Fixed login CSFR token error

Implements PR #970

composer.json

@@ -12,9 +12,11 @@
         "ext-json": "*",
         "ext-mbstring": "*",
         "amphp/http-client": "^5.1",
-        "api-platform/core": "^3.1",
+        "api-platform/doctrine-orm": "^4.1",
+        "api-platform/symfony": "^4.0.0",
+        "api-platform/json-api": "^4.0.0",
         "beberlei/doctrineextensions": "^1.2",
-        "brick/math": "0.12.1 as 0.11.0",
+        "brick/math": "^0.13.1",
         "composer/ca-bundle": "^1.5",
         "composer/package-versions-deprecated": "^1.11.99.5",
         "doctrine/data-fixtures": "^2.0.0",
@@ -41,7 +43,7 @@
         "nelmio/cors-bundle": "^2.3",
         "nelmio/security-bundle": "^3.0",
         "nyholm/psr7": "^1.1",
-        "omines/datatables-bundle": "^0.9.1",
+        "omines/datatables-bundle": "^0.10.0",
         "paragonie/sodium_compat": "^1.21",
         "part-db/label-fonts": "^1.0",
         "rhukster/dom-sanitizer": "^1.0",
@@ -84,6 +86,7 @@
         "symfony/web-link": "7.3.*",
         "symfony/webpack-encore-bundle": "^v2.0.1",
         "symfony/yaml": "7.3.*",
+        "symplify/easy-coding-standard": "^12.5.20",
         "tecnickcom/tc-lib-barcode": "^2.1.4",
         "twig/cssinliner-extra": "^3.0",
         "twig/extra-bundle": "^3.8",
@@ -92,8 +95,7 @@
         "twig/intl-extra": "^3.8",
         "twig/markdown-extra": "^3.8",
         "twig/string-extra": "^3.8",
-        "web-auth/webauthn-symfony-bundle": "^4.0.0",
-        "symplify/easy-coding-standard": "^12.5.20"
+        "web-auth/webauthn-symfony-bundle": "^4.0.0"
     },
     "require-dev": {
         "dama/doctrine-test-bundle": "^v8.0.0",

config/bundles.php

@@ -30,7 +30,7 @@ return [
     Jbtronics\DompdfFontLoaderBundle\DompdfFontLoaderBundle::class => ['all' => true],
     KnpU\OAuth2ClientBundle\KnpUOAuth2ClientBundle::class => ['all' => true],
     Nelmio\CorsBundle\NelmioCorsBundle::class => ['all' => true],
-    ApiPlatform\Symfony\Bundle\ApiPlatformBundle::class => ['all' => true],
     Jbtronics\SettingsBundle\JbtronicsSettingsBundle::class => ['all' => true],
     Jbtronics\TranslationEditorBundle\JbtronicsTranslationEditorBundle::class => ['dev' => true],
+    \ApiPlatform\Symfony\Bundle\ApiPlatformBundle::class => ['all' => true],
 ];

config/packages/api_platform.yaml

@@ -32,10 +32,9 @@ api_platform:
 
     pagination_client_items_per_page: true # Allow clients to override the default items per page
 
-  keep_legacy_inflector: false
   # Need to be true, or some tests will fail
   use_symfony_listeners: true
 
   serializer:
     # Change this to false later, to remove the hydra prefix on the API
-    hydra_prefix: true
+    hydra_prefix: true

config/packages/framework.yaml

@@ -28,6 +28,11 @@ framework:
     #esi: true
     #fragments: true
 
+
+    form: { csrf_protection: { token_id: 'submit' } }
+    csrf_protection:
+        stateless_token_ids: ['submit', 'authenticate', 'logout']
+
 when@test:
     framework:
         test: true

config/packages/ux_turbo.yaml

@@ -0,0 +1,4 @@
+# Enable stateless CSRF protection for forms and logins/logouts
+framework:
+    csrf_protection:
+        check_header: true

