Release 2.59 (#5957)

src/EventSubscriber/PasswordResetSubscriber.php

@@ -64,7 +64,7 @@ class PasswordResetSubscriber implements EventSubscriberInterface
             return;
         }
 
-        $response = new RedirectResponse($this->urlGenerator->generate('wizard', ['wizard' => 'password']));
+        $response = new RedirectResponse($this->urlGenerator->generate('wizard_password'));
         $event->setResponse($response);
     }
 }

src/EventSubscriber/WizardSubscriber.php

@@ -11,6 +11,7 @@ namespace App\EventSubscriber;
 
 use App\Configuration\SystemConfiguration;
 use App\Entity\User;
+use App\Wizard\WizardManager;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpKernel\Event\RequestEvent;
@@ -19,13 +20,17 @@ use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
 use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
 
+/**
+ * Responsible for displaying the correct wizard
+ */
 class WizardSubscriber implements EventSubscriberInterface
 {
     public function __construct(
         private readonly UrlGeneratorInterface $urlGenerator,
         private readonly AuthorizationCheckerInterface $security,
         private readonly TokenStorageInterface $storage,
-        private readonly SystemConfiguration $systemConfiguration
+        private readonly SystemConfiguration $systemConfiguration,
+        private readonly WizardManager $wizardManager,
     ) {
     }
 
@@ -45,9 +50,20 @@ class WizardSubscriber implements EventSubscriberInterface
 
         $uri = $event->getRequest()->getRequestUri();
 
-        // never trigger wizard on API calls
         // TODO 3.0 remove /register/
-        if (str_starts_with($uri, '/api/') || stripos($uri, '/register/') !== false || stripos($uri, '/wizard/') !== false) {
+        if (stripos($uri, '/register/') !== false) {
+            return;
+        }
+
+        // never trigger wizard on API calls
+        if (str_starts_with($uri, '/api/')) {
+            return;
+        }
+
+        // never trigger on wizard routes themselves — except the virtual /next/
+        // route, which intentionally re-enters this subscriber so that the user
+        // is redirected to the first step they have not seen yet.
+        if (stripos($uri, '/wizard/') !== false && stripos($uri, '/wizard/next/') === false) {
             return;
         }
 
@@ -65,13 +81,15 @@ class WizardSubscriber implements EventSubscriberInterface
             return;
         }
 
-        foreach (User::WIZARDS as $wizard) {
-            if (!$user->hasSeenWizard($wizard)) {
-                $response = new RedirectResponse($this->urlGenerator->generate('wizard', ['wizard' => $wizard]));
-                $event->setResponse($response);
+        $step = $this->wizardManager->getFirstUnseenStep($user);
 
-                return;
-            }
+        if ($step === null) {
+            // All registered steps have been seen — fall through to the regular
+            // application response. If we were intercepting /wizard/next/, the
+            // controller will redirect to wizard_finish.
+            return;
         }
+
+        $event->setResponse(new RedirectResponse($this->urlGenerator->generate($step->route)));
     }
 }