chg: usr: add forgot password functionality #4

src/Controller/SecurityController.php

@@ -11,6 +11,8 @@
 namespace App\Controller;
 
 use App\Entity\User;
+use App\Repository\UserRepository;
+use DateTime;
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bridge\Twig\Mime\TemplatedEmail;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
@@ -137,6 +139,99 @@ class SecurityController extends AbstractController
         ]);
     }
 
+    #[Route('/forgot-password', name: 'MineSeekerBundle_forgot_password')]
+    public function forgotPassword(
+        Request $request,
+        UserRepository $userRepository,
+        EntityManagerInterface $em,
+        MailerInterface $mailer,
+    ): Response {
+        if ($this->getUser()) {
+            return $this->redirectToRoute('MineSeekerBundle_homepage');
+        }
+
+        if ($request->isMethod('POST')) {
+            $email = trim((string) $request->request->get('_email', ''));
+            $user  = $userRepository->findOneByEmail($email);
+
+            if ($user && $user->isVerified()) {
+                $token = bin2hex(random_bytes(32));
+                $user
+                    ->setResetToken($token)
+                    ->setResetTokenExpiresAt(new DateTime('+1 hour'));
+                $em->flush();
+
+                $resetUrl = $this->generateUrl(
+                    'MineSeekerBundle_reset_password',
+                    ['token' => $token],
+                    UrlGeneratorInterface::ABSOLUTE_URL,
+                );
+
+                $mailer->send(
+                    new TemplatedEmail()
+                        ->from('noreply@mineseeker.ninja')
+                        ->to($email)
+                        ->subject('Reset your MineSeeker password')
+                        ->htmlTemplate('emails/reset_password.html.twig')
+                        ->context([
+                            'username'  => $user->getUsername(),
+                            'reset_url' => $resetUrl,
+                        ])
+                );
+            }
+
+            // Always show the same flash to prevent email enumeration
+            $this->addFlash('reset_sent', $email);
+
+            return $this->redirectToRoute('MineSeekerBundle_forgot_password');
+        }
+
+        return $this->render('Security/forgot_password.html.twig');
+    }
+
+    #[Route('/reset-password/{token}', name: 'MineSeekerBundle_reset_password')]
+    public function resetPassword(
+        string $token,
+        Request $request,
+        UserRepository $userRepository,
+        EntityManagerInterface $em,
+        UserPasswordHasherInterface $hasher,
+    ): Response {
+        $user = $userRepository->findOneByResetToken($token);
+
+        if (!$user || $user->getResetTokenExpiresAt() < new DateTime()) {
+            $this->addFlash('error', 'This password reset link is invalid or has expired.');
+            return $this->redirectToRoute('MineSeekerBundle_forgot_password');
+        }
+
+        $errors = [];
+
+        if ($request->isMethod('POST')) {
+            $password        = (string) $request->request->get('_password', '');
+            $passwordConfirm = (string) $request->request->get('_password_confirm', '');
+
+            if (mb_strlen($password) < 6) {
+                $errors['password'] = 'Password must be at least 6 characters.';
+            } elseif ($password !== $passwordConfirm) {
+                $errors['password_confirm'] = 'Passwords do not match.';
+            }
+
+            if (empty($errors)) {
+                $user
+                    ->setPassword($hasher->hashPassword($user, $password))
+                    ->setResetToken(null)
+                    ->setResetTokenExpiresAt(null);
+                $em->flush();
+
+                $this->addFlash('success', 'Your password has been reset. You can now sign in.');
+
+                return $this->redirectToRoute('MineSeekerBundle_login');
+            }
+        }
+
+        return $this->render('Security/reset_password.html.twig', ['errors' => $errors]);
+    }
+
     #[Route('/activate/{token}', name: 'MineSeekerBundle_activate')]
     public function activate(string $token, EntityManagerInterface $em): Response
     {