src/Web/EventSubscriber/LockedUser.php line 53

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. namespace SpringerNature\CPS\AMEDReviewTracker\Web\EventSubscriber;
  7. use FOS\UserBundle\Model\UserManagerInterface;
  8. use SpringerNature\CPS\AMEDReviewTracker\App\LockedUserNotifierInterface;
  9. use SpringerNature\CPS\AMEDReviewTracker\Web\Entity\WebUser;
  10. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  11. use Symfony\Component\HttpFoundation\Session\SessionInterface;
  12. use Symfony\Component\Security\Core\AuthenticationEvents;
  13. use Symfony\Component\Security\Core\Event\AuthenticationFailureEvent;
  14. use Symfony\Component\Security\Core\Event\AuthenticationSuccessEvent;
  15. use Symfony\Component\Security\Core\Exception\LockedException;
  17. class LockedUser implements EventSubscriberInterface
  18. {
  19.     /**
  20.      * @var SessionInterface
  21.      */
  22.     private $session;
  24.     /**
  25.      * @var UserManagerInterface
  26.      */
  27.     private $userManager;
  29.     /**
  30.      * @var LockedUserNotifierInterface
  31.      */
  32.     private $notifier;
  34.     private const MAX_FAILED_LOGIN_ATTEMPTS = 5;
  35.     private const FAILED_LOGIN_TIME_WINDOW_MINUTES = 10;
  36.     private const FAILED_LOGINS_KEY = 'failed_logins';
  38.     public function __construct(SessionInterface $session, UserManagerInterface $userManager, LockedUserNotifierInterface $notifier)
  39.     {
  40.         $this->session = $session;
  41.         $this->userManager = $userManager;
  42.         $this->notifier = $notifier;
  43.     }
  45.     public static function getSubscribedEvents(): array
  46.     {
  47.         return [
  48.             AuthenticationEvents::AUTHENTICATION_SUCCESS => 'onAuthenticationSuccess',
  49.             AuthenticationEvents::AUTHENTICATION_FAILURE => 'onAuthenticationFailure',
  50.         ];
  51.     }
  53.     public function onAuthenticationSuccess(AuthenticationSuccessEvent $event): void
  54.     {
  55.         $username = $event->getAuthenticationToken()->getUsername();
  57.         /** @var WebUser $user */
  58.         $user = $this->userManager->findUserByUsernameOrEmail($username);
  60.         if (null === $user) {
  61.             return;
  62.         }
  64.         if ($user->isAccountLocked()) {
  65.             throw new LockedException('Account is locked');
  66.         }
  67.     }
  69.     public function onAuthenticationFailure(AuthenticationFailureEvent $event): void
  70.     {
  71.         $username = $event->getAuthenticationToken()->getUsername();
  73.         /** @var WebUser $user */
  74.         $user = $this->userManager->findUserByUsernameOrEmail($username);
  76.         if (null === $user) {
  77.             return;
  78.         }
  80.         $this->incrementFailedLoginCounter($username);
  81.         $numberOfFailedLogins = $this->getNumberOfFailedLogins($username);
  83.         if ($numberOfFailedLogins >= self::MAX_FAILED_LOGIN_ATTEMPTS && ! $user->isAccountLocked()) {
  84.             $user->lockAccount();
  86.             $this->userManager->updateUser($user);
  88.             $this->notifier->__invoke($username);
  89.         }
  91.         if ($user->isAccountLocked()) {
  92.             throw new LockedException('Account is locked');
  93.         }
  94.     }
  96.     private function getNumberOfFailedLogins(string $username): int
  97.     {
  98.         $failedLogins = $this->session->get(self::FAILED_LOGINS_KEY, []);
  99.         $timestamp = time();
  101.         if (isset($failedLogins[$username]) && $failedLogins[$username]['expiry'] > $timestamp) {
  102.             return $failedLogins[$username]['count'];
  103.         }
  105.         return 0;
  106.     }
  108.     private function incrementFailedLoginCounter(string $username): void
  109.     {
  110.         $failedLogins = $this->session->get(self::FAILED_LOGINS_KEY, []);
  111.         $timestamp = time();
  113.         if (isset($failedLogins[$username]) && $failedLogins[$username]['expiry'] > $timestamp) {
  114.             $failedLogins[$username] = [
  115.                 'count' => $failedLogins[$username]['count'] + 1,
  116.                 'expiry' => $failedLogins[$username]['expiry'],
  117.             ];
  118.         } else {
  119.             $failedLogins[$username] = [
  120.                 'count' => 1,
  121.                 'expiry' => $timestamp + (self::FAILED_LOGIN_TIME_WINDOW_MINUTES * 60),
  122.             ];
  123.         }
  125.         $this->session->set(self::FAILED_LOGINS_KEY, $failedLogins);
  126.     }
  127. }