code challenge 9 solution

Author: jschaedl

CODING-CHALLENGE-10.md

@@ -0,0 +1,44 @@
+# RESTful Webservices in Symfony
+
+## Coding Challenge 10 - JSON WEB TOKEN
+
+### Tasks
+
+Let's set up the Authentication/Authorization for our API based on JSON Web Token
+
+1. Implement a Token provider
+
+- configure the security system for basic auth
+- add a TokenController to retrieve a token
+
+2. Implement a Guard
+
+- implement a JwtGuardAuthenticator
+
+3. Secure your Controllers to meet the requirements described in README.md
+
+- use the `#[IsGranted]` attribute
+- or alternatively add `access_control` entries
+
+### Solution
+
+#### Preparation
+
+- require Symfony's SecurityBundle: `composer req security`
+- require LexikJWTAuthenticationBundle: `composer req lexik/jwt-authentication-bundle`
+- run `php bin/console lexik:jwt:generate-keypair`
+
+#### GuardAuthenticator
+
+- adjust firewall configuration (firewall for token: `http_basic`, firewall for api: `custom_authenticators`)
+- implement a `TokenController`, secure it with http_basic and return a JWT token
+- implement a `JwtTokenAuthenticator` extending the `AbstractAuthenticator`
+- configure the `JwtTokenAuthenticator` on the api firewall (`custom_authenticators` option)
+- add `#[IsGranted]` attributes to your controller actions
+- add an Authorization header to your Postman endpoints
+
+#### Make things shiny
+
+- use the serializer to create a nice error response in the `JwtTokenAuthenticator::start()` method
+- implement the `JwtTokenAuthenticator::onAuthenticationFailure()` and use the serializer to return an
+  HTTP 401 Unauthorized Response with a nice error message

composer.json

@@ -19,6 +19,7 @@
         "symfony/console": "5.4.*",
         "symfony/deprecation-contracts": "^2.1|^3",
         "symfony/dotenv": "5.4.*",
+        "symfony/expression-language": "5.4.*",
         "symfony/flex": "^1.17",
         "symfony/framework-bundle": "5.4.*",
         "symfony/property-access": "5.4.*",

composer.lock

@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ArgumentValueResolver;
+
+use App\Domain\Model\CreateWorkshopModel;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Controller\ArgumentValueResolverInterface;
+use Symfony\Component\HttpKernel\ControllerMetadata\ArgumentMetadata;
+use Symfony\Component\Serializer\SerializerInterface;
+use Symfony\Component\Validator\Exception\ValidationFailedException;
+use Symfony\Component\Validator\Validator\ValidatorInterface;
+
+final class CreateWorkshopModelResolver implements ArgumentValueResolverInterface
+{
+    public function __construct(
+        private SerializerInterface $serializer,
+        private ValidatorInterface $validator,
+    ) {
+    }
+
+    public function supports(Request $request, ArgumentMetadata $argument): bool
+    {
+        return CreateWorkshopModel::class === $argument->getType() && 'POST' === $request->getMethod();
+    }
+
+    /**
+     * @return iterable<CreateWorkshopModel>
+     */
+    public function resolve(Request $request, ArgumentMetadata $argument)
+    {
+        $model = $this->serializer->deserialize(
+            $request->getContent(),
+            CreateWorkshopModel::class,
+            $request->getRequestFormat(),
+        );
+
+        $validationErrors = $this->validator->validate($model);
+
+        if (\count($validationErrors) > 0) {
+            throw new ValidationFailedException($model, $validationErrors);
+        }
+
+        yield $model;
+    }
+}

src/ArgumentValueResolver/CreateWorkshopModelResolver.php

@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\ArgumentValueResolver;
+
+use App\Domain\Model\UpdateWorkshopModel;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Controller\ArgumentValueResolverInterface;
+use Symfony\Component\HttpKernel\ControllerMetadata\ArgumentMetadata;
+use Symfony\Component\Serializer\SerializerInterface;
+use Symfony\Component\Validator\Exception\ValidationFailedException;
+use Symfony\Component\Validator\Validator\ValidatorInterface;
+
+final class UpdateWorkshopModelResolver implements ArgumentValueResolverInterface
+{
+    public function __construct(
+        private SerializerInterface $serializer,
+        private ValidatorInterface $validator,
+    ) {
+    }
+
+    public function supports(Request $request, ArgumentMetadata $argument): bool
+    {
+        return UpdateWorkshopModel::class === $argument->getType() && 'PUT' === $request->getMethod();
+    }
+
+    /**
+     * @return iterable<UpdateWorkshopModel>
+     */
+    public function resolve(Request $request, ArgumentMetadata $argument)
+    {
+        $model = $this->serializer->deserialize(
+            $request->getContent(),
+            UpdateWorkshopModel::class,
+            $request->getRequestFormat(),
+        );
+
+        $validationErrors = $this->validator->validate($model);
+
+        if (\count($validationErrors) > 0) {
+            throw new ValidationFailedException($model, $validationErrors);
+        }
+
+        yield $model;
+    }
+}

