Refactor authentication system (#2602)

Make auth configuration available via UI, remove FOSUserBundle and SAML-Bundle dependency

src/Command/AbstractResetCommand.php

@@ -48,8 +48,9 @@ abstract class AbstractResetCommand extends Command
     protected function configure()
     {
         $this
-            ->setName('kimai:reset-' . $this->getEnvName())
-            ->setDescription('Resets the dev environment')
+            ->setName('kimai:reset:' . $this->getEnvName())
+            ->setAliases(['kimai:reset-' . $this->getEnvName()])
+            ->setDescription('Resets the "' . $this->getEnvName() . '" environment')
             ->setHelp(
                 <<<EOT
     This command will drop and re-create the database and its schemas, load data and clear the cache.

src/Command/AbstractRoleCommand.php

@@ -0,0 +1,69 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Command;
+
+use App\Entity\User;
+use App\User\UserService;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+abstract class AbstractRoleCommand extends Command
+{
+    private $userService;
+
+    public function __construct(UserService $userService)
+    {
+        parent::__construct();
+        $this->userService = $userService;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function configure()
+    {
+        $this
+            ->setDefinition([
+                new InputArgument('username', InputArgument::REQUIRED, 'The username'),
+                new InputArgument('role', InputArgument::OPTIONAL, 'The role'),
+                new InputOption('super', null, InputOption::VALUE_NONE, 'Instead specifying role, use this to quickly add the super administrator role'),
+            ]);
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function execute(InputInterface $input, OutputInterface $output)
+    {
+        $username = $input->getArgument('username');
+        $role = $input->getArgument('role');
+        $super = (true === $input->getOption('super'));
+
+        if (null !== $role && $super) {
+            throw new \InvalidArgumentException('You can pass either the role or the --super option (but not both simultaneously).');
+        }
+
+        if (null === $role && !$super) {
+            throw new \RuntimeException('Not enough arguments, pass a role or use --super.');
+        }
+
+        $user = $this->userService->findUserByUsernameOrThrowException($username);
+
+        $this->executeRoleCommand($this->userService, new SymfonyStyle($input, $output), $user, $super, $role);
+
+        return 0;
+    }
+
+    abstract protected function executeRoleCommand(UserService $manipulator, SymfonyStyle $output, User $user, bool $super, $role);
+}

src/Command/ActivateUserCommand.php

@@ -0,0 +1,70 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Command;
+
+use App\User\UserService;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+class ActivateUserCommand extends Command
+{
+    private $userService;
+
+    public function __construct(UserService $userService)
+    {
+        parent::__construct();
+        $this->userService = $userService;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function configure()
+    {
+        $this
+            ->setName('kimai:user:activate')
+            ->setAliases(['fos:user:activate'])
+            ->setDescription('Activate a user')
+            ->setDefinition([
+                new InputArgument('username', InputArgument::REQUIRED, 'The username'),
+            ])
+            ->setHelp(
+                <<<'EOT'
+The <info>kimai:user:activate</info> command activates a user (so they will be able to log in):
+
+  <info>php %command.full_name% susan_super</info>
+EOT
+            );
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function execute(InputInterface $input, OutputInterface $output)
+    {
+        $username = $input->getArgument('username');
+        $user = $this->userService->findUserByUsernameOrThrowException($username);
+
+        $io = new SymfonyStyle($input, $output);
+
+        if (!$user->isEnabled()) {
+            $user->setEnabled(true);
+            $this->userService->updateUser($user);
+            $io->success(sprintf('User "%s" has been activated.', $username));
+        } else {
+            $io->warning(sprintf('User "%s" is already active.', $username));
+        }
+
+        return 0;
+    }
+}

