-1-deprecated-the-advanceduserinterface

Upvotes: 1

Related Questions