src/ArgumentValueResolver/UpdateWorkshopModelResolver.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Attendee;
+
+use App\Domain\AttendeeRemover;
+use App\Entity\Attendee;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Annotation\Route;
+
+#[Route('/attendees/{identifier}', name: 'delete_attendee', methods: ['DELETE'])]
+class DeleteController
+{
+    public function __construct(
+        private AttendeeRemover $attendeeRemover,
+    ) {
+    }
+
+    public function __invoke(Request $request, Attendee $attendee)
+    {
+        $this->attendeeRemover->remove($attendee);
+
+        return new Response(null, Response::HTTP_NO_CONTENT);
+    }
+}

src/Controller/Attendee/DeleteController.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Workshop;
+
+use App\Entity\Attendee;
+use App\Entity\Workshop;
+use Doctrine\ORM\EntityManagerInterface;
+use Sensio\Bundle\FrameworkExtraBundle\Configuration\Entity;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Annotation\Route;
+
+#[Route('/workshops/{identifier}/attendees/add/{attendee_identifier}', name: 'add_attendee_to_workshop', methods: ['POST'])]
+#[Entity('attendee', expr: 'repository.findOneByIdentifier(attendee_identifier)')]
+class AddAttendeeToWorkshopController
+{
+    public function __construct(
+        private EntityManagerInterface $entityManager
+    ) {
+    }
+
+    public function __invoke(Request $request, Workshop $workshop, Attendee $attendee)
+    {
+        $workshop->addAttendee($attendee);
+
+        $this->entityManager->flush();
+
+        return new Response(null, Response::HTTP_NO_CONTENT);
+    }
+}

src/Controller/Workshop/AddAttendeeToWorkshopController.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Workshop;
+
+use App\Domain\Model\CreateWorkshopModel;
+use App\Domain\WorkshopCreator;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Annotation\Route;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Serializer\SerializerInterface;
+
+#[Route('/workshops', name: 'create_workshop', methods: ['POST'])]
+final class CreateController
+{
+    public function __construct(
+        private WorkshopCreator $workshopCreator,
+        private SerializerInterface $serializer,
+        private UrlGeneratorInterface $urlGenerator,
+    ) {
+    }
+
+    public function __invoke(Request $request, CreateWorkshopModel $createWorkshopModel)
+    {
+        $createdWorkshop = $this->workshopCreator->create($createWorkshopModel);
+
+        $serializedCreatedWorkshop = $this->serializer->serialize($createdWorkshop, $request->getRequestFormat());
+
+        return new Response($serializedCreatedWorkshop, Response::HTTP_CREATED, [
+            'Location' => $this->urlGenerator->generate('read_workshop', [
+                'identifier' => $createdWorkshop->getIdentifier(),
+            ], UrlGeneratorInterface::ABSOLUTE_URL),
+        ]);
+    }
+}

src/Controller/Workshop/CreateController.php

@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Workshop;
+
+use App\Domain\WorkshopRemover;
+use App\Entity\Workshop;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Annotation\Route;
+
+#[Route('/workshops/{identifier}', name: 'delete_workshop', methods: ['DELETE'])]
+class DeleteController
+{
+    public function __construct(
+        private WorkshopRemover $workshopRemover,
+    ) {
+    }
+
+    public function __invoke(Request $request, Workshop $workshop)
+    {
+        $this->workshopRemover->remove($workshop);
+
+        return new Response(null, Response::HTTP_NO_CONTENT);
+    }
+}

src/Controller/Workshop/DeleteController.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Workshop;
+
+use App\Entity\Attendee;
+use App\Entity\Workshop;
+use Doctrine\ORM\EntityManagerInterface;
+use Sensio\Bundle\FrameworkExtraBundle\Configuration\Entity;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Annotation\Route;
+
+#[Route('/workshops/{identifier}/attendees/remove/{attendee_identifier}', name: 'remove_attendee_from_workshop', methods: ['POST'])]
+#[Entity('attendee', expr: 'repository.findOneByIdentifier(attendee_identifier)')]
+class RemoveAttendeeFromWorkshopController
+{
+    public function __construct(
+        private EntityManagerInterface $entityManager
+    ) {
+    }
+
+    public function __invoke(Request $request, Workshop $workshop, Attendee $attendee)
+    {
+        $workshop->removeAttendee($attendee);
+
+        $this->entityManager->flush();
+
+        return new Response(null, Response::HTTP_NO_CONTENT);
+    }
+}