From e7f0cd50c9f712a748ebef7b0567cb421dd42368 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Julien=20Fastr=C3=A9?= <julien.fastre@champs-libres.coop>
Date: Wed, 13 Apr 2022 23:05:38 +0200
Subject: [PATCH] controller to grant access to notification by access key

---
 .../Controller/NotificationController.php     | 43 ++++++++++++++++++-
 1 file changed, 42 insertions(+), 1 deletion(-)

diff --git a/src/Bundle/ChillMainBundle/Controller/NotificationController.php b/src/Bundle/ChillMainBundle/Controller/NotificationController.php
index 0e02c0a82..5c1508321 100644
--- a/src/Bundle/ChillMainBundle/Controller/NotificationController.php
+++ b/src/Bundle/ChillMainBundle/Controller/NotificationController.php
@@ -22,6 +22,7 @@ use Chill\MainBundle\Pagination\PaginatorFactory;
 use Chill\MainBundle\Repository\NotificationRepository;
 use Chill\MainBundle\Security\Authorization\NotificationVoter;
 use Doctrine\ORM\EntityManagerInterface;
+use Psr\Log\LoggerInterface;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
@@ -39,6 +40,10 @@ class NotificationController extends AbstractController
 {
     private EntityManagerInterface $em;
 
+    private LoggerInterface $chillLogger;
+
+    private LoggerInterface $logger;
+
     private NotificationHandlerManager $notificationHandlerManager;
 
     private NotificationRepository $notificationRepository;
@@ -51,6 +56,8 @@ class NotificationController extends AbstractController
 
     public function __construct(
         EntityManagerInterface $em,
+        LoggerInterface $chillLogger,
+        LoggerInterface $logger,
         Security $security,
         NotificationRepository $notificationRepository,
         NotificationHandlerManager $notificationHandlerManager,
@@ -58,6 +65,8 @@ class NotificationController extends AbstractController
         TranslatorInterface $translator
     ) {
         $this->em = $em;
+        $this->logger = $logger;
+        $this->chillLogger = $chillLogger;
         $this->security = $security;
         $this->notificationRepository = $notificationRepository;
         $this->notificationHandlerManager = $notificationHandlerManager;
@@ -72,8 +81,40 @@ class NotificationController extends AbstractController
     {
         $this->denyAccessUnlessGranted('IS_AUTHENTICATED_REMEMBERED');
 
-        return new Response('Invalid access key');
+        if (!$this->security->getUser() instanceof User) {
+            throw new AccessDeniedHttpException('You must be authenticated and a user to create a notification');
+        }
 
+        foreach (['accessKey', 'email'] as $param) {
+            if (!$request->query->has($param)) {
+                throw new BadRequestHttpException("Missing $param parameter");
+            }
+        }
+
+        if ($notification->getAccessKey() !== $request->query->getAlnum('accessKey')) {
+            throw new AccessDeniedHttpException('access key is invalid');
+        }
+
+        if (!in_array($request->query->get('email'), $notification->getAddressesEmails())) {
+            return (new Response('The email address is no more associated with this notification'))
+                ->setStatusCode(Response::HTTP_FORBIDDEN);
+        }
+
+        $notification->addAddressee($this->security->getUser());
+
+        $this->getDoctrine()->getManager()->flush();
+
+        $logMsg = '[Notification] a user is granted access to notification trough an access key';
+        $context = [
+            'notificationId' => $notification->getId(),
+            'email' => $request->query->get('email'),
+            'user' => $this->security->getUser()->getId(),
+        ];
+
+        $this->logger->info($logMsg, $context);
+        $this->chillLogger->info($logMsg, $context);
+
+        return $this->redirectToRoute('chill_main_notification_show', ['id' => $notification->getId()]);
     }
 
     /**