src/EventSubscriber/PasswordChangeSubscriber.php line 32

Open in your IDE?
  1. <?php
  3. namespace App\EventSubscriber;
  5. use App\Entity\AppUser;
  6. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  7. use Symfony\Component\HttpFoundation\RedirectResponse;
  8. use Symfony\Component\HttpKernel\Event\RequestEvent;
  9. use Symfony\Component\HttpKernel\KernelEvents;
  10. use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
  11. use Symfony\Component\Security\Core\Security;
  13. class PasswordChangeSubscriber implements EventSubscriberInterface
  14. {
  16.     private Security $security;
  17.     private UrlGeneratorInterface $urlGenerator;
  19.     public function __construct(Security $security, UrlGeneratorInterface $urlGenerator)
  20.     {
  21.         $this->security = $security;
  22.         $this->urlGenerator = $urlGenerator;
  23.     }
  25.     public static function getSubscribedEvents(): array
  26.     {
  27.         return [
  28.             KernelEvents::REQUEST => [['forcePasswordChange', 0]],
  29.         ];
  30.     }
  32.     public function forcePasswordChange(RequestEvent $event): void
  33.     {
  35.         // only deal with the main request, disregard subrequests
  36.         if (!$event->isMainRequest()) {
  37.             return;
  38.         }
  40.         // if we are visiting the password change route, no need to redirect
  41.         // otherwise we'd create an infinite redirection loop
  42.         if ($event->getRequest()->get('_route') === 'force_password_change') {
  43.             return;
  44.         }
  46.         $user = $this->security->getUser();
  47.         // if you do not have a valid user, it means it's not an authenticated request, so it's not our concern
  48.         if (!$user instanceof AppUser) {
  49.             return;
  50.         }
  52.         // if it's not their first login, and they do not need to change their password, move on
  53.         if (!$user->isFirstLogin()) {
  54.             return;
  55.         }
  57.         // if we get here, it means we need to redirect them to the password change view.
  58.         $event->setResponse(new RedirectResponse($this->urlGenerator->generate('force_password_change')));
  60.     }
  61. }