mail-account-admin/src/Frontend/Login/LoginController.php

<?php
declare(strict_types=1);

namespace MailAccountAdmin\Frontend\Login;

use MailAccountAdmin\Common\UserHelper;
use MailAccountAdmin\Exceptions\AdminUserNotFoundException;
use MailAccountAdmin\Frontend\BaseController;
use MailAccountAdmin\Repositories\AdminUserRepository;
use Psr\Http\Message\ResponseInterface as Response;
use Psr\Http\Message\ServerRequestInterface as Request;
use Slim\Views\Twig;

class LoginController extends BaseController
{
    /** @var AdminUserRepository */
    private $adminUserRepository;

    public function __construct(Twig $view, UserHelper $userHelper, AdminUserRepository $adminUserRepository)
    {
        parent::__construct($view, $userHelper);
        $this->adminUserRepository = $adminUserRepository;
    }

    private function renderLoginPage(Response $response, array $renderData = []): Response
    {
        return $this->view->render($response, 'login.html.twig', $renderData);
    }

    public function showLoginPage(Request $request, Response $response): Response
    {
        if ($this->userHelper->isLoggedIn()) {
            // Already logged in, redirect to dashboard
            return $response
                ->withHeader('Location', '/')
                ->withStatus(303);
        }

        return $this->renderLoginPage($response);
    }

    public function authenticateUser(Request $request, Response $response): Response
    {
        $params = (array)$request->getParsedBody();

        if (empty($params['username'])) {
            return $this->renderLoginPage($response, ['error' => 'Missing username!']);
        } elseif (empty($params['password'])) {
            return $this->renderLoginPage($response, ['error' => 'Missing password!']);
        }

        $loginUsername = $params['username'];
        $loginPassword = $params['password'];

        try {
            $user = $this->adminUserRepository->getUserByName($loginUsername);
        }
        catch (AdminUserNotFoundException $e) {
            $user = null;
        }

        if ($user === null || !password_verify($loginPassword, $user->getPasswordHash())) {
            return $this->renderLoginPage($response, ['error' => 'Wrong username or password!']);
        } elseif (!$user->isActive()) {
            return $this->renderLoginPage($response, ['error' => 'User is inactive!']);
        }

        // Set login session
        $_SESSION['username'] = $user->getUsername();
        return $response
            ->withHeader('Location', '/')
            ->withStatus(303);
    }

    public function logoutUser(Request $request, Response $response): Response
    {
        session_destroy();

        return $response
            ->withHeader('Location', '/login')
            ->withStatus(303);
    }
}