From 2251045901875aa815dee43ec467fb1af8d416d0 Mon Sep 17 00:00:00 2001 From: Thomas Citharel Date: Sat, 29 Apr 2017 19:22:50 +0200 Subject: WIP Signed-off-by: Thomas Citharel --- .../ApiBundle/Controller/UserRestController.php | 98 ++++++++++++++++++++++ .../ApiBundle/Resources/config/routing_rest.yml | 5 ++ src/Wallabag/UserBundle/Entity/User.php | 5 ++ 3 files changed, 108 insertions(+) create mode 100644 src/Wallabag/ApiBundle/Controller/UserRestController.php (limited to 'src') diff --git a/src/Wallabag/ApiBundle/Controller/UserRestController.php b/src/Wallabag/ApiBundle/Controller/UserRestController.php new file mode 100644 index 00000000..c5ffbdf1 --- /dev/null +++ b/src/Wallabag/ApiBundle/Controller/UserRestController.php @@ -0,0 +1,98 @@ +validateAuthentication(); + + $serializationContext = SerializationContext::create()->setGroups(['user_api']); + $json = $this->get('serializer')->serialize($this->getUser(), 'json', $serializationContext); + + return (new JsonResponse())->setJson($json); + } + + /** + * Register an user + * + * @ApiDoc( + * requirements={ + * {"name"="username", "dataType"="string", "required"=true, "description"="The user's username"}, + * {"name"="password", "dataType"="string", "required"=true, "description"="The user's password"} + * {"name"="email", "dataType"="string", "required"=true, "description"="The user's email"} + * } + * ) + * @return JsonResponse + */ + // TODO : Make this method (or the whole API) accessible only through https + public function putUserAction($username, $password, $email) + { + if (!$this->container->getParameter('fosuser_registration')) { + $json = $this->get('serializer')->serialize(['error' => "Server doesn't allow registrations"], 'json'); + return (new JsonResponse())->setJson($json)->setStatusCode(403); + } + + if ($password === '') { // TODO : might be a good idea to enforce restrictions here + $json = $this->get('serializer')->serialize(['error' => 'Password is blank'], 'json'); + return (new JsonResponse())->setJson($json)->setStatusCode(400); + } + + + // TODO : Make only one call to database by using a custom repository method + if ($this->getDoctrine() + ->getRepository('WallabagUserBundle:User') + ->findOneByUserName($username)) { + $json = $this->get('serializer')->serialize(['error' => 'Username is already taken'], 'json'); + return (new JsonResponse())->setJson($json)->setStatusCode(409); + } + + if ($this->getDoctrine() + ->getRepository('WallabagUserBundle:User') + ->findOneByEmail($email)) { + $json = $this->get('serializer')->serialize(['error' => 'An account with this email already exists'], 'json'); + return (new JsonResponse())->setJson($json)->setStatusCode(409); + } + + $em = $this->get('doctrine.orm.entity_manager'); + + $userManager = $this->get('fos_user.user_manager'); + $user = $userManager->createUser(); + + $user->setUsername($username); + + $user->setPlainPassword($password); + + $user->setEmail($email); + + $user->setEnabled(true); + $user->addRole('ROLE_USER'); + + $em->persist($user); + + // dispatch a created event so the associated config will be created + $event = new UserEvent($user); + $this->get('event_dispatcher')->dispatch(FOSUserEvents::USER_CREATED, $event); + + $serializationContext = SerializationContext::create()->setGroups(['user_api']); + $json = $this->get('serializer')->serialize($user, 'json', $serializationContext); + + return (new JsonResponse())->setJson($json); + + } + +} diff --git a/src/Wallabag/ApiBundle/Resources/config/routing_rest.yml b/src/Wallabag/ApiBundle/Resources/config/routing_rest.yml index 57d37f4b..c0283e71 100644 --- a/src/Wallabag/ApiBundle/Resources/config/routing_rest.yml +++ b/src/Wallabag/ApiBundle/Resources/config/routing_rest.yml @@ -17,3 +17,8 @@ misc: type: