Frank
3c58e153dc
Fixes the 500 on admin user deletion: deleting a user with an email_log row (i.e. basically anyone who received any email) hit an unhandled ForeignKeyConstraintViolationException, since email_log, reset_password_request and player all have non-nullable FKs to user with no cascade at the DB level. Instead of cascading the delete (which would be fine for email_log and reset_password_request but risky for player - removing a player row could corrupt other real players' session state), admin delete now sets a deletedAt timestamp instead of removing the row: - UserChecker blocks login for deleted users (checkPreAuth). - EmailLoggerListener rejects the message before send for deleted recipients (checked at actual send time, not at queue time). - Added a last_login_at column + a LoginSuccessEvent listener to populate it, and surfaced both last login and status in the admin users list. Added `app:users:purge-deleted`, a command intended to run on a schedule that permanently removes users who were soft-deleted more than 3 months ago and never played a game (join to Player via a NOT EXISTS subquery). For that eventual hard-delete to actually succeed, email_log and reset_password_request now cascade-delete at the DB level (migration drops+recreates both FK constraints with ON DELETE CASCADE) - player intentionally still isn't cascaded, so a user with game history can never be purged this way even by mistake.
79 lines
2.7 KiB
PHP
79 lines
2.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Game\Controller;
|
|
|
|
use App\Tech\Entity\User;
|
|
use App\Tech\Form\AdminUserType;
|
|
use App\Tech\Repository\UserRepository;
|
|
use Doctrine\ORM\EntityManagerInterface;
|
|
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
|
|
use Symfony\Component\HttpFoundation\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
|
|
use Symfony\Component\Routing\Annotation\Route;
|
|
use Symfony\Component\Security\Http\Attribute\IsGranted;
|
|
|
|
#[Route('/admin/users')]
|
|
#[IsGranted('ROLE_ADMIN')]
|
|
final class GameAdminUserController extends AbstractController
|
|
{
|
|
#[Route('', name: 'game_admin_users', methods: ['GET'])]
|
|
public function index(UserRepository $userRepository): Response
|
|
{
|
|
$users = $userRepository->findBy([], ['id' => 'ASC']);
|
|
|
|
return $this->render('game/admin/users/index.html.twig', [
|
|
'users' => $users,
|
|
'marketingOptInCount' => count(array_filter($users, static fn (User $user) => $user->isMarketingOptIn())),
|
|
]);
|
|
}
|
|
|
|
#[Route('/{id}/edit', name: 'game_admin_user_edit', methods: ['GET', 'POST'])]
|
|
public function edit(
|
|
User $user,
|
|
Request $request,
|
|
EntityManagerInterface $em,
|
|
UserPasswordHasherInterface $passwordHasher,
|
|
): Response {
|
|
$form = $this->createForm(AdminUserType::class, $user);
|
|
$form->handleRequest($request);
|
|
|
|
if ($form->isSubmitted() && $form->isValid()) {
|
|
$plainPassword = $form->get('plainPassword')->getData();
|
|
if ($plainPassword) {
|
|
$user->setPassword($passwordHasher->hashPassword($user, $plainPassword));
|
|
}
|
|
|
|
$em->flush();
|
|
$this->addFlash('success', sprintf('User "%s" updated.', $user->getUsername()));
|
|
|
|
return $this->redirectToRoute('game_admin_users');
|
|
}
|
|
|
|
return $this->render('game/admin/users/edit.html.twig', [
|
|
'user' => $user,
|
|
'form' => $form,
|
|
]);
|
|
}
|
|
|
|
#[Route('/{id}/delete', name: 'game_admin_user_delete', methods: ['POST'])]
|
|
public function delete(User $user, Request $request, EntityManagerInterface $em): Response
|
|
{
|
|
if (!$this->isCsrfTokenValid('delete_user_' . $user->getId(), $request->request->get('_token'))) {
|
|
$this->addFlash('danger', 'Invalid CSRF token.');
|
|
return $this->redirectToRoute('game_admin_users');
|
|
}
|
|
|
|
if (!$user->isDeleted()) {
|
|
$user->setDeletedAt(new \DateTimeImmutable());
|
|
$em->flush();
|
|
}
|
|
|
|
$this->addFlash('success', sprintf('User "%s" deleted.', $user->getUsername()));
|
|
|
|
return $this->redirectToRoute('game_admin_users');
|
|
}
|
|
}
|