Password change (!13)

Reviewed-on: #13

config/routes.yaml

@@ -53,6 +53,12 @@ user_account:
     requirements:
         method: GET
 
+user_account_password_change:
+    path: /account/password
+    controller: App\Controller\AccountController::changePassword
+    requirements:
+        method: POST
+
 user_account_token_create:
     path: /profile/api/token/create
     controller: App\Controller\AccountController::addApiToken

src/Command/AddInvitesCommand.php

@@ -44,7 +44,7 @@ class AddInvitesCommand extends Command
 
         $this->em->flush();
 
-        $output->writeln(sprintf('<info>%d invites added to \'%s\'.</info>', $number, $user->getUsername()));
+        $output->writeln(sprintf('<info>%d invites added to \'%s\'.</info>', $number, $user->getUserIdentifier()));
 
         return Command::SUCCESS;
     }

src/Command/AddUserCommand.php

@@ -74,7 +74,7 @@ class AddUserCommand extends Command
 
         $this->em->flush();
 
-        $output->writeln(sprintf('<info>User \'%s\' registered, %d invites added.</info>', $user->getUsername(), $invites));
+        $output->writeln(sprintf('<info>User \'%s\' registered, %d invites added.</info>', $user->getUserIdentifier(), $invites));
 
         return Command::SUCCESS;
     }

src/Controller/AccountController.php

@@ -5,14 +5,21 @@ namespace App\Controller;
 
 use App\Entity\{ApiToken, User};
 use App\Repository\{ApiTokenRepository, InviteRepository};
+use App\Form\Data\PasswordChangeData;
+use App\Form\PasswordChangeType;
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
-use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Form\Extension\Core\Type\SubmitType;
+use Symfony\Component\Form\FormInterface;
+use Symfony\Component\HttpFoundation\{Request, Response};
+use Symfony\Component\PasswordHasher\Hasher\PasswordHasherFactoryInterface;
 
 class AccountController extends AbstractController
 {
-    public function account(InviteRepository $inviteRepo, ApiTokenRepository $apiTokenRepo): Response
-    {
+    public function account(
+        InviteRepository $inviteRepo,
+        ApiTokenRepository $apiTokenRepo
+    ): Response {
         /** @var User $user */
         if (null === $user = $this->getUser()) {
             throw $this->createAccessDeniedException('User not found exception');
@@ -26,6 +33,32 @@ class AccountController extends AbstractController
         ]);
     }
 
+    public function changePassword(
+        Request $request,
+        EntityManagerInterface $em,
+        PasswordHasherFactoryInterface $hasherFactory,
+    ): Response {
+        $data = new PasswordChangeData();
+        $form = $this->createChangePasswordForm($data);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            /** @var User $user */
+            $user = $this->getUser();
+            $hasher = $hasherFactory->getPasswordHasher($user);
+
+            $user->changePassword($hasher, $data->newPassword);
+            $em->flush();
+            $this->addFlash('success', 'Password changed.');
+
+            return $this->redirectToRoute('user_account');
+        }
+
+        return $this->renderForm('Account/password.html.twig', [
+            'form' => $form,
+        ]);
+    }
+
     public function addApiToken(EntityManagerInterface $em): Response
     {
         /** @var User|null $user */
@@ -57,4 +90,13 @@ class AccountController extends AbstractController
 
         return $this->redirectToRoute('user_account');
     }
+
+    private function createChangePasswordForm(PasswordChangeData $data): FormInterface
+    {
+        return $this
+            ->createForm(PasswordChangeType::class, $data, [
+                'action' => $this->generateUrl('user_account_password_change'),
+            ])
+            ->add('submit', SubmitType::class);
+    }
 }

src/Controller/UserController.php

@@ -5,13 +5,15 @@ namespace App\Controller;
 
 use App\Entity\{Invite, PasswordResetToken};
 use App\Repository\PasswordResetTokenRepository;
-use App\Form\{Data\PasswordResetRequestData, Data\PasswordResetData, PasswordResetRequestType, PasswordResetType, RegisterType, Data\RegisterData};
+use App\Form\Data\{PasswordResetRequestData, PasswordResetData, RegisterData};
+use App\Form\{PasswordResetRequestType, PasswordResetType, RegisterType};
 use App\Repository\InviteRepository;
 use App\User\{Exception\UserNotFoundException, InviteManager, PasswordResetManager, UserManager};
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\Form\{Extension\Core\Type\SubmitType, FormError, FormInterface};
 use Symfony\Component\HttpFoundation\{Request, Response};
+use Symfony\Component\PasswordHasher\Hasher\PasswordHasherFactoryInterface;
 
 class UserController extends AbstractController
 {
@@ -23,8 +25,8 @@ class UserController extends AbstractController
         InviteManager $inviteManager,
         InviteRepository $inviteRepo
     ): Response {
-        $formData = new RegisterData($code);
-        $form = $this->createRegisterForm($formData, $code);
+        $data = new RegisterData($code);
+        $form = $this->createRegisterForm($data, $code);
 