rest resource: "WallabagApiBundle:WallabagRest" name_prefix: api_ + +user: + type: rest + resource: "WallabagApiBundle:UserRest" + name_prefix: api_ diff --git a/src/Wallabag/UserBundle/Entity/User.php b/src/Wallabag/UserBundle/Entity/User.php index 3a167de7..1863c966 100644 --- a/src/Wallabag/UserBundle/Entity/User.php +++ b/src/Wallabag/UserBundle/Entity/User.php @@ -4,6 +4,7 @@ namespace Wallabag\UserBundle\Entity; use Doctrine\Common\Collections\ArrayCollection; use Doctrine\ORM\Mapping as ORM; +use JMS\Serializer\Annotation\Groups; use Scheb\TwoFactorBundle\Model\Email\TwoFactorInterface; use Scheb\TwoFactorBundle\Model\TrustedComputerInterface; use FOS\UserBundle\Model\User as BaseUser; @@ -35,6 +36,7 @@ class User extends BaseUser implements TwoFactorInterface, TrustedComputerInterf * @ORM\Column(name="id", type="integer") * @ORM\Id * @ORM\GeneratedValue(strategy="AUTO") + * @Groups({"user_api"}) */ protected $id; @@ -42,6 +44,7 @@ class User extends BaseUser implements TwoFactorInterface, TrustedComputerInterf * @var string * * @ORM\Column(name="name", type="text", nullable=true) + * @Groups({"user_api"}) */ protected $name; @@ -49,6 +52,7 @@ class User extends BaseUser implements TwoFactorInterface, TrustedComputerInterf * @var date * * @ORM\Column(name="created_at", type="datetime") + * @Groups({"user_api"}) */ protected $createdAt; @@ -56,6 +60,7 @@ class User extends BaseUser implements TwoFactorInterface, TrustedComputerInterf * @var date * * @ORM\Column(name="updated_at", type="datetime") + * @Groups({"user_api"}) */ protected $updatedAt; -- cgit v1.2.3 From 5709ecb36809fb009446a11a758232bbe8f264e4 Mon Sep 17 00:00:00 2001 From: Jeremy Benoist Date: Tue, 30 May 2017 07:56:01 +0200 Subject: Re-use `NewUserType` to validate registration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The only ugly things is how we handle error by generating the view and then parse the content to retrieve all errors… Fix exposition fields in User entity --- .../ApiBundle/Controller/UserRestController.php | 119 ++++++++++++++------- src/Wallabag/UserBundle/Entity/User.php | 25 ++++- 2 files changed, 101 insertions(+), 43 deletions(-) (limited to 'src') diff --git a/src/Wallabag/ApiBundle/Controller/UserRestController.php b/src/Wallabag/ApiBundle/Controller/UserRestController.php index c5ffbdf1..a1b78e3f 100644 --- a/src/Wallabag/ApiBundle/Controller/UserRestController.php +++ b/src/Wallabag/ApiBundle/Controller/UserRestController.php @@ -6,12 +6,14 @@ use FOS\UserBundle\Event\UserEvent; use FOS\UserBundle\FOSUserEvents; use JMS\Serializer\SerializationContext; use Nelmio\ApiDocBundle\Annotation\ApiDoc; +use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\JsonResponse; +use Wallabag\UserBundle\Entity\User; class UserRestController extends WallabagRestController { /** - * Retrieve user informations + * Retrieve current logged in user informations. * * @ApiDoc() * @@ -21,78 +23,117 @@ class UserRestController extends WallabagRestController { $this->validateAuthentication(); - $serializationContext = SerializationContext::create()->setGroups(['user_api']); - $json = $this->get('serializer')->serialize($this->getUser(), 'json', $serializationContext); - - return (new JsonResponse())->setJson($json); + return $this->sendUser($this->getUser()); } /** - * Register an user + * Register an user. * * @ApiDoc( * requirements={ * {"name"="username", "dataType"="string", "required"=true, "description"="The user's username"}, - * {"name"="password", "dataType"="string", "required"=true, "description"="The user's password"} + * {"name"="password", "dataType"="string", "required"=true, "description"="The user's password"}, * {"name"="email", "dataType"="string", "required"=true, "description"="The user's email"} * } * ) + * + * @todo Make this method (or the whole API) accessible only through https + * * @return JsonResponse */ - // TODO : Make this method (or the whole API) accessible only through https - public function putUserAction($username, $password, $email) + public function putUserAction(Request $request) { if (!