Apprendre Symfony 6 : Créer un espace membre

composer require symfony/security-bundle

security:
	enable_authenticator_manager: true
	# https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
	password_hashers:
		Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
	# https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
	providers:
		users_in_memory: { memory: null }
	firewalls:
		dev:
			pattern: ^/(_(profiler|wdt)|css|images|js)/
			security: false
		main:
			lazy: true
			provider: users_in_memory

			# activate different ways to authenticate
			# https://symfony.com/doc/current/security.html#firewalls-authentication

			# https://symfony.com/doc/current/security/impersonating_user.html
			# switch_user: true

	# Easy way to control access for large sections of your site
	# Note: Only the *first* access control that matches will be used
	access_control:
		# - { path: ^/admin, roles: ROLE_ADMIN }
		# - { path: ^/profile, roles: ROLE_USER }

symfony console make:user

The name of the security user class (e.g. User) [User]:
> User

Do you want to store user data in the database (via Doctrine)? (yes/no) [yes]:
> yes

Enter a property name that will be the unique "display" name for the user (e.g. email, username, uuid) [email]:
> email

Does this app need to hash/check user passwords? (yes/no) [yes]:
> yes

namespace App\Entity;

use App\Repository\UserRepository;
use Doctrine\ORM\Mapping as ORM;
use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
use Symfony\Component\Security\Core\User\UserInterface;

/**
 * @ORM\Entity(repositoryClass=UserRepository::class)
 */
class User implements UserInterface, PasswordAuthenticatedUserInterface
{
	/**
	 * @ORM\Id
	 * @ORM\GeneratedValue
	 * @ORM\Column(type="integer")
	 */
	private $id;

	/**
	 * @ORM\Column(type="string", length=180, unique=true)
	 */
	private $email;

	/**
	 * @ORM\Column(type="json")
	 */
	private $roles = [];

	/**
	 * @var string The hashed password
	 * @ORM\Column(type="string")
	 */
	private $password;

	public function getId(): ?int
	{
		return $this->id;
	}

	public function getEmail(): ?string
	{
		return $this->email;
	}

	public function setEmail(string $email): self
	{
		$this->email = $email;

		return $this;
	}

	/**
	 * The public representation of the user (e.g. a username, an email address, etc.)
	 *
	 * @see UserInterface
	 */
	public function getUserIdentifier(): string
	{
		return (string) $this->email;
	}

	/**
	 * @deprecated since Symfony 5.3
	 */
	public function getUsername(): string
	{
		return (string) $this->email;
	}

	/**
	 * @see UserInterface
	 */
	public function getRoles(): array
	{
		$roles = $this->roles;
		// guarantee every user at least has ROLE_USER
		$roles[] = 'ROLE_USER';

		return array_unique($roles);
	}

	public function setRoles(array $roles): self
	{
		$this->roles = $roles;

		return $this;
	}

	/**
	 * @see PasswordAuthenticatedUserInterface
	 */
	public function getPassword(): string
	{
		return $this->password;
	}

	public function setPassword(string $password): self
	{
		$this->password = $password;

		return $this;
	}

	/**
	 * Returning a salt is only needed if you are not using a modern
	 * hashing algorithm (e.g. bcrypt or sodium) in your security.yaml.
	 *
	 * @see UserInterface
	 */
	public function getSalt(): ?string
	{
		return null;
	}

	/**
	 * @see UserInterface
	 */
	public function eraseCredentials()
	{
		// If you store any temporary, sensitive data on the user, clear it here
		// $this->plainPassword = null;
	}
}

security:
	# ...

	providers:
		app_user_provider:
			entity:
				class: App\Entity\User
				property: email

security:
	# ...

	firewalls:
		# ...
		main:
			lazy: true
			provider: app_user_provider

symfony console make:migration

symfony console doctrine:migrations:migrate

symfony console make:registration-form

[0 ] _preview_error
[1 ] _wdt
[2 ] _profiler_home
[3 ] _profiler_search
[4 ] _profiler_search_bar
[5 ] _profiler_phpinfo
[6 ] _profiler_xdebug
[7 ] _profiler_search_results
[8 ] _profiler_open_file
[9 ] _profiler
[10] _profiler_router
[11] _profiler_exception
[12] _profiler_exception_css
[13] app_demo <-- route perso

<?php

namespace App\Controller;

use App\Entity\User;
use App\Form\RegistrationFormType;
use Doctrine\ORM\EntityManagerInterface;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
use Symfony\Component\Routing\Annotation\Route;
use Symfony\Contracts\Translation\TranslatorInterface;

class RegistrationController extends AbstractController
{
	#[Route('/register', name:'app_register')]
	public function register(Request $request, UserPasswordHasherInterface $userPasswordHasher, EntityManagerInterface $entityManager): Response
	{
		$user = new User();
		$form = $this->createForm(RegistrationFormType::class, $user);
		$form->handleRequest($request);

		if ($form->isSubmitted() && $form->isValid()) {
			// encode the plain password
			$user->setPassword(
				$userPasswordHasher->hashPassword(
					$user,
					$form->get('plainPassword')->getData()
				)
			);

			$entityManager->persist($user);
			$entityManager->flush();
			// do anything else you need here, like send an email

			return $this->redirectToRoute('ma_route');
		}

		return $this->render('registration/register.html.twig', [
			'registrationForm' => $form->createView(),
		]);
	}
}