         /** @var Invite $invite */
         $invite = $inviteRepo->findOneBy(['code' => $code, 'usedBy' => null]);
@@ -33,9 +35,9 @@ class UserController extends AbstractController
 
         if ($form->isSubmitted() && $form->isValid()) {
             $user = $userManager->createUserByInvite(
-                $formData->username,
-                $formData->password,
-                $formData->email,
+                $data->username,
+                $data->password,
+                $data->email,
                 $invite
             );
 
@@ -54,8 +56,8 @@ class UserController extends AbstractController
 
     public function requestReset(Request $request, EntityManagerInterface $em, PasswordResetManager $manager): Response
     {
-        $formData = new PasswordResetRequestData();
-        $form = $this->createResetRequestForm($formData);
+        $data = new PasswordResetRequestData();
+        $form = $this->createResetRequestForm($data);
 
         $form->handleRequest($request);
 
@@ -63,7 +65,7 @@ class UserController extends AbstractController
 
         if ($form->isSubmitted() && $form->isValid()) {
             try {
-                $manager->sendResetLink($formData->email);
+                $manager->sendResetLink($data->email);
 
                 $message = 'Password reset link was sent';
             } catch (UserNotFoundException $e) {
@@ -84,12 +86,12 @@ class UserController extends AbstractController
         string $code,
         Request $request,
         EntityManagerInterface $em,
-        UserManager $manager,
-        PasswordResetTokenRepository $tokenRepository
+        PasswordHasherFactoryInterface $hasherFactory,
+        PasswordResetTokenRepository $tokenRepository,
     ): Response
     {
-        $formData = new PasswordResetData();
-        $form = $this->createResetForm($formData, $code);
+        $data = new PasswordResetData();
+        $form = $this->createPasswordResetForm($data, $code);
 
         /** @var PasswordResetToken $token */
         $token = $tokenRepository->find($code);
@@ -98,15 +100,17 @@ class UserController extends AbstractController
 
         if ($form->isSubmitted() && $form->isValid()) {
             if ($token && $token->isValid()) {
-                $manager->changePassword($token->getUser(), $formData->password);
+                $user = $token->getUser();
+                $hasher = $hasherFactory->getPasswordHasher($user);
+                $user->changePassword($hasher, $data->password);
 
                 $em->remove($token);
                 $em->flush();
 
                 return $this->redirectToRoute('user_auth_login');
-            } else {
-                $form->addError(new FormError('Invalid token.'));
             }
+
+            $form->addError(new FormError('Invalid token.'));
         }
 
         return $this->render('User/reset.html.twig', [
@@ -116,32 +120,28 @@ class UserController extends AbstractController
 
     private function createResetRequestForm(PasswordResetRequestData $formData): FormInterface
     {
-        $form = $this->createForm(PasswordResetRequestType::class, $formData, [
-            'action' => $this->generateUrl('user_reset_request'),
-        ]);
-        $form->add('submit', SubmitType::class);
-
-        return $form;
+        return $this
+            ->createForm(PasswordResetRequestType::class, $formData, [
+                'action' => $this->generateUrl('user_reset_request'),
+            ])
+            ->add('submit', SubmitType::class);
     }
 
-    private function createResetForm(PasswordResetData $formData, string $code): FormInterface
+    private function createPasswordResetForm(PasswordResetData $data, string $code): FormInterface
     {
-        $form = $this->createForm(PasswordResetType::class, $formData, [
-            'action' => $this->generateUrl('user_reset', ['code' => $code]),
-        ]);
-        $form->add('submit', SubmitType::class);
-
-        return $form;
+        return $this
+            ->createForm(PasswordResetType::class, $data, [
+                'action' => $this->generateUrl('user_reset', ['code' => $code]),
+            ])
+            ->add('submit', SubmitType::class);
     }
 
     private function createRegisterForm(RegisterData $formData, string $code): FormInterface
     {
-        $form = $this->createForm(RegisterType::class, $formData, [
-            'action' => $this->generateUrl('user_register', ['code' => $code]),
-        ]);
-
-        $form->add('submit', SubmitType::class);
-
-        return $form;
+        return $this
+            ->createForm(RegisterType::class, $formData, [
+                'action' => $this->generateUrl('user_register', ['code' => $code]),
+            ])
+            ->add('submit', SubmitType::class);
     }
 }

src/Form/Data/PasswordChangeData.php

@@ -0,0 +1,19 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Form\Data;
+
+use Symfony\Component\Validator\Constraints as Assert;
+use Symfony\Component\Security\Core\Validator\Constraints as SecurityAssert;
+
+class PasswordChangeData
+{
+    #[Assert\NotBlank]
+    #[SecurityAssert\UserPassword(message: 'Wrong password')]
+    public string $currentPassword;
+
+    #[Assert\NotBlank]
+    #[Assert\Length(min: 8, max: 4096)]
+    #[Assert\NotCompromisedPassword(skipOnError: true)]
+    public string $newPassword;
+}

