Redirección personalizada cuando "Email no verificado"

Solved! Sorry, my mistake. Wrong typing in construct ...

it happens ;)

Cheers and happy coding!

Note this is some legacy code from a proof of concept I built a while back. I tested moving it into the CheckVerifiedUserSubscriber subscribed events and that seems to work fine. Not sure it makes sense to wrap this into that class given that event is more broad in potential use but I'm guessing it would be best to keep the work happening on each request to a minimum.

Hey Chris

Could you tell me more info about the error. What error message did you get? Does it happen on every request? If so, there must be something wrong in your authenticator's supports() method

Cheers!

Hi MolloKhan !

Thanks for replying me !
I will try to explain with my bad english my problem 😅

So, I installed the bundle verify-email-bundle : https://github.com/SymfonyCasts/verify-email-bundle on my project. It's work fine ! Cool !

But a user not verified can log in. There is not a deny access for the not verified user.

Therefore, I found your tuto and I'm trying to develop it in my project.

It's OK, all users not verified are redirect to the resending email confirmation page "/verify/resend_email".
But, when users come from the link of the email confirmation, they are rejected too after logging in.
"An authentication exception occurred."
This link needs user to log in before being verified.

/eventSubscriber/CheckVerifiedUserSubscriber.php :

`
class CheckVerifiedUserSubscriber implements EventSubscriberInterface
{

private RouterInterface $router;
private RequestStack $requestStack;

public function __construct(RouterInterface $router, RequestStack $requestStack)
{
    $this->router = $router;
    $this->requestStack = $requestStack;
}

public function onCheckPassport(CheckPassportEvent $event)
{
    $passport = $event->getPassport();

    $user = $passport->getUser();
    if (!$user instanceof User) {
        throw new \Exception('Unexpected user type');
    }

    //Si l'utilisateur n'est pas vérifié, l'authentification échoue
    if (!$user->isVerified()) {
        throw new AccountNotVerifiedAuthenticationException;
    }
}

public function onLoginFailure(LoginFailureEvent $event)
{
    if (!$event->getException() instanceof AccountNotVerifiedAuthenticationException) {
        return;
    }

    $request = $this->requestStack->getCurrentRequest();
    $targetPath = $request->getSession()->get('_security.main.target_path');
    // dd($targetPath);
    if (strpos($targetPath, '/verify/email?') !== false) {
        return new RedirectResponse($targetPath);
    } else {
        $passport = $event->getPassport();

        $user = $passport->getUser();
        if (!$user instanceof User) {
            throw new \Exception('Unexpected user type');
        }

        $email = $user->getEmail();
        $request->getSession()->set('non_verified_email', $email);

        $response = new RedirectResponse(
            $this->router->generate('app_verify_resend_email')
        );
        $event->setResponse($response);
    }
}

public static function getSubscribedEvents()
{
    return [
        CheckPassportEvent::class => ['onCheckPassport', -10],
        LoginFailureEvent::class => 'onLoginFailure',
    ];
}

}`

src/Controller/RegistrationController.php :

`
#[Route('/verify/resend_email', name: 'app_verify_resend_email')]

public function resendVerifyEmail(Request $request, UserRepository $userRepository)
{
    if ($request->isMethod('POST')) {
        $email = $request->getSession()->get('non_verified_email');
        $user = $userRepository->findOneBy(['email' => $email]);
        if (!$user) {
            throw $this->createNotFoundException('user not found for email');
        }
        // generate a signed url and email it to the user
        $this->emailVerifier->sendEmailConfirmation(
            'app_verify_email',
            $user,
            (new TemplatedEmail())
                ->from(new Address($_ENV['MAILER_USER'], 'Avisa Partners'))
                ->to($user->getEmail())
                ->subject('Please Confirm your Email')
                ->htmlTemplate('registration/confirmation_email.html.twig')
        );

        $this->addFlash('success', 'An email has been sended to you. Please click on the link into.');

        return $this->redirectToRoute('app_home');
    }

    return $this->render('registration/resend_verify_email.html.twig');
}

`

Do you have an idea for bypass the onLoginFailure when the user click on the link of the confirmation email ?
Because I don't want bypass the log in form before verification for security.

I hope to be understandable 🙏🏻😬

Thanks !