$this->container->getParameter('fosuser_registration')) { $json = $this->get('serializer')->serialize(['error' => "Server doesn't allow registrations"], 'json'); + return (new JsonResponse())->setJson($json)->setStatusCode(403); } - if ($password === '') { // TODO : might be a good idea to enforce restrictions here - $json = $this->get('serializer')->serialize(['error' => 'Password is blank'], 'json'); - return (new JsonResponse())->setJson($json)->setStatusCode(400); - } + $userManager = $this->get('fos_user.user_manager'); + $user = $userManager->createUser(); + // enable created user by default + $user->setEnabled(true); + $form = $this->createForm('Wallabag\UserBundle\Form\NewUserType', $user, [ + 'csrf_protection' => false, + ]); - // TODO : Make only one call to database by using a custom repository method - if ($this->getDoctrine() - ->getRepository('WallabagUserBundle:User') - ->findOneByUserName($username)) { - $json = $this->get('serializer')->serialize(['error' => 'Username is already taken'], 'json'); - return (new JsonResponse())->setJson($json)->setStatusCode(409); - } + // simulate form submission + $form->submit([ + 'username' => $request->request->get('username'), + 'plainPassword' => [ + 'first' => $request->request->get('password'), + 'second' => $request->request->get('password'), + ], + 'email' => $request->request->get('email'), + ]); - if ($this->getDoctrine() - ->getRepository('WallabagUserBundle:User') - ->findOneByEmail($email)) { - $json = $this->get('serializer')->serialize(['error' => 'An account with this email already exists'], 'json'); - return (new JsonResponse())->setJson($json)->setStatusCode(409); - } + if ($form->isSubmitted() && false === $form->isValid()) { + $view = $this->view($form, 400); + $view->setFormat('json'); - $em = $this->get('doctrine.orm.entity_manager'); + // handle errors in a more beautiful way than the default view + $data = json_decode($this->handleView($view)->getContent(), true)['children']; + $errors = []; - $userManager = $this->get('fos_user.user_manager'); - $user = $userManager->createUser(); + if (isset($data['username']['errors'])) { + $errors['username'] = $this->translateErrors($data['username']['errors']); + } - $user->setUsername($username); + if (isset($data['email']['errors'])) { + $errors['email'] = $this->translateErrors($data['email']['errors']); + } - $user->setPlainPassword($password); + if (isset($data['plainPassword']['children']['first']['errors'])) { + $errors['password'] = $this->translateErrors($data['plainPassword']['children']['first']['errors']); + } - $user->setEmail($email); + $json = $this->get('serializer')->serialize(['error' => $errors], 'json'); - $user->setEnabled(true); - $user->addRole('ROLE_USER'); + return (new JsonResponse())->setJson($json)->setStatusCode(400); + } - $em->persist($user); + $userManager->updateUser($user); // dispatch a created event so the associated config will be created - $event = new UserEvent($user); + $event = new UserEvent($user, $request); $this->get('event_dispatcher')->dispatch(FOSUserEvents::USER_CREATED, $event); - $serializationContext = SerializationContext::create()->setGroups(['user_api']); - $json = $this->get('serializer')->serialize($user, 'json', $serializationContext); + return $this->sendUser($user); + } - return (new JsonResponse())->setJson($json); + /** + * Send user response. + * + * @param User $user + * + * @return JsonResponse + */ + private function