src/Command/ChangePasswordCommand.php

@@ -0,0 +1,80 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Command;
+
+use App\User\UserService;
+use App\Utils\CommandStyle;
+use App\Validator\ValidationFailedException;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class ChangePasswordCommand extends Command
+{
+    private $userService;
+
+    public function __construct(UserService $userService)
+    {
+        parent::__construct();
+        $this->userService = $userService;
+    }
+
+    protected function configure()
+    {
+        $this
+            ->setName('kimai:user:password')
+            ->setAliases(['fos:user:change-password'])
+            ->setDescription('Change the password of a user.')
+            ->setDefinition([
+                new InputArgument('username', InputArgument::REQUIRED, 'The username'),
+                new InputArgument('password', InputArgument::REQUIRED, 'The password'),
+            ])
+            ->setHelp(
+                <<<'EOT'
+The <info>kimai:user:password</info> command changes the password of a user:
+
+  <info>php %command.full_name% matthieu</info>
+
+This interactive shell will first ask you for a password.
+
+You can alternatively specify the password as a second argument:
+
+  <info>php %command.full_name% susan_super newpassword</info>
+
+EOT
+            );
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function execute(InputInterface $input, OutputInterface $output)
+    {
+        $username = $input->getArgument('username');
+        $password = $input->getArgument('password');
+
+        $user = $this->userService->findUserByUsernameOrThrowException($username);
+
+        $io = new CommandStyle($input, $output);
+
+        try {
+            $user->setPlainPassword($password);
+            $this->userService->updateUser($user, ['PasswordUpdate']);
+            $io->success(sprintf('Changed password for user "%s".', $username));
+        } catch (ValidationFailedException $ex) {
+            $io->validationError($ex);
+
+            return 2;
+        }
+
+        return 0;
+    }
+}

src/Command/CreateUserCommand.php

@@ -10,39 +10,24 @@
 namespace App\Command;
 
 use App\Entity\User;
-use Doctrine\Persistence\ManagerRegistry;
+use App\User\UserService;
+use App\Utils\CommandStyle;
+use App\Validator\ValidationFailedException;
 use Symfony\Component\Console\Command\Command;
 use Symfony\Component\Console\Helper\QuestionHelper;
 use Symfony\Component\Console\Input\InputArgument;
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Output\OutputInterface;
 use Symfony\Component\Console\Question\Question;
-use Symfony\Component\Console\Style\SymfonyStyle;
-use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface;
-use Symfony\Component\Validator\Validator\ValidatorInterface;
 
 final class CreateUserCommand extends Command
 {
-    /**
-     * @var UserPasswordEncoderInterface
-     */
-    private $encoder;
-    /**
-     * @var ManagerRegistry
-     */
-    private $doctrine;
-    /**
-     * @var ValidatorInterface
-     */
-    private $validator;
+    private $userService;
 
-    public function __construct(UserPasswordEncoderInterface $encoder, ManagerRegistry $registry, ValidatorInterface $validator)
+    public function __construct(UserService $userService)
     {
-        $this->encoder = $encoder;
-        $this->doctrine = $registry;
-        $this->validator = $validator;
-
         parent::__construct();
+        $this->userService = $userService;
     }
 
     /**
@@ -53,7 +38,8 @@ final class CreateUserCommand extends Command
         $roles = implode(',', [User::DEFAULT_ROLE, User::ROLE_ADMIN]);
 
         $this
-            ->setName('kimai:create-user')
+            ->setName('kimai:user:create')
+            ->setAliases(['kimai:create-user'])
             ->setDescription('Create a new user')
             ->setHelp('This command allows you to create a new user.')
             ->addArgument('username', InputArgument::REQUIRED, 'A name for the new user (must be unique)')
@@ -73,7 +59,7 @@ final class CreateUserCommand extends Command
      */
     protected function execute(InputInterface $input, OutputInterface $output)
     {
-        $io = new SymfonyStyle($input, $output);
+        $io = new CommandStyle($input, $output);
 
         $username = $input->getArgument('username');
         $email = $input->getArgument('email');
@@ -87,41 +73,18 @@ final class CreateUserCommand extends Command
 