src/ApiPlatform/DocumentedAPIProperties/PropertyMetadataFactory.php

@@ -70,4 +70,4 @@ class PropertyMetadataFactory implements PropertyMetadataFactoryInterface
 
         return $metadata;
     }
-}
+}

src/Serializer/APIPlatform/DetermineTypeFromElementIRIDenormalizer.php

@@ -24,7 +24,7 @@ declare(strict_types=1);
 namespace App\Serializer\APIPlatform;
 
 use ApiPlatform\Metadata\Exception\ResourceClassNotFoundException;
-use ApiPlatform\Api\IriConverterInterface;
+use ApiPlatform\Metadata\IriConverterInterface;
 use ApiPlatform\Metadata\Operation;
 use ApiPlatform\Metadata\Post;
 use ApiPlatform\Metadata\Resource\Factory\ResourceMetadataCollectionFactoryInterface;
@@ -121,4 +121,4 @@ class DetermineTypeFromElementIRIDenormalizer implements DenormalizerInterface,
 
         return $tmp;
     }
-}
+}

src/Serializer/PartNormalizer.php

@@ -92,7 +92,7 @@ class PartNormalizer implements NormalizerInterface, DenormalizerInterface, Norm
         return $data;
     }
 
-    public function supportsDenormalization($data, string $type, string $format = null, array $context = []): bool
+    public function supportsDenormalization($data, string $type, ?string $format = null, array $context = []): bool
     {
         //Only denormalize if we are doing a file import operation
         if (!($context['partdb_import'] ?? false)) {

symfony.lock

@@ -1,16 +1,16 @@
 {
-    "api-platform/core": {
-        "version": "3.4",
+    "api-platform/symfony": {
+        "version": "4.1",
         "recipe": {
             "repo": "github.com/symfony/recipes",
             "branch": "main",
-            "version": "3.3",
-            "ref": "74b45ac570c57eb1fbe56c984091a9ff87e18bab"
+            "version": "4.0",
+            "ref": "e9952e9f393c2d048f10a78f272cd35e807d972b"
         },
         "files": [
-            "config/packages/api_platform.yaml",
-            "config/routes/api_platform.yaml",
-            "src/ApiResource/.gitignore"
+            "./config/packages/api_platform.yaml",
+            "./config/routes/api_platform.yaml",
+            "./src/ApiResource/.gitignore"
         ]
     },
     "beberlei/assert": {
@@ -748,13 +748,16 @@
         ]
     },
     "symfony/ux-turbo": {
-        "version": "2.27",
+        "version": "2.28",
         "recipe": {
             "repo": "github.com/symfony/recipes",
             "branch": "main",
             "version": "2.20",
-            "ref": "e4b951d7de760751e170c6d2e3b565cf9ed5182f"
-        }
+            "ref": "287f7c6eb6e9b65e422d34c00795b360a787380b"
+        },
+        "files": [
+            "config/packages/ux_turbo.yaml"
+        ]
     },
     "symfony/validator": {
         "version": "7.3",

templates/security/login.html.twig

@@ -22,8 +22,7 @@
 {% block card_content %}
     <form action="{{ path('login') }}" method="post" data-turbo="false" class="form-horizontal">
 
-        <input type="hidden" name="_csrf_token"
-               value="{{ csrf_token('authenticate') }}">
+        <input type="hidden" name="_csrf_token" data-controller="csrf-protection" value="{{ csrf_token('authenticate') }}">
 
         <input type="hidden" name="_target_path" value="{{ app.request.query.get('_target_path') }}" />
 
@@ -72,4 +71,4 @@
     {% if allow_email_pw_reset %}
         <a class="offset-sm-2" href="{{ path('pw_reset_request') }}">{% trans %}pw_reset.password_forget{% endtrans %}</a>
     {% endif %}
-{% endblock %}
+{% endblock %}