src/EventSubscriber/TwoFactorSetupSubscriber.php line 39

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. namespace App\EventSubscriber;
  7. use App\Entity\User;
  8. use Psr\Log\LoggerInterface;
  9. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  10. use Symfony\Component\HttpFoundation\RedirectResponse;
  11. use Symfony\Component\HttpKernel\Event\RequestEvent;
  12. use Symfony\Component\HttpKernel\KernelEvents;
  13. use Symfony\Component\Routing\RouterInterface;
  14. use Symfony\Component\Security\Core\Security;
  16. class TwoFactorSetupSubscriber implements EventSubscriberInterface
  17. {
  18. protected $logger;
  19. protected $security;
  20. protected $router;
  22. public function __construct(
  23. LoggerInterface $logger,
  24. Security $security,
  25. RouterInterface $router
  26. ) {
  27. $this->logger = $logger;
  28. $this->security = $security;
  29. $this->router = $router;
  30. }
  32. public static function getSubscribedEvents(): array
  33. {
  34. return [
  35. KernelEvents::REQUEST => [['onKernelRequest', 4]],
  36. ];
  37. }
  39. public function onKernelRequest(RequestEvent $event): void
  40. {
  41. $request = $event->getRequest();
  42. $path = $request->getPathInfo();
  44. // Only intercept /app routes — not login, 2fa, logout, setup itself, or API
  45. $allowedPaths = ['/2fa', '/2fa/check', '/2fa/resend', '/logout', '/app/2fa/setup', '/app/security/enable-2fa', '/security_questions', '/reset', '/forgot', '/resetting'];
  46. foreach ($allowedPaths as $allowed) {
  47. if (str_starts_with($path, $allowed)) {
  48. return;
  49. }
  50. }
  52. if (!str_starts_with($path, '/app')) {
  53. return;
  54. }
  56. $user = $this->security->getUser();
  58. if (!$user instanceof User) {
  59. return;
  60. }
  62. // Skip admins
  63. if (in_array(User::ROLE_ADMIN, $user->getRoles()) || in_array(User::ROLE_SUPER_ADMIN, $user->getRoles())) {
  64. return;
  65. }
  67. if (!$user->getEmailAuthEnabled()) {
  68. $this->logger->debug('***** TwoFactorSetupSubscriber: user has no 2FA, redirecting to setup');
  69. $event->setResponse(new RedirectResponse($this->router->generate('app_2fa_setup')));
  70. }
  71. }
  72. }