         $role = $role ?: User::DEFAULT_ROLE;
 
-        $user = new User();
-        $user->setUsername($username)
-            ->setPlainPassword($password)
-            ->setEmail($email)
-            ->setEnabled(true)
-            ->setRoles(explode(',', $role))
-        ;
-
-        $errors = $this->validator->validate($user, null, ['Registration']);
-        if ($errors->count() > 0) {
-            /** @var \Symfony\Component\Validator\ConstraintViolation $error */
-            foreach ($errors as $error) {
-                $value = $error->getInvalidValue();
-                $io->error(
-                    $error->getPropertyPath()
-                    . ' (' . (\is_array($value) ? implode(',', $value) : $value) . ')'
-                    . "\n    "
-                    . $error->getMessage()
-                );
-            }
-
-            return 1;
-        }
+        $user = $this->userService->createNewUser();
+        $user->setUsername($username);
+        $user->setPlainPassword($password);
+        $user->setEmail($email);
+        $user->setEnabled(true);
+        $user->setRoles(explode(',', $role));
 
         try {
-            $pwd = $this->encoder->encodePassword($user, $user->getPlainPassword());
-            $user->setPassword($pwd);
-
-            $entityManager = $this->doctrine->getManager();
-            $entityManager->persist($user);
-            $entityManager->flush();
-            $io->success('Success! Created user: ' . $user->getUsername());
-        } catch (\Exception $ex) {
-            $io->error('Failed to create user: ' . $user->getUsername());
-            $io->error('Reason: ' . $ex->getMessage());
+            $this->userService->saveNewUser($user);
+            $io->success(sprintf('Success! Created user: %s', $username));
+        } catch (ValidationFailedException $ex) {
+            $io->validationError($ex);
 
             return 2;
         }

src/Command/DeactivateUserCommand.php

@@ -0,0 +1,70 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Command;
+
+use App\User\UserService;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+class DeactivateUserCommand extends Command
+{
+    private $userService;
+
+    public function __construct(UserService $userService)
+    {
+        parent::__construct();
+        $this->userService = $userService;
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function configure()
+    {
+        $this
+            ->setName('kimai:user:deactivate')
+            ->setAliases(['fos:user:deactivate'])
+            ->setDescription('Deactivate a user')
+            ->setDefinition([
+                new InputArgument('username', InputArgument::REQUIRED, 'The username'),
+            ])
+            ->setHelp(
+                <<<'EOT'
+The <info>kimai:user:deactivate</info> command deactivates a user (will not be able to log in)
+
+  <info>php %command.full_name% susan_super</info>
+EOT
+            );
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function execute(InputInterface $input, OutputInterface $output)
+    {
+        $username = $input->getArgument('username');
+        $user = $this->userService->findUserByUsernameOrThrowException($username);
+
+        $io = new SymfonyStyle($input, $output);
+
+        if ($user->isEnabled()) {
+            $user->setEnabled(false);
+            $this->userService->updateUser($user);
+            $io->success(sprintf('User "%s" has been deactivated.', $username));
+        } else {
+            $io->warning(sprintf('User "%s" is already deactivated.', $username));
+        }
+
+        return 0;
+    }
+}