sendUser(User $user) + { + $json = $this->get('serializer')->serialize( + $user, + 'json', + SerializationContext::create()->setGroups(['user_api']) + ); + return (new JsonResponse())->setJson($json); } + /** + * Translate errors message. + * + * @param array $errors + * + * @return array + */ + private function translateErrors($errors) + { + $translatedErrors = []; + foreach ($errors as $error) { + $translatedErrors[] = $this->get('translator')->trans($error); + } + + return $translatedErrors; + } } diff --git a/src/Wallabag/UserBundle/Entity/User.php b/src/Wallabag/UserBundle/Entity/User.php index 1863c966..1ff3046a 100644 --- a/src/Wallabag/UserBundle/Entity/User.php +++ b/src/Wallabag/UserBundle/Entity/User.php @@ -5,11 +5,10 @@ namespace Wallabag\UserBundle\Entity; use Doctrine\Common\Collections\ArrayCollection; use Doctrine\ORM\Mapping as ORM; use JMS\Serializer\Annotation\Groups; +use JMS\Serializer\Annotation\XmlRoot; use Scheb\TwoFactorBundle\Model\Email\TwoFactorInterface; use Scheb\TwoFactorBundle\Model\TrustedComputerInterface; use FOS\UserBundle\Model\User as BaseUser; -use JMS\Serializer\Annotation\ExclusionPolicy; -use JMS\Serializer\Annotation\Expose; use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity; use Symfony\Component\Security\Core\User\UserInterface; use Wallabag\ApiBundle\Entity\Client; @@ -19,23 +18,24 @@ use Wallabag\CoreBundle\Entity\Entry; /** * User. * + * @XmlRoot("user") * @ORM\Entity(repositoryClass="Wallabag\UserBundle\Repository\UserRepository") * @ORM\Table(name="`user`") * @ORM\HasLifecycleCallbacks() - * @ExclusionPolicy("all") * * @UniqueEntity("email") * @UniqueEntity("username") */ class User extends BaseUser implements TwoFactorInterface, TrustedComputerInterface { + /** @Serializer\XmlAttribute */ /** * @var int * - * @Expose * @ORM\Column(name="id", type="integer") * @ORM\Id * @ORM\GeneratedValue(strategy="AUTO") + * * @Groups({"user_api"}) */ protected $id; @@ -44,14 +44,30 @@ class User extends BaseUser implements TwoFactorInterface, TrustedComputerInterf * @var string * * @ORM\Column(name="name", type="text", nullable=true) + * * @Groups({"user_api"}) */ protected $name; + /** + * @var string + * + * @Groups({"user_api"}) + */ + protected $username; + + /** + * @var string + * + * @Groups({"user_api"}) + */ + protected $email; + /** * @var date * * @ORM\Column(name="created_at", type="datetime") + * * @Groups({"user_api"}) */ protected $createdAt; @@ -60,6 +76,7 @@ class User extends BaseUser implements TwoFactorInterface, TrustedComputerInterf * @var date * * @ORM\Column(name="updated_at", type="datetime") + * * @Groups({"user_api"}) */ protected $updatedAt; -- cgit v1.2.3 From d069bff4f606be75c47a3415f2a5af13d6f04865 Mon Sep 17 00:00:00 2001 From: Jeremy Benoist Date: Tue, 30 May 2017 07:56:41 +0200 Subject: Remove unknown validation_groups The Profile validation_groups does not exist and then for validation to be skipped (like password length) --- src/Wallabag/UserBundle/Controller/ManageController.php | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'src') diff --git a/src/Wallabag/UserBundle/Controller/ManageController.php b/src/Wallabag/UserBundle/Controller/ManageController.php index 1c5c86d4..084f2c67 100644 --- a/src/Wallabag/UserBundle/Controller/ManageController.php +++ b/src/Wallabag/UserBundle/Controller/ManageController.php @@ -33,9 +33,7 @@ class ManageController extends Controller // enable created user by default $user->setEnabled(true); - $form = $this->createForm('Wallabag\UserBundle\Form\NewUserType', $user, [ - 'validation_groups' => ['Profile'], - ]); + $form = $this->createForm('Wallabag\UserBundle\Form\NewUserType', $user); $form->handleRequest($request); if ($form->isSubmitted() && $form->isValid()) { -- cgit v1.2.3