Create API controllers structure with JWT auth and sandbox fixtures
Controllers: - ApiAuthController: POST /api/auth/login with JWT generation (HS256, 24h TTL) - Validates email + password against DB - Returns JWT token with userId, email, roles, iat, exp - Static verifyJwt() for use by live/sandbox controllers - Only ROLE_ORGANIZER can authenticate - ApiLiveController: empty shell at /api/live (routes to implement) - ApiSandboxController: empty shell at /api/sandbox (routes to implement) Auth is shared: one /api/auth/login for both environments using real credentials. Sandbox fixtures (data/sandbox/fixtures.json): - 2 events (Brocante + Convention Cosplay) - 4 categories across events - 6 billets with varied types (billet, reservation_brocante) - 6 billet details with descriptions, images, categories, events - 4 scan results (2 accepted, 2 refused with different reasons) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Serreau Jovann
296
data/sandbox/fixtures.json
Normal file
296
data/sandbox/fixtures.json
Normal file
@@ -0,0 +1,296 @@
|
||||
{
|
||||
"events": [
|
||||
{
|
||||
"id": 1,
|
||||
"title": "Brocante de Printemps 2026",
|
||||
"description": "Grande brocante annuelle en plein air avec plus de 200 exposants.",
|
||||
"startAt": "2026-06-15T08:00:00",
|
||||
"endAt": "2026-06-15T18:00:00",
|
||||
"address": "Place de la Republique",
|
||||
"zipcode": "75003",
|
||||
"city": "Paris",
|
||||
"isOnline": true,
|
||||
"isSecret": false,
|
||||
"imageUrl": null
|
||||
},
|
||||
{
|
||||
"id": 2,
|
||||
"title": "Convention Cosplay Ete",
|
||||
"description": "Convention cosplay avec concours, stands et animations.",
|
||||
"startAt": "2026-08-20T10:00:00",
|
||||
"endAt": "2026-08-21T19:00:00",
|
||||
"address": "Parc des Expositions",
|
||||
"zipcode": "02800",
|
||||
"city": "Beautor",
|
||||
"isOnline": true,
|
||||
"isSecret": false,
|
||||
"imageUrl": "https://ticket.e-cosplay.fr/demo/convention.jpg"
|
||||
}
|
||||
],
|
||||
"categories": {
|
||||
"1": [
|
||||
{
|
||||
"id": 1,
|
||||
"name": "Entrees",
|
||||
"position": 0,
|
||||
"startAt": "2026-05-01T00:00:00",
|
||||
"endAt": "2026-06-15T18:00:00",
|
||||
"isHidden": false,
|
||||
"isActive": true
|
||||
},
|
||||
{
|
||||
"id": 2,
|
||||
"name": "Reservations Brocante",
|
||||
"position": 1,
|
||||
"startAt": "2026-04-01T00:00:00",
|
||||
"endAt": "2026-06-10T23:59:00",
|
||||
"isHidden": false,
|
||||
"isActive": true
|
||||
}
|
||||
],
|
||||
"2": [
|
||||
{
|
||||
"id": 3,
|
||||
"name": "General",
|
||||
"position": 0,
|
||||
"startAt": "2026-07-01T00:00:00",
|
||||
"endAt": "2026-08-21T19:00:00",
|
||||
"isHidden": false,
|
||||
"isActive": true
|
||||
},
|
||||
{
|
||||
"id": 4,
|
||||
"name": "VIP",
|
||||
"position": 1,
|
||||
"startAt": "2026-07-01T00:00:00",
|
||||
"endAt": "2026-08-15T23:59:00",
|
||||
"isHidden": false,
|
||||
"isActive": true
|
||||
}
|
||||
]
|
||||
},
|
||||
"billets": {
|
||||
"1": [
|
||||
{
|
||||
"id": 1,
|
||||
"name": "Entree Adulte",
|
||||
"priceHT": 500,
|
||||
"quantity": 500,
|
||||
"sold": 312,
|
||||
"type": "billet",
|
||||
"isGeneratedBillet": true,
|
||||
"notBuyable": false,
|
||||
"position": 0
|
||||
},
|
||||
{
|
||||
"id": 2,
|
||||
"name": "Entree Enfant (-12 ans)",
|
||||
"priceHT": 0,
|
||||
"quantity": null,
|
||||
"sold": 145,
|
||||
"type": "billet",
|
||||
"isGeneratedBillet": true,
|
||||
"notBuyable": false,
|
||||
"position": 1
|
||||
}
|
||||
],
|
||||
"2": [
|
||||
{
|
||||
"id": 3,
|
||||
"name": "Emplacement 3m",
|
||||
"priceHT": 1500,
