add user management

src/Controller/Admin/UserController.php

@@ -0,0 +1,176 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Admin;
+
+use App\Entity\User;
+use App\Service\Admin\UserAdminService;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+#[Route('/admin/users')]
+final class UserController extends AbstractController
+{
+    #[Route('', name: 'admin_users_index', methods: ['GET'])]
+    public function index(Request $request, UserAdminService $users): Response
+    {
+        $this->denyAccessUnlessGranted('ROLE_SUPER_ADMIN');
+
+        $query = trim((string) $request->query->get('q', ''));
+        $status = (string) $request->query->get('status', 'all');
+        $role = (string) $request->query->get('role', 'all');
+        $list = $users->listUsers($query, $status, $role);
+
+        return $this->render('admin/user/index.html.twig', [
+            'users' => $list['users'],
+            'total' => $list['total'],
+            'filtered_total' => $list['filtered_total'],
+            'active_total' => $list['active_total'],
+            'inactive_total' => $list['inactive_total'],
+            'role_choices' => $users->roleChoices(),
+            'filters' => [
+                'q' => $query,
+                'status' => in_array($status, ['all', 'active', 'inactive'], true) ? $status : 'all',
+                'role' => array_key_exists($role, $users->roleChoices()) ? $role : 'all',
+            ],
+        ]);
+    }
+
+    #[Route('/create', name: 'admin_users_create', methods: ['GET', 'POST'])]
+    public function create(Request $request, UserAdminService $users): Response
+    {
+        $this->denyAccessUnlessGranted('ROLE_SUPER_ADMIN');
+
+        if (!$request->isMethod('POST')) {
+            return $this->render('admin/user/create.html.twig', [
+                'role_choices' => $users->roleChoices(),
+            ]);
+        }
+
+        if (!$this->isCsrfTokenValid('admin_user_create', (string) $request->request->get('_token'))) {
+            $this->addFlash('danger', 'Ungültiges CSRF-Token.');
+
+            return $this->redirectToRoute('admin_users_create');
+        }
+
+        try {
+            $user = $users->create(
+                (string) $request->request->get('email', ''),
+                (string) $request->request->get('password', ''),
+                (string) $request->request->get('password_repeat', ''),
+                $this->extractRoles($request),
+                $request->request->has('is_active'),
+            );
+
+            $this->addFlash('success', 'Benutzer wurde erstellt: ' . $user->getEmail());
+
+            return $this->redirectToRoute('admin_users_index');
+        } catch (\Throwable $e) {
+            $this->addFlash('danger', $e->getMessage());
+
+            return $this->redirectToRoute('admin_users_create');
+        }
+    }
+
+    #[Route('/{id}/edit', name: 'admin_users_edit', requirements: ['id' => '[0-9a-fA-F\-]{36}'], methods: ['GET', 'POST'])]
+    public function edit(string $id, Request $request, UserAdminService $users): Response
+    {
+        $this->denyAccessUnlessGranted('ROLE_SUPER_ADMIN');
+
+        try {
+            $user = $users->requireUser($id);
+        } catch (\Throwable $e) {
+            $this->addFlash('danger', $e->getMessage());
+
+            return $this->redirectToRoute('admin_users_index');
+        }
+
+        if (!$request->isMethod('POST')) {
+            return $this->render('admin/user/edit.html.twig', [
+                'managed_user' => $user,
+                'role_choices' => $users->roleChoices(),
+            ]);
+        }
+
+        if (!$this->isCsrfTokenValid('admin_user_edit_' . $id, (string) $request->request->get('_token'))) {
+            $this->addFlash('danger', 'Ungültiges CSRF-Token.');
+
+            return $this->redirectToRoute('admin_users_edit', ['id' => $id]);
+        }
+
+        try {
+            $updatedUser = $users->update(
+                $id,
+                (string) $request->request->get('email', ''),
+                (string) $request->request->get('password', ''),
+                (string) $request->request->get('password_repeat', ''),
+                $this->extractRoles($request),
+                $request->request->has('is_active'),
+                $this->requireCurrentUser(),
+            );
+
+            $this->addFlash('success', 'Benutzer wurde aktualisiert: ' . $updatedUser->getEmail());
+
+            return $this->redirectToRoute('admin_users_index');
+        } catch (\Throwable $e) {
+            $this->addFlash('danger', $e->getMessage());
+
+            return $this->redirectToRoute('admin_users_edit', ['id' => $id]);
+        }
+    }
+
+    #[Route('/{id}/toggle-active', name: 'admin_users_toggle_active', requirements: ['id' => '[0-9a-fA-F\-]{36}'], methods: ['POST'])]
+    public function toggleActive(string $id, Request $request, UserAdminService $users): RedirectResponse
+    {
+        $this->denyAccessUnlessGranted('ROLE_SUPER_ADMIN');
+
+        if (!$this->isCsrfTokenValid('admin_user_toggle_active_' . $id, (string) $request->request->get('_token'))) {
+            $this->addFlash('danger', 'Ungültiges CSRF-Token.');
+
+            return $this->redirectToRoute('admin_users_index');
+        }
+
+        try {
+            $user = $users->toggleActive($id, $this->requireCurrentUser());
+            $this->addFlash('success', sprintf(
+                'Benutzer %s wurde %s.',
+                $user->getEmail(),
+                $user->isActive() ? 'aktiviert' : 'deaktiviert',
+            ));
+        } catch (\Throwable $e) {
+            $this->addFlash('danger', $e->getMessage());
+        }
+
+        return $this->redirectToRoute('admin_users_index');
+    }
+
+    /**
+     * @return list<string>
+     */
+    private function extractRoles(Request $request): array
+    {
+        $roles = $request->request->all('roles');
+
+        if (!is_array($roles)) {
+            return [];
+        }
+
+        return array_values(array_map(static fn (mixed $role): string => (string) $role, $roles));
+    }
+
+    private function requireCurrentUser(): User
+    {
+        $user = $this->getUser();
+
+        if (!$user instanceof UserInterface || !$user instanceof User) {
+            throw $this->createAccessDeniedException('Kein gültiger Benutzer angemeldet.');
+        }
+
+        return $user;
+    }
+}