src/Command/DemoteUserCommand.php

@@ -0,0 +1,63 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Command;
+
+use App\Entity\User;
+use App\User\UserService;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+class DemoteUserCommand extends AbstractRoleCommand
+{
+    /**
+     * {@inheritdoc}
+     */
+    protected function configure()
+    {
+        parent::configure();
+
+        $this
+            ->setName('kimai:user:demote')
+            ->setAliases(['fos:user:demote'])
+            ->setDescription('Demote a user by removing a role')
+            ->setHelp(
+                <<<'EOT'
+The <info>kimai:user:demote</info> command demotes a user by removing a role
+
+  <info>php %command.full_name% susan_super ROLE_TEAMLEAD</info>
+  <info>php %command.full_name% --super susan_super</info>
+EOT
+            );
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function executeRoleCommand(UserService $manipulator, SymfonyStyle $output, User $user, bool $super, $role)
+    {
+        $username = $user->getUsername();
+        if ($super) {
+            if ($user->isSuperAdmin()) {
+                $user->setSuperAdmin(false);
+                $manipulator->updateUser($user);
+                $output->success(sprintf('Super administrator role has been removed from the user "%s".', $username));
+            } else {
+                $output->warning(sprintf('User "%s" doesn\'t have the super administrator role.', $username));
+            }
+        } else {
+            if ($user->hasRole($role)) {
+                $user->removeRole($role);
+                $manipulator->updateUser($user);
+                $output->success(sprintf('Role "%s" has been removed from user "%s".', $role, $username));
+            } else {
+                $output->warning(sprintf('User "%s" didn\'t have "%s" role.', $username, $role));
+            }
+        }
+    }
+}

src/Command/KimaiImporterCommand.php

@@ -136,7 +136,8 @@ final class KimaiImporterCommand extends Command
     protected function configure()
     {
         $this
-            ->setName('kimai:import-v1')
+            ->setName('kimai:import:v1')
+            ->setAliases(['kimai:import-v1'])
             ->setDescription('Import data from a Kimai v1 installation')
             ->setHelp('This command allows you to import the most important data from a Kimi v1 installation.')
             ->addArgument(

src/Command/PromoteUserCommand.php

@@ -0,0 +1,63 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Command;
+
+use App\Entity\User;
+use App\User\UserService;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+class PromoteUserCommand extends AbstractRoleCommand
+{
+    /**
+     * {@inheritdoc}
+     */
+    protected function configure()
+    {
+        parent::configure();
+
+        $this
+            ->setName('kimai:user:promote')
+            ->setAliases(['fos:user:promote'])
+            ->setDescription('Promotes a user by adding a role')
+            ->setHelp(
+                <<<'EOT'
+The <info>kimai:user:promote</info> command promotes a user by adding a role
+
+  <info>php %command.full_name% susan_super ROLE_TEAMLEAD</info>
+  <info>php %command.full_name% --super susan_super</info>
+EOT
+            );
+    }
+
+    /**
+     * {@inheritdoc}
+     */
+    protected function executeRoleCommand(UserService $manipulator, SymfonyStyle $output, User $user, bool $super, $role)
+    {
+        $username = $user->getUsername();
+        if ($super) {
+            if (!$user->isSuperAdmin()) {
+                $user->setSuperAdmin(true);
+                $manipulator->updateUser($user);
+                $output->success(sprintf('User "%s" has been promoted as a super administrator.', $username));
+            } else {
+                $output->warning(sprintf('User "%s" does already have the super administrator role.', $username));
+            }
+        } else {
+            if (!$user->hasRole($role)) {
+                $user->addRole($role);
+                $manipulator->updateUser($user);
+                $output->success(sprintf('Role "%s" has been added to user "%s".', $role, $username));
+            } else {
+                $output->warning(sprintf('User "%s" did already have "%s" role.', $username, $role));
+            }
+        }
+    }
+}

src/Command/ResetTestCommand.php

@@ -110,13 +110,13 @@ class ResetTestCommand extends AbstractResetCommand
             }
             $user->setUsername($userConf[9]);
             if ($userConf[10] !== null) {
-                $user->setUsernameCanonical($userConf[10]);
+                // removed field: UsernameCanonical
             }
             if ($userConf[11] !== null) {
                 $user->setEmail($userConf[11]);
             }
             if ($userConf[12] !== null) {
-                $user->setEmailCanonical($userConf[12]);
+                // removed field: EmailCanonical
             }
             if ($userConf[17] !== null) {
                 $user->setApiToken($userConf[17]);