From 62e04b2fcc604ba89b4dbc37a7fc8fcc5d218c12 Mon Sep 17 00:00:00 2001
From: Konrad Oboza <konrad.oboza@ibexa.co>
Date: Mon, 1 Jul 2024 13:05:54 +0200
Subject: [PATCH] IBX-8356: Removed
 `Ibexa\Core\MVC\Symfony\Security\Authentication\AuthenticatorInterface` to be
 replaced with Symfony-based authentication

https://github.com/ibexa/core/pull/375
---
 .../Compiler/SecurityPass.php                 |  4 -
 src/bundle/Core/Resources/config/security.yml |  4 +
 .../Authentication/AuthenticatorInterface.php | 45 ----------
 .../DefaultAuthenticationSuccessHandler.php   | 21 -----
 ...onTokenCreatedRepositoryUserSubscriber.php | 39 +++++++++
 ...kenCreatedRepositoryUserSubscriberTest.php | 85 +++++++++++++++++++
 6 files changed, 128 insertions(+), 70 deletions(-)
 delete mode 100644 src/lib/MVC/Symfony/Security/Authentication/AuthenticatorInterface.php
 create mode 100644 src/lib/MVC/Symfony/Security/Authentication/EventSubscriber/OnAuthenticationTokenCreatedRepositoryUserSubscriber.php
 create mode 100644 tests/lib/MVC/Symfony/Security/Authentication/EventSubscriber/OnAuthenticationTokenCreatedRepositoryUserSubscriberTest.php

diff --git a/src/bundle/Core/DependencyInjection/Compiler/SecurityPass.php b/src/bundle/Core/DependencyInjection/Compiler/SecurityPass.php
index ffcbc8774c..d9520db0cd 100644
--- a/src/bundle/Core/DependencyInjection/Compiler/SecurityPass.php
+++ b/src/bundle/Core/DependencyInjection/Compiler/SecurityPass.php
@@ -78,9 +78,5 @@ public function process(ContainerBuilder $container): void
             'setEventDispatcher',
             [new Reference('event_dispatcher')]
         );
-        $successHandlerDef->addMethodCall(
-            'setPermissionResolver',
-            [$permissionResolverRef]
-        );
     }
 }
diff --git a/src/bundle/Core/Resources/config/security.yml b/src/bundle/Core/Resources/config/security.yml
index 5ca47846d9..fb74525faf 100644
--- a/src/bundle/Core/Resources/config/security.yml
+++ b/src/bundle/Core/Resources/config/security.yml
@@ -47,3 +47,7 @@ services:
     Ibexa\Core\MVC\Symfony\Security\Authentication\EventSubscriber\AccessDeniedSubscriber:
         autowire: true
         autoconfigure: true
+
+    Ibexa\Core\MVC\Symfony\Security\Authentication\EventSubscriber\OnAuthenticationTokenCreatedRepositoryUserSubscriber:
+        autowire: true
+        autoconfigure: true
diff --git a/src/lib/MVC/Symfony/Security/Authentication/AuthenticatorInterface.php b/src/lib/MVC/Symfony/Security/Authentication/AuthenticatorInterface.php
deleted file mode 100644
index 37f4a1c20e..0000000000
--- a/src/lib/MVC/Symfony/Security/Authentication/AuthenticatorInterface.php
+++ /dev/null
@@ -1,45 +0,0 @@
-<?php
-
-/**
- * @copyright Copyright (C) Ibexa AS. All rights reserved.
- * @license For full copyright and license information view LICENSE file distributed with this source code.
- */
-
-namespace Ibexa\Core\MVC\Symfony\Security\Authentication;
-
-use Symfony\Component\HttpFoundation\Request;
-
-/**
- * This interface is to be implemented by authenticator classes.
- * Authenticators are meant to be used to run authentication programmatically, i.e. outside the firewall context.
- *
- * @deprecated 4.6.7 this class is deprecated. Symfony Security has received major changes in 5.3, therefore Ibexa DXP relies on authenticator system from now on. Will be removed in 5.0.
- */
-interface AuthenticatorInterface
-{
-    /**
-     * Runs authentication against provided request and returns the authenticated security token.
-     *
-     * This method typically does:
-     *  - The authentication by itself (i.e. matching a user)
-     *  - User type checks (e.g. check user activation)
-     *  - Inject authenticated token in the SecurityContext
-     *  - (optional) Trigger SecurityEvents::INTERACTIVE_LOGIN event
-     *
-     * @param \Symfony\Component\HttpFoundation\Request $request
-     *
-     * @return \Symfony\Component\Security\Core\Authentication\Token\TokenInterface
-     *
-     * @throws \Symfony\Component\Security\Core\Exception\AuthenticationException If any authentication issue occured.
-     */
-    public function authenticate(Request $request);
-
-    /**
-     * Performs logout by running configured logout handlers.
-     *
-     * @param \Symfony\Component\HttpFoundation\Request $request
-     *
-     * @return \Symfony\Component\HttpFoundation\Response
-     */
-    public function logout(Request $request);
-}
diff --git a/src/lib/MVC/Symfony/Security/Authentication/DefaultAuthenticationSuccessHandler.php b/src/lib/MVC/Symfony/Security/Authentication/DefaultAuthenticationSuccessHandler.php
index 5b45e65228..cd710684d7 100644
--- a/src/lib/MVC/Symfony/Security/Authentication/DefaultAuthenticationSuccessHandler.php
+++ b/src/lib/MVC/Symfony/Security/Authentication/DefaultAuthenticationSuccessHandler.php
@@ -8,13 +8,9 @@
 