|
||||
"quantity": 80,
|
||||
"sold": 72,
|
||||
"type": "reservation_brocante",
|
||||
"isGeneratedBillet": false,
|
||||
"notBuyable": false,
|
||||
"position": 0
|
||||
}
|
||||
],
|
||||
"3": [
|
||||
{
|
||||
"id": 4,
|
||||
"name": "Pass 2 jours",
|
||||
"priceHT": 2000,
|
||||
"quantity": 300,
|
||||
"sold": 189,
|
||||
"type": "billet",
|
||||
"isGeneratedBillet": true,
|
||||
"notBuyable": false,
|
||||
"position": 0
|
||||
},
|
||||
{
|
||||
"id": 5,
|
||||
"name": "Pass 1 jour Samedi",
|
||||
"priceHT": 1200,
|
||||
"quantity": 200,
|
||||
"sold": 156,
|
||||
"type": "billet",
|
||||
"isGeneratedBillet": true,
|
||||
"notBuyable": false,
|
||||
"position": 1
|
||||
}
|
||||
],
|
||||
"4": [
|
||||
{
|
||||
"id": 6,
|
||||
"name": "Pass VIP 2 jours",
|
||||
"priceHT": 5000,
|
||||
"quantity": 30,
|
||||
"sold": 28,
|
||||
"type": "billet",
|
||||
"isGeneratedBillet": true,
|
||||
"notBuyable": false,
|
||||
"position": 0
|
||||
}
|
||||
]
|
||||
},
|
||||
"billetDetails": {
|
||||
"1": {
|
||||
"id": 1,
|
||||
"name": "Entree Adulte",
|
||||
"description": "Entree standard pour les adultes. Billet electronique avec QR code.",
|
||||
"priceHT": 500,
|
||||
"quantity": 500,
|
||||
"sold": 312,
|
||||
"type": "billet",
|
||||
"isGeneratedBillet": true,
|
||||
"hasDefinedExit": false,
|
||||
"notBuyable": false,
|
||||
"position": 0,
|
||||
"imageUrl": null,
|
||||
"category": {"id": 1, "name": "Entrees"},
|
||||
"event": {"id": 1, "title": "Brocante de Printemps 2026"}
|
||||
},
|
||||
"2": {
|
||||
"id": 2,
|
||||
"name": "Entree Enfant (-12 ans)",
|
||||
"description": "Gratuit pour les enfants de moins de 12 ans.",
|
||||
"priceHT": 0,
|
||||
"quantity": null,
|
||||
"sold": 145,
|
||||
"type": "billet",
|
||||
"isGeneratedBillet": true,
|
||||
"hasDefinedExit": false,
|
||||
"notBuyable": false,
|
||||
"position": 1,
|
||||
"imageUrl": null,
|
||||
"category": {"id": 1, "name": "Entrees"},
|
||||
"event": {"id": 1, "title": "Brocante de Printemps 2026"}
|
||||
},
|
||||
"3": {
|
||||
"id": 3,
|
||||
"name": "Emplacement 3m",
|
||||
"description": "Emplacement de 3 metres lineaires pour exposant.",
|
||||
"priceHT": 1500,
|
||||
"quantity": 80,
|
||||
"sold": 72,
|
||||
"type": "reservation_brocante",
|
||||
"isGeneratedBillet": false,
|
||||
"hasDefinedExit": false,
|
||||
"notBuyable": false,
|
||||
"position": 0,
|
||||
"imageUrl": null,
|
||||
"category": {"id": 2, "name": "Reservations Brocante"},
|
||||
"event": {"id": 1, "title": "Brocante de Printemps 2026"}
|
||||
},
|
||||
"4": {
|
||||
"id": 4,
|
||||
"name": "Pass 2 jours",
|
||||
"description": "Acces aux 2 jours de la convention.",
|
||||
"priceHT": 2000,
|
||||
"quantity": 300,
|
||||
"sold": 189,
|
||||
"type": "billet",
|
||||
"isGeneratedBillet": true,
|
||||
"hasDefinedExit": true,
|
||||
"notBuyable": false,
|
||||
"position": 0,
|
||||
"imageUrl": "https://ticket.e-cosplay.fr/demo/pass-2j.jpg",
|
||||
"category": {"id": 3, "name": "General"},
|
||||
"event": {"id": 2, "title": "Convention Cosplay Ete"}
|
||||
},
|
||||
"5": {
|
||||
"id": 5,
|
||||
"name": "Pass 1 jour Samedi",
|
||||
"description": "Acces le samedi uniquement.",
|
||||
"priceHT": 1200,
|
||||
"quantity": 200,
|
||||
"sold": 156,
|
||||
"type": "billet",
|
||||
"isGeneratedBillet": true,
|
||||
"hasDefinedExit": true,
|
||||
"notBuyable": false,
|
||||
"position": 1,
|
||||
"imageUrl": null,
|
||||
"category": {"id": 3, "name": "General"},
|
||||
"event": {"id": 2, "title": "Convention Cosplay Ete"}
|
||||
},
|
||||
"6": {
|
