src/App/Security/TwoFactor/TwoFactorAuthSubscriber.php line 50

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace App\Security\TwoFactor;
  5. use App\Security\TwoFactor\AllowedDevice\AllowedDeviceAuthenticator;
  6. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  7. use Symfony\Component\HttpFoundation\RedirectResponse;
  8. use Symfony\Component\HttpKernel\Event\RequestEvent;
  9. use Symfony\Component\HttpKernel\HttpKernelInterface;
  10. use Symfony\Component\Routing\RouterInterface;
  11. use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
  13. class TwoFactorAuthSubscriber implements EventSubscriberInterface
  14. {
  16.     private bool $twoFactorEnabled;
  18.     private TokenStorageInterface $tokenStorage;
  20.     private TwoFactorManager $twoFactorManager;
  22.     private RouterInterface $router;
  24.     private AllowedDeviceAuthenticator $rememberedDeviceAuthenticator;
  26.     private const ROUTES = [
  27.         'two_factor_setup',
  28.         'two_factor_verify',
  29.         'two_factor_notice',
  30.         'backend_two_factor_setup',
  31.         'backend_two_factor_verify',
  32.         'backend_two_factor_notice',
  33.     ];
  35.     public function __construct(
  36.         TokenStorageInterface $tokenStorage,
  37.         TwoFactorManager $twoFactorManager,
  38.         RouterInterface $router,
  39.         AllowedDeviceAuthenticator $rememberedDeviceAuthenticator,
  40.         bool $twoFactorEnabled
  41.     )
  42.     {
  43.         $this->tokenStorage = $tokenStorage;
  44.         $this->twoFactorManager = $twoFactorManager;
  45.         $this->router = $router;
  46.         $this->rememberedDeviceAuthenticator = $rememberedDeviceAuthenticator;
  47.         $this->twoFactorEnabled = $twoFactorEnabled;
  48.     }
  50.     public function onKernelRequest(RequestEvent $event): void
  51.     {
  52.         if ($event->getRequestType() !== HttpKernelInterface::MAIN_REQUEST) {
  53.             return;
  54.         }
  56.         /*
  57.          * Bypass listener when:
  58.          * - user is not logged in or capable of two factor auth.
  59.          * - requesting any of the two factor routes.
  60.          * - satellite has disabled two factor auth.
  61.          * - user is using remembered device
  62.          */
  63.         if (!$this->twoFactorEnabled) {
  64.             return;
  65.         }
  67.         $token = $this->tokenStorage->getToken();
  68.         /** @var TwoFactorUserInterface|null $user */
  69.         $user = (null !== $token && $token->getUser() instanceof TwoFactorUserInterface) ? $token->getUser() : null;
  71.         if (null === $user) {
  72.             return;
  73.         }
  75.         $route = $event->getRequest()->attributes->get('_route');
  77.         if (in_array($route, self::ROUTES, true)) {
  78.             return;
  79.         }
  81.         if ($this->rememberedDeviceAuthenticator->authenticate($event->getRequest())) {
  82.             return;
  83.         }
  85.         /*
  86.          * If user is not authenticated, redirect him based on configuration...
  87.          */
  88.         if ($this->twoFactorManager->isAuthenticated($user, $event->getRequest())) {
  89.             return;
  90.         }
  92.         if ($user->isTwoFactorVerified()) {
  93.             /*
  94.              * This means user is fully capable of authenticating via two factor auth...
  95.              */
  96.             $event->setResponse(new RedirectResponse(
  97.                 $this->router->generate('two_factor_verify', ['continue' => $event->getRequest()->getRequestUri()])
  98.             ));
  99.         } else {
  100.             /*
  101.              * This means satellite requires users to set up 2fa...
  102.              * Redirect to notice page which prompts user to set up 2fa...
  103.              */
  104.             $event->setResponse(new RedirectResponse(
  105.                 $this->router->generate('two_factor_notice', ['continue' => $event->getRequest()->getRequestUri()])
  106.             ));
  107.         }
  109.         /*
  110.          * Do nothing and allow user trough if satellite does not require 2fa.
  111.          */
  112.     }
  114.     /**
  115.      * @return array<string, array<int|string, array<int|string, int|string>|int|string>|string>
  116.      */
  117.     public static function getSubscribedEvents(): array
  118.     {
  119.         return [
  120.             RequestEvent::class => 'onKernelRequest',
  121.         ];
  122.     }
  124. }