 namespace Ibexa\Core\MVC\Symfony\Security\Authentication;
 
-use Ibexa\Contracts\Core\Repository\PermissionResolver;
 use Ibexa\Contracts\Core\SiteAccess\ConfigResolverInterface;
-use Ibexa\Core\MVC\Symfony\Security\UserInterface;
 use Psr\EventDispatcher\EventDispatcherInterface;
 use Symfony\Component\HttpFoundation\Request;
-use Symfony\Component\HttpFoundation\Response;
-use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Http\Authentication\DefaultAuthenticationSuccessHandler as BaseSuccessHandler;
 
 final class DefaultAuthenticationSuccessHandler extends BaseSuccessHandler
@@ -23,8 +19,6 @@ final class DefaultAuthenticationSuccessHandler extends BaseSuccessHandler
 
     private ConfigResolverInterface $configResolver;
 
-    private PermissionResolver $permissionResolver;
-
     public function setConfigResolver(ConfigResolverInterface $configResolver): void
     {
         $this->configResolver = $configResolver;
@@ -35,21 +29,6 @@ public function setEventDispatcher(EventDispatcherInterface $eventDispatcher): v
         $this->eventDispatcher = $eventDispatcher;
     }
 
-    public function setPermissionResolver(PermissionResolver $permissionResolver): void
-    {
-        $this->permissionResolver = $permissionResolver;
-    }
-
-    public function onAuthenticationSuccess(Request $request, TokenInterface $token): ?Response
-    {
-        $user = $token->getUser();
-        if ($user instanceof UserInterface && isset($this->permissionResolver)) {
-            $this->permissionResolver->setCurrentUserReference($user->getAPIUser());
-        }
-
-        return parent::onAuthenticationSuccess($request, $token);
-    }
-
     protected function determineTargetUrl(Request $request): string
     {
         if (isset($this->configResolver)) {
diff --git a/src/lib/MVC/Symfony/Security/Authentication/EventSubscriber/OnAuthenticationTokenCreatedRepositoryUserSubscriber.php b/src/lib/MVC/Symfony/Security/Authentication/EventSubscriber/OnAuthenticationTokenCreatedRepositoryUserSubscriber.php
new file mode 100644
index 0000000000..59e6b4b1b0
--- /dev/null
+++ b/src/lib/MVC/Symfony/Security/Authentication/EventSubscriber/OnAuthenticationTokenCreatedRepositoryUserSubscriber.php
@@ -0,0 +1,39 @@
+<?php
+
+/**
+ * @copyright Copyright (C) Ibexa AS. All rights reserved.
+ * @license For full copyright and license information view LICENSE file distributed with this source code.
+ */
+declare(strict_types=1);
+
+namespace Ibexa\Core\MVC\Symfony\Security\Authentication\EventSubscriber;
+
+use Ibexa\Contracts\Core\Repository\PermissionResolver;
+use Ibexa\Core\MVC\Symfony\Security\UserInterface as IbexaUser;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\Security\Http\Event\AuthenticationTokenCreatedEvent;
+
+final readonly class OnAuthenticationTokenCreatedRepositoryUserSubscriber implements EventSubscriberInterface
+{
+    public function __construct(
+        private PermissionResolver $permissionResolver,
+    ) {
+    }
+
+    public static function getSubscribedEvents(): array
+    {
+        return [
+            AuthenticationTokenCreatedEvent::class => ['onAuthenticationTokenCreated', 10],
+        ];
+    }
+
+    public function onAuthenticationTokenCreated(AuthenticationTokenCreatedEvent $event): void
+    {
+        $user = $event->getAuthenticatedToken()->getUser();
+        if (!$user instanceof IbexaUser) {
+            return;
+        }
+
+        $this->permissionResolver->setCurrentUserReference($user->getAPIUser());
+    }
+}