||||
"id": 6,
|
||||
"name": "Pass VIP 2 jours",
|
||||
"description": "Acces VIP avec espace dedie, boissons et rencontre artistes.",
|
||||
"priceHT": 5000,
|
||||
"quantity": 30,
|
||||
"sold": 28,
|
||||
"type": "billet",
|
||||
"isGeneratedBillet": true,
|
||||
"hasDefinedExit": true,
|
||||
"notBuyable": false,
|
||||
"position": 0,
|
||||
"imageUrl": "https://ticket.e-cosplay.fr/demo/vip.jpg",
|
||||
"category": {"id": 4, "name": "VIP"},
|
||||
"event": {"id": 2, "title": "Convention Cosplay Ete"}
|
||||
}
|
||||
},
|
||||
"scan": {
|
||||
"ETICKET-DEMO-0001-AAAA": {
|
||||
"state": "accepted",
|
||||
"reason": null,
|
||||
"reference": "ETICKET-DEMO-0001-AAAA",
|
||||
"billetName": "Pass 2 jours",
|
||||
"buyerFirstName": "Jean",
|
||||
"buyerLastName": "Dupont",
|
||||
"isInvitation": false,
|
||||
"firstScannedAt": null,
|
||||
"hasDefinedExit": true,
|
||||
"details": {}
|
||||
},
|
||||
"ETICKET-DEMO-0002-BBBB": {
|
||||
"state": "refused",
|
||||
"reason": "already_scanned",
|
||||
"reference": "ETICKET-DEMO-0002-BBBB",
|
||||
"billetName": "Entree Adulte",
|
||||
"buyerFirstName": "Marie",
|
||||
"buyerLastName": "Martin",
|
||||
"isInvitation": false,
|
||||
"firstScannedAt": "2026-06-15T09:30:00",
|
||||
"hasDefinedExit": false,
|
||||
"details": null
|
||||
},
|
||||
"ETICKET-DEMO-0003-CCCC": {
|
||||
"state": "refused",
|
||||
"reason": "invalid",
|
||||
"reference": "ETICKET-DEMO-0003-CCCC",
|
||||
"billetName": "Pass VIP 2 jours",
|
||||
"buyerFirstName": "Pierre",
|
||||
"buyerLastName": "Durand",
|
||||
"isInvitation": false,
|
||||
"firstScannedAt": null,
|
||||
"hasDefinedExit": true,
|
||||
"details": null
|
||||
},
|
||||
"ETICKET-DEMO-0004-DDDD": {
|
||||
"state": "accepted",
|
||||
"reason": null,
|
||||
"reference": "ETICKET-DEMO-0004-DDDD",
|
||||
"billetName": "Pass 1 jour Samedi",
|
||||
"buyerFirstName": "Sophie",
|
||||
"buyerLastName": "Bernard",
|
||||
"isInvitation": true,
|
||||
"firstScannedAt": null,
|
||||
"hasDefinedExit": true,
|
||||
"details": {}
|
||||
}
|
||||
}
|
||||
}
|
||||
118
src/Controller/Api/ApiAuthController.php
Normal file
118
src/Controller/Api/ApiAuthController.php
Normal file
@@ -0,0 +1,118 @@
|
||||
<?php
|
||||
|
||||
namespace App\Controller\Api;
|
||||
|
||||
use App\Entity\User;
|
||||
use Doctrine\ORM\EntityManagerInterface;
|
||||
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
|
||||
use Symfony\Component\DependencyInjection\Attribute\Autowire;
|
||||
use Symfony\Component\HttpFoundation\JsonResponse;
|
||||
use Symfony\Component\HttpFoundation\Request;
|
||||
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
|
||||
use Symfony\Component\Routing\Attribute\Route;
|
||||
|
||||
#[Route('/api/auth')]
|
||||
class ApiAuthController extends AbstractController
|
||||
{
|
||||
private const JWT_TTL = 86400; // 24h
|
||||
|
||||
#[Route('/login', name: 'app_api_auth_login', methods: ['POST'])]
|
||||
public function login(
|
||||
Request $request,
|
||||
EntityManagerInterface $em,
|
||||
UserPasswordHasherInterface $passwordHasher,
|
||||
#[Autowire('%kernel.secret%')] string $appSecret,
|
||||
): JsonResponse {
|
||||
$data = json_decode($request->getContent(), true);
|
||||
$email = $data['email'] ?? '';
|
||||
$password = $data['password'] ?? '';
|
||||
|
||||
if ('' === $email || '' === $password) {
|
||||
return $this->json(['success' => false, 'data' => null, 'error' => 'Email et mot de passe requis.'], 400);
|
||||
}
|
||||
|
||||
$user = $em->getRepository(User::class)->findOneBy(['email' => $email]);
