src/EventSubscriber/PassengerAppAvailabilitySubscriber.php line 49

Open in your IDE?
  1. <?php
  3. namespace App\EventSubscriber;
  5. use App\Repository\Bus\PassengerAppSettingRepository;
  6. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  7. use Symfony\Component\HttpFoundation\JsonResponse;
  8. use Symfony\Component\HttpFoundation\Response;
  9. use Symfony\Component\HttpKernel\Event\RequestEvent;
  10. use Symfony\Component\HttpKernel\KernelEvents;
  11. use Symfony\Component\Security\Core\Security;
  13. /**
  14. * Gates the public passenger app out of /bus_api when it's been switched
  15. * off (App\Entity\Bus\PassengerAppSetting), without touching clerk/staff
  16. * traffic on the same routes:
  17. *
  18. * - the Courier Android app's counter-booking flow always sends the
  19. * custom `Auth` JWT header (see BusApi\BookingController::resolveAuthenticatedUser())
  20. * - the web admin (e.g. managing fare rules) is authenticated via the
  21. * session-based `main` firewall, i.e. Security::getUser() is set
  22. * - the public app's checkout flow sends neither - that's the only
  23. * traffic this blocks
  24. *
  25. * Safaricom's M-Pesa callback is exempted by route name since it's neither
  26. * of the above and must always be processed to keep payment/booking state
  27. * consistent regardless of the switch.
  28. */
  29. class PassengerAppAvailabilitySubscriber implements EventSubscriberInterface
  30. {
  31. private const EXEMPT_ROUTES = ['bookingMpesaCallback'];
  33. private PassengerAppSettingRepository $settingRepository;
  34. private Security $security;
  36. public function __construct(PassengerAppSettingRepository $settingRepository, Security $security)
  37. {
  38. $this->settingRepository = $settingRepository;
  39. $this->security = $security;
  40. }
  42. public static function getSubscribedEvents(): array
  43. {
  44. return [
  45. KernelEvents::REQUEST => 'onKernelRequest',
  46. ];
  47. }
  49. public function onKernelRequest(RequestEvent $event): void
  50. {
  51. if (!$event->isMainRequest()) {
  52. return;
  53. }
  55. $request = $event->getRequest();
  56. if (strpos($request->getPathInfo(), '/bus_api') !== 0) {
  57. return;
  58. }
  60. if (in_array($request->attributes->get('_route'), self::EXEMPT_ROUTES, true)) {
  61. return;
  62. }
  64. if ($request->headers->get('Auth') || $this->security->getUser()) {
  65. return;
  66. }
  68. $setting = $this->settingRepository->getCurrent();
  69. if ($setting->isEnabled()) {
  70. return;
  71. }
  73. $event->setResponse(new JsonResponse([
  74. 'error' => 'BOOKING_UNAVAILABLE',
  75. 'message' => $setting->getDisabledMessage()
  76. ?: 'Online booking is temporarily unavailable. Please visit a station counter to book your seat.',
  77. ], Response::HTTP_SERVICE_UNAVAILABLE));
  78. }
  79. }