src/Form/LoginType.php

@@ -9,7 +9,7 @@ use Symfony\Component\Form\FormBuilderInterface;
 
 class LoginType extends AbstractType
 {
-    public function buildForm(FormBuilderInterface $builder, array $options)
+    public function buildForm(FormBuilderInterface $builder, array $options): void
     {
         $builder
             ->add('_username', TextType::class, ['mapped' => false, 'required' => true])

src/Form/PasswordChangeType.php

@@ -0,0 +1,38 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Form;
+
+use App\Form\Data\PasswordChangeData;
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\{PasswordType, RepeatedType};
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+
+class PasswordChangeType extends AbstractType
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        $builder
+            ->add('currentPassword', PasswordType::class, [
+                'label' => 'Current password',
+                'invalid_message' => 'Wrong password.',
+                'required' => true,
+            ])
+            ->add('newPassword', RepeatedType::class, [
+                'type' => PasswordType::class,
+                'invalid_message' => 'The password fields must match.',
+                'required' => true,
+                'first_options'  => ['label' => 'New password'],
+                'second_options' => ['label' => 'Repeat'],
+            ])
+        ;
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+           'data_class' => PasswordChangeData::class,
+       ]);
+    }
+}

src/Form/PasswordResetRequestType.php

@@ -10,7 +10,7 @@ use Symfony\Component\OptionsResolver\OptionsResolver;
 
 class PasswordResetRequestType extends AbstractType
 {
-    public function buildForm(FormBuilderInterface $builder, array $options)
+    public function buildForm(FormBuilderInterface $builder, array $options): void
     {
         $builder
             ->add('email', EmailType::class, ['required' => true])
@@ -18,7 +18,7 @@ class PasswordResetRequestType extends AbstractType
         ;
     }
 
-    public function configureOptions(OptionsResolver $resolver)
+    public function configureOptions(OptionsResolver $resolver): void
     {
         $resolver->setDefaults([
             'data_class' => PasswordResetRequestData::class,

src/Form/PasswordResetType.php

@@ -11,7 +11,7 @@ use Symfony\Component\OptionsResolver\OptionsResolver;
 
 class PasswordResetType extends AbstractType
 {
-    public function buildForm(FormBuilderInterface $builder, array $options)
+    public function buildForm(FormBuilderInterface $builder, array $options): void
     {
         $builder
             ->add('password', RepeatedType::class, [
@@ -24,7 +24,7 @@ class PasswordResetType extends AbstractType
         ;
     }
 
-    public function configureOptions(OptionsResolver $resolver)
+    public function configureOptions(OptionsResolver $resolver): void
     {
         $resolver->setDefaults([
            'data_class' => PasswordResetData::class,

src/Form/RegisterType.php

@@ -11,7 +11,7 @@ use Symfony\Component\OptionsResolver\OptionsResolver;
 
 class RegisterType extends AbstractType
 {
-    public function buildForm(FormBuilderInterface $builder, array $options)
+    public function buildForm(FormBuilderInterface $builder, array $options): void
     {
         $builder
             ->add('username', TextType::class, ['required' => true])
@@ -21,7 +21,7 @@ class RegisterType extends AbstractType
         ;
     }
 
-    public function configureOptions(OptionsResolver $resolver)
+    public function configureOptions(OptionsResolver $resolver): void
     {
         $resolver->setDefaults([
            'data_class' => RegisterData::class,

src/User/UserManager.php

@@ -34,11 +34,6 @@ class UserManager
         return $user;
     }
 
-    public function changePassword(User $user, string $rawPassword): void
-    {
-        $user->changePassword($this->hasherFactory->getPasswordHasher(User::class), $rawPassword);
-    }
-
     public function createUserByInvite(string $username, string $password, string $email, Invite $invite, array $roles = self::DEFAULT_ROLES): User
     {
         if (null !== $invite->getUsedBy()) {

templates/Account/password.html.twig

@@ -0,0 +1,5 @@
+{% extends 'base.html.twig' %}
+
+{% block content %}
+{{ form(form) }}
+{% endblock %}

templates/Account/profile.html.twig

@@ -10,7 +10,7 @@
     <tbody>
     <tr>
         <th scope="row">Username</th>
-        <td>{{ user.username }}</td>
+        <td>{{ user.userIdentifier }}</td>
         <td></td>
     </tr>
     <tr>
@@ -20,5 +20,12 @@
             <button type="button" class="btn disabled" title="Not implemented">Change</button>
         </td>
     </tr>
+    <tr>
+        <th scope="row">Password</th>
+        <td>********</td>
+        <td>
+            <a role="button" class="btn btn-primary" href="{{ path('user_account_password_change') }}">Change</a>
+        </td>
+    </tr>
     </tbody>
 </table>