|
||||
|
||||
if (!$user || !$passwordHasher->isPasswordValid($user, $password)) {
|
||||
return $this->json(['success' => false, 'data' => null, 'error' => 'Identifiants invalides.'], 401);
|
||||
}
|
||||
|
||||
if (!\in_array('ROLE_ORGANIZER', $user->getRoles(), true)) {
|
||||
return $this->json(['success' => false, 'data' => null, 'error' => 'Acces reserve aux organisateurs.'], 403);
|
||||
}
|
||||
|
||||
$token = $this->generateJwt($user, $appSecret);
|
||||
$expiresAt = (new \DateTimeImmutable())->modify('+'.self::JWT_TTL.' seconds');
|
||||
|
||||
return $this->json([
|
||||
'success' => true,
|
||||
'data' => [
|
||||
'token' => $token,
|
||||
'expiresAt' => $expiresAt->format(\DateTimeInterface::ATOM),
|
||||
],
|
||||
'error' => null,
|
||||
]);
|
||||
}
|
||||
|
||||
public static function verifyJwt(string $token, string $email, string $appSecret): ?int
|
||||
{
|
||||
$parts = explode('.', $token);
|
||||
if (3 !== \count($parts)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
[$headerB64, $payloadB64, $signatureB64] = $parts;
|
||||
|
||||
$expectedSignature = self::base64UrlEncode(
|
||||
hash_hmac('sha256', $headerB64.'.'.$payloadB64, $appSecret, true)
|
||||
);
|
||||
|
||||
if (!hash_equals($expectedSignature, $signatureB64)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$payload = json_decode(self::base64UrlDecode($payloadB64), true);
|
||||
if (!$payload) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (($payload['exp'] ?? 0) < time()) {
|
||||
return null;
|
||||
}
|
||||
|
||||
if (($payload['email'] ?? '') !== $email) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return $payload['userId'] ?? null;
|
||||
}
|
||||
|
||||
private function generateJwt(User $user, string $appSecret): string
|
||||
{
|
||||
$header = self::base64UrlEncode(json_encode(['alg' => 'HS256', 'typ' => 'JWT']));
|
||||
|
||||
$payload = self::base64UrlEncode(json_encode([
|
||||
'userId' => $user->getId(),
|
||||
'email' => $user->getEmail(),
|
||||
'roles' => $user->getRoles(),
|
||||
'iat' => time(),
|
||||
'exp' => time() + self::JWT_TTL,
|
||||
]));
|
||||
|
||||
$signature = self::base64UrlEncode(
|
||||
hash_hmac('sha256', $header.'.'.$payload, $appSecret, true)
|
||||
);
|
||||
|
||||
return $header.'.'.$payload.'.'.$signature;
|
||||
}
|
||||
|
||||
private static function base64UrlEncode(string $data): string
|
||||
{
|
||||
return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
|
||||
}
|
||||
|
||||
private static function base64UrlDecode(string $data): string
|
||||
{
|
||||
return base64_decode(strtr($data, '-_', '+/'), true) ?: '';
|
||||
}
|
||||
}
|
||||
11
src/Controller/Api/ApiLiveController.php
Normal file
11
src/Controller/Api/ApiLiveController.php
Normal file
@@ -0,0 +1,11 @@
|
||||
<?php
|
||||
|
||||
namespace App\Controller\Api;
|
||||
|
||||
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
|
||||
use Symfony\Component\Routing\Attribute\Route;
|
||||
|
||||
#[Route('/api/live')]
|
||||
class ApiLiveController extends AbstractController
|
||||
{
|
||||
}
|
||||
11
src/Controller/Api/ApiSandboxController.php
Normal file
11
src/Controller/Api/ApiSandboxController.php
Normal file
@@ -0,0 +1,11 @@
|
||||
<?php
|
||||
|
||||
namespace App\Controller\Api;
|
||||
|
||||
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
|
||||
use Symfony\Component\Routing\Attribute\Route;
|
||||
|
||||
#[Route('/api/sandbox')]
|
||||
class ApiSandboxController extends AbstractController
|
||||
{
|
||||
}
|
||||
Reference in New Issue
Block a user