Sylius认证代码位置查询及登录事件扩展需求咨询

Locating Sylius Authentication Code #

Sylius is built on Symfony's Security Component, so authentication logic combines Symfony core functionality with Sylius-specific extensions. Key locations to check:

• Security Configuration: The main setup lives in config/packages/security.yaml, where you’ll find firewalls for shop and admin sections, defining login paths, user providers, and authentication methods.
• Login Controllers:
  • Shop user login handling: vendor/sylius/sylius/src/Sylius/Bundle/ShopBundle/Controller/SecurityController.php
  • Admin user login handling: vendor/sylius/sylius/src/Sylius/Bundle/AdminBundle/Controller/SecurityController.php
• User Providers: Sylius uses custom providers to load users from the database. Check vendor/sylius/sylius/src/Sylius/Component/Core/Security/UserProvider/ShopUserProvider.php (and the equivalent AdminUserProvider for admin accounts).
• Sylius Security Extensions: Custom security logic (like user impersonation, password reset flows) is in vendor/sylius/sylius/src/Sylius/Component/Security.
• Symfony Core Security: For low-level password validation flow, refer to Symfony’s core classes in vendor/symfony/security-guard (Sylius uses Symfony’s Guard authenticator system by default).

Adding Custom Action on Login (e.g., Admin Notification) #

Instead of modifying core Sylius code, use Symfony’s security events to hook into the authentication flow. Here’s how to send an admin notification when a user successfully logs in (after password validation):

Step 1: Create an Event Subscriber #

Make a subscriber class in your src/EventSubscriber directory:

<?php

namespace App\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\Security\Core\AuthenticationEvents;
use Symfony\Component\Security\Core\Event\AuthenticationSuccessEvent;
use Symfony\Component\Mailer\MailerInterface;
use Symfony\Component\Mime\Email;
use Sylius\Component\Core\Model\AdminUserInterface;

class LoginNotificationSubscriber implements EventSubscriberInterface
{
    private $mailer;
    private $adminEmail;

    public function __construct(MailerInterface $mailer, string $adminEmail)
    {
        $this->mailer = $mailer;
        $this->adminEmail = $adminEmail;
    }

    public static function getSubscribedEvents(): array
    {
        return [
            AuthenticationEvents::AUTHENTICATION_SUCCESS => 'onAuthenticationSuccess',
        ];
    }

    public function onAuthenticationSuccess(AuthenticationSuccessEvent $event): void
    {
        $user = $event->getAuthenticationToken()->getUser();
        
        // Skip admin logins if needed
        if ($user instanceof AdminUserInterface) {
            return;
        }

        // Send email to admin
        $email = (new Email())
            ->from('no-reply@yourshop.com')
            ->to($this->adminEmail)
            ->subject('New User Login')
            ->text(sprintf(
                'User %s (%s) logged in successfully at %s.',
                $user->getFullName(),
                $user->getEmail(),
                date('Y-m-d H:i:s')
            ));

        $this->mailer->send($email);
    }
}

Step 2: Register the Subscriber #

Add the subscriber to config/services.yaml:

services:
    App\EventSubscriber\LoginNotificationSubscriber:
        arguments:
            $adminEmail: '%env(ADMIN_EMAIL)%' # Define this in your .env file
        tags:
            - { name: kernel.event_subscriber }

Key Notes: #

• To trigger on failed login attempts, subscribe to AuthenticationEvents::AUTHENTICATION_FAILURE instead.
• For finer control (e.g., right after password validation but before login completes), use Symfony’s CheckPassportEvent (available in Symfony 5.4+).
• Replace the email logic with your preferred notification method (Slack message, database log, etc.) as needed.

内容的提问来源于stack exchange，提问作者Quyhn Tan Bao