<?php

namespace App\Form;

use App\Entity\User;
use Symfony\Component\Form\AbstractType;
use Symfony\Component\Form\Extension\Core\Type\CheckboxType;
use Symfony\Component\Form\Extension\Core\Type\PasswordType;
use Symfony\Component\Form\FormBuilderInterface;
use Symfony\Component\OptionsResolver\OptionsResolver;
use Symfony\Component\Validator\Constraints\IsTrue;
use Symfony\Component\Validator\Constraints\Length;
use Symfony\Component\Validator\Constraints\NotBlank;

class RegistrationFormType extends AbstractType
{
	public function buildForm(FormBuilderInterface $builder, array $options): void
	{
		$builder
			->add('email')
			->add('agreeTerms', CheckboxType::class, [
				'mapped' => false,
				'constraints' => [
					new IsTrue([
						'message' => 'You should agree to our terms.',
					]),
				],
			])
			->add('plainPassword', PasswordType::class, [
				// instead of being set onto the object directly,
				// this is read and encoded in the controller
				'mapped' => false,
				'attr' => ['autocomplete' => 'new-password'],
				'constraints' => [
					new NotBlank([
						'message' => 'Please enter a password',
					]),
					new Length([
						'min' => 6,
						'minMessage' => 'Your password should be at least {{ limit }} characters',
						// max length allowed by Symfony for security reasons
						'max' => 4096,
					]),
				],
			])
		;
	}

	public function configureOptions(OptionsResolver $resolver): void
	{
		$resolver->setDefaults([
			'data_class' => User::class,
		]);
	}
}

{% extends 'base.html.twig' %}

{% block title %}Register{% endblock %}

{% block body %}
	<h1>Register</h1>

	{{ form_start(registrationForm) }}
		{{ form_row(registrationForm.email) }}
		{{ form_row(registrationForm.plainPassword, {
				label: 'Password'
		}) }}
		{{ form_row(registrationForm.agreeTerms) }}

		<button type="submit" class="btn">Register</button>
	{{ form_end(registrationForm) }}
{% endblock %}

security:
	# ...
	password_hashers:
		# Use native password hasher, which auto-selects and migrates the best
		# possible hashing algorithm (starting from Symfony 5.3 this is "bcrypt")
		Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'

symfony console make:controller Security

use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;

#[Route('/login', name: 'app_login')]
public function login(AuthenticationUtils $authenticationUtils): Response {
	// get the login error if there is one
	$error = $authenticationUtils->getLastAuthenticationError();

	// last username entered by the user
	$lastUsername = $authenticationUtils->getLastUsername();

	return $this->render('security/login.html.twig', [
		'last_username' => $lastUsername,
		'error'         => $error,
	]);
}

{% extends 'base.html.twig' %}

{# ... #}

{% block body %}
	{% if error %}
		<div>{{ error.messageKey|trans(error.messageData, 'security') }}</div>
	{% endif %}

	<form action="{{ path('app_login') }}" method="post">
		<label for="username">Email:</label>
		<input type="text" id="username" name="_username" value="{{ last_username }}"/>

		<label for="password">Password:</label>
		<input type="password" id="password" name="_password"/>

		{# If you want to control the URL the user is redirected to on success
		<input type="hidden" name="_target_path" value="/account"/> #}

		<button type="submit">login</button>
	</form>
{% endblock %}

security:
	# ...

	firewalls:
		secured_area:
			# ...
			form_login:
				# ...
				enable_csrf: true

<form action="{{ path('app_login') }}" method="post">
	...

	<input type="hidden" name="_csrf_token" value="{{ csrf_token('authenticate') }}">

	<button type="submit">login</button>
</form>

security:
	# ...
	firewalls:
		dev:
			pattern: ^/(_(profiler|wdt)|css|images|js)/
			security: false
		main:
			lazy: true
			provider: app_user_provider

security:
	# ...

	firewalls:
		main:
			# ...
			form_login:
				# "app_login" is the name of the route created previously
				login_path: app_login
				check_path: app_login

#[Route('/logout', name: 'app_logout', methods: ['GET'])]
public function logout(): never {}

security:
	# ...

	firewalls:
		main:
			# ...
			logout:
				path: app_logout

				# where to redirect after logout
				# target: app_any_route

class User {

	/**
	 * @ORM\Column(type="json")
	 */
	private $roles = [];

	// ...
	public function getRoles(): array {
		$roles = $this->roles;
		// guarantee every user at least has ROLE_USER
		$roles[] = 'ROLE_USER';

		return array_unique($roles);
	}
}

security:
	# ...

	role_hierarchy:
		ROLE_AUTHOR: ROLE_USER
		ROLE_ADMIN: [ROLE_AUTHOR, ROLE_ALLOWED_TO_SWITCH]

security:
	# ...
	
	firewalls:
		# ...
		
		access_control:
		
			# Les admin peuvent accéder à /admin*
			- { path: '^/admin', roles: ROLE_ADMIN }
			
			# Les admin et auteurs peuvent accéder à /admin/formation* et /admin/category*
			- { path: '^/admin/(formation|category)', roles: ROLE_AUTHOR }
			
			# Les utilisateurs authentifiés peuvent accéder à /formations*
			- { path: '^/formations', roles: ROLE_USER }
			
			# Les utilisateurs authentifiés peuvent accéder aux URLs de la forme /api/formations/7298 et /api/category/528491
			- { path: '^/api/(formations|category)/\d+$', roles: ROLE_USER }

{% if is_granted('ROLE_AUTHOR') %}
	<a href="#">Editer</a>
	<a href="#">Supprimer</a>
{% endif %}