diff --git a/tests/lib/MVC/Symfony/Security/Authentication/EventSubscriber/OnAuthenticationTokenCreatedRepositoryUserSubscriberTest.php b/tests/lib/MVC/Symfony/Security/Authentication/EventSubscriber/OnAuthenticationTokenCreatedRepositoryUserSubscriberTest.php
new file mode 100644
index 0000000000..29c3d68685
--- /dev/null
+++ b/tests/lib/MVC/Symfony/Security/Authentication/EventSubscriber/OnAuthenticationTokenCreatedRepositoryUserSubscriberTest.php
@@ -0,0 +1,85 @@
+<?php
+
+/**
+ * @copyright Copyright (C) Ibexa AS. All rights reserved.
+ * @license For full copyright and license information view LICENSE file distributed with this source code.
+ */
+declare(strict_types=1);
+
+namespace Ibexa\Tests\Core\MVC\Symfony\Security\Authentication\EventSubscriber;
+
+use Ibexa\Contracts\Core\Repository\PermissionResolver;
+use Ibexa\Core\MVC\Symfony\Security\Authentication\EventSubscriber\OnAuthenticationTokenCreatedRepositoryUserSubscriber;
+use Ibexa\Core\MVC\Symfony\Security\User;
+use Ibexa\Core\Repository\Values\User\User as ApiUser;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
+use Symfony\Component\Security\Core\User\InMemoryUser;
+use Symfony\Component\Security\Core\User\UserInterface;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
+use Symfony\Component\Security\Http\Authenticator\Passport\Credentials\PasswordCredentials;
+use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
+use Symfony\Component\Security\Http\Event\AuthenticationTokenCreatedEvent;
+
+final class OnAuthenticationTokenCreatedRepositoryUserSubscriberTest extends TestCase
+{
+    public function testGetSubscribedEvents(): void
+    {
+        $subscriber = new OnAuthenticationTokenCreatedRepositoryUserSubscriber(
+            $this->createMock(PermissionResolver::class)
+        );
+
+        self::assertEquals(
+            [
+                AuthenticationTokenCreatedEvent::class => ['onAuthenticationTokenCreated', 10],
+            ],
+            $subscriber->getSubscribedEvents()
+        );
+    }
+
+    /**
+     * @dataProvider dataProviderForTestSettingCurrentUserReference
+     */
+    public function testSettingCurrentUserReference(
+        UserInterface $user,
+        bool $isPermissionResolverInvoked
+    ): void {
+        $permissionResolver = $this->createMock(PermissionResolver::class);
+        $permissionResolver
+            ->expects($isPermissionResolverInvoked === true ? self::once() : self::never())
+            ->method('setCurrentUserReference');
+
+        $subscriber = new OnAuthenticationTokenCreatedRepositoryUserSubscriber($permissionResolver);
+
+        $subscriber->onAuthenticationTokenCreated(
+            $this->getAuthenticationTokenCreatedEvent($user)
+        );
+    }
+
+    /**
+     * @return iterable<string, array{\Symfony\Component\Security\Core\User\UserInterface, bool}>
+     */
+    public function dataProviderForTestSettingCurrentUserReference(): iterable
+    {
+        yield 'authorizing Ibexa user' => [
+            new User($this->createMock(ApiUser::class)),
+            true,
+        ];
+
+        yield 'authorizing non-Ibexa user' => [
+            new InMemoryUser('foo', 'bar'),
+            false,
+        ];
+    }
+
+    private function getAuthenticationTokenCreatedEvent(UserInterface $user): AuthenticationTokenCreatedEvent
+    {
+        return new AuthenticationTokenCreatedEvent(
+            new UsernamePasswordToken($user, 'test_firewall'),
+            new Passport(
+                new UserBadge('foo'),
+                new PasswordCredentials('bar')
+            )
+        );
+    }
+}