Maybe the only way is to verify their email address without having to be authenticated ?
What do you think ? 😑

Hey Chris

I noticed the bundle support both ways, validating anon and logged in users. You need to decide first what method you want to leverage and then add the code shown in their docs https://github.com/SymfonyC...

I hope it helps. Cheers!

Hey MolloKhan !

Yes I fixed my issue with the anonymous validation. It's Ok now :)

Thanks for your help !

Cheers !

Hey Leonel D. !

Fair enough :). Here is what I would do:

A) From inside of CheckVerifiedUserSubscriber - https://symfonycasts.com/screencast/symfony-security/login-failure#codeblock-d5a84a00cc - inside of onLoginFailure(), I would set the email of the user into the session. Something like:

public function onLoginFailure(LoginFailureEvent $event)
{
    if (!$event->getException() instanceof AccountNotVerifiedAuthenticationException) {
        return;
    }

    // ADD these 3 lines!
    $request = $event->getRequest();
    $email = $event->getPassport()->getUser()->getEmail();
    $request->getSession()->set('non_verified_email', $email);
    
    $response = new RedirectResponse(
        $this->router->generate('app_verify_resend_email')
    );
    $event->setResponse($response);
}

Then, in resend_verify_email.html.twig, for the "Re-Send Email" link, I would actually make that form with a button so that it POSTs back to the controller when pressed:

<form method="POST">
    <button type="submit" class="btn btn-primary">Re-send Email</button>
</form>

Finally, in the resendVerifyEmail() controller method, IF the method is POST, let's re-send the email:

/**
 * @Route("/verify/resend", name="app_verify_resend_email")
 */
public function resendVerifyEmail(Request $request, VerifyEmailHelperInterface $verifyEmailHelper, UserRepository $userRepository)
{
    if ($request->isMethod('POST')) {
         // resend the email here
         // probably, you will want to centralize all of this logic
         // into a service so you can call it from here and also
         // from RegistrationController after a successful registration

        $email = $request->getSession()->get('non_verified_email');
        $user = $userRepository->findOneBy(['email' => $email]);
        if (!$user) {
            throw $this->createNotFoundException('user not found for email');
        }

         $signatureComponents = $verifyEmailHelper->generateSignature(
             'app_verify_email',
             $user->getId(),
             $user->getEmail(),
             ['id' => $user->getId()]
         );

        // TODO: in a real app, send this as an email!
        $this->addFlash('success', 'Confirm your email at: '.$signatureComponents->getSignedUrl());

        return $this->redirectToRoute('app_homepage');
    }

    return $this->render('registration/resend_verify_email.html.twig');
}

Let me know if this helps :).

Cheers!

Thanks for sharing your approach.

I have got one thing to add:

In CheckVerifiedUserSubscriber class you have to add RequestStack $requestRequeststack to the Constructor so that you can use the current Request in the method of the subscriber via $request = $this->requestStack->getCurrentRequest();

Then I also got a question. How can I get the User in the resendVerifyEmail(9 controller method?

Since we are not verified at this point, we can NOT use the controllers $this->getUser() helper an can not access the private non_verified_email property of the session, or am I wrong?

Thanks!

Hey Tristan P.!

In CheckVerifiedUserSubscriber class you have to add RequestStack $requestRequeststack to the Constructor so that you can use the current Request in the method of the subscriber via $request = $this->requestStack->getCurrentRequest();

Ah, you're right! Thank you - I updated my code above. Actually, you can get the Request even easier with $event->getRequest() on this case.

And, I can see that you answered your other question, but I can see that it wasn't clear in my code. I'll update that as well!

Cheers!

Ok, I am sorry. I can of course get the user in the controller method, I just have get the email from the session via

`

$session->get('non_verified_email');

`

Then I can use the repo to get the user.

I just hat a typo when trying to get the property from the session

Hey there!

Sounds good! But because the last username is in session and it's not robust solution probably. If the users is authenticated - you can try to get it from the controller. If you extends the Symfony abstract controller - you can get the current user with getUser() call. Otherwise, you can inject the Security service that will bring you the same getUser() method to fetch. the currently authenticated user object.

Cheers!

Hey Khaled L.!

That's a really good question! A simple solution would be to, from the subscriber we create, store the user's id into the session. Then in the resend action, read it from the session (404 if nothing is there), query for the User and re-send the email.

Cheers!

Hi...Works pretty fine. Thanks !