Cobblestone login package
=========================

This package is used across different Cobblestone symfony projects to provide login agaist Auth0
and to hande all communication with the Cobblestone User Cloud API.

Package can be included by putting:

```
"repositories": [
    {
        "type": "composer",
        "url": "https://baggagist.peytz.dk"
    }
],
"require": {
    "cobblestone/cc-login": "vX.Y.Z"
}
```

in your composer.json file and running composer install.
 

This package is available at baggagist.pco.dk/cc-files.

We use semantic versioning (https://semver.org/) for version numbers.

Usage
=====
In confis/packages, add a file hwi_oauth with this content

```
hwi_oauth:
    firewall_names: [secured_area]
    resource_owners:
        auth0:
            type: oauth2
            class: 'Cobblestone\CcLogin\ResourceOwners\Auth0ResourceOwner'
            client_id: "%env(AUTH0_CLIENT_ID)%"
            client_secret: "%env(AUTH0_CLIENT_SECRET)%"
            base_url: "https://%env(AUTH0_DOMAIN)%"
            scope: "openid profile"
            redirect_uri: '/auth0/callback'
```

In config/services.yaml ad the following
 
```
    app.lease_service:
        class: Cobblestone\CcLogin\Service\LeaseService
        arguments: []

    app.asset_service:
        class: Cobblestone\CcLogin\Service\AssetService
        arguments: ['@app.lease_service']

    app.user_service:
        class: Cobblestone\CcLogin\Service\UserService
        arguments: []

    app.role_service:
        class: Cobblestone\CcLogin\Service\RoleService
        arguments: []

    auth.user_provider:
        class: Cobblestone\CcLogin\Security\Provider\CCUserProvider
        arguments: ['@app.asset_service', '@app.user_service', '@app.role_service', '%env(API_APPLICATION_ID)%', '%env(CLIENT_USER_CLOUD_URL)%']
        calls:
            - [setRequest, ['@request_stack']]

``` 

In config/packages/security add config for which route are protected. Example:
```
security:
    # https://symfony.com/doc/current/security.html#where-do-users-come-from-user-providers
    role_hierarchy:
        ROLE_ADMIN:       [ROLE_USER, ROLE_OAUTH_USER, ROLE_CC_EMPLOYEE]
        ROLE_SUPER_ADMIN: ROLE_ADMIN
    providers:
        hwi:
            id: auth.user_provider
    firewalls:
        dev:
            pattern: ^/(_(profiler|wdt)|css|images|js)/
            security: false
        secured_area:
            anonymous: ~
            oauth:
                resource_owners:
                    auth0: "/auth0/callback"
                login_path: /login
                use_forward: false
                failure_path: /not-verified
                default_target_path: /
                oauth_user_provider:
                    service: auth.user_provider
            logout:
                path: /auth0/logout
                target: /login

    access_control:
        - { path: ^/healthz, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/login, roles: IS_AUTHENTICATED_ANONYMOUSLY }
        - { path: ^/, roles: ROLE_CC_EMPLOYEE }
```

Lastly add the file login.html.twig to templates/bundles/HWIOauthBundle/Connect

```
<!doctype html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport"
          content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
    <meta http-equiv="X-UA-Compatible" content="ie=edge">
    <title>Document</title>
</head>
<body>

</body>
<script src="//cdn.auth0.com/js/auth0/9.5.1/auth0.min.js"></script>
<script type="text/javascript">
    var auth0js = new auth0.WebAuth({
        domain: '{{ auth0_domain }}',
        clientID: '{{ auth0_client_id }}',
        audience: 'usercloud',
        scope: 'openid email profile',
        redirectUri: '{{ app.request.getSchemeAndHttpHost() }}/auth0/callback'
    });

    auth0js.checkSession({
        responseType: 'token'
    }, function (err, result) {
        auth0js.authorize(
            {
                responseType: 'code'
            }
        );
    });
</script>
</html>
```

in config/twig.yaml  add the folloing two lines under the twig: line

```
    globals:
        auth0_domain: '%env(AUTH0_DOMAIN)%'
        auth0_client_id: '%env(AUTH0_CLIENT_ID)%'
```