Password Reset Core Bundle Laravel Package

Getting Started

Minimal Setup

1. Install Dependencies Ensure dcs/user-core-bundle is installed and configured first (this bundle depends on it).

   composer require dcs/user-core-bundle "~1.0@dev"
   

2. Add the Bundle Register the bundle in config/bundles.php (Symfony 4+) or AppKernel.php (Symfony 2.8-3.x):

   DCS\PasswordReset\CoreBundle\DCSPasswordResetCoreBundle::class => ['all' => true],
   

3. Configure Database Run migrations (if provided by the bundle or a dependent package) to create the password_reset_request table. Example migration (if not auto-generated):

   php bin/console doctrine:migrations:diff
   php bin/console doctrine:migrations:migrate
   

4. First Use Case: Trigger a Reset Request Use the PasswordResetRequestManager service to create a reset request for a user:

   use DCS\PasswordReset\CoreBundle\Manager\PasswordResetRequestManager;
   
   $requestManager = $this->container->get('dcs_password_reset.request_manager');
   $request = $requestManager->createRequest($user);
   $requestManager->saveRequest($request);
   

Implementation Patterns

Core Workflow

1. Request Creation Generate a reset request tied to a user (via DCSUserCoreBundle):

   $request = $requestManager->createRequest($user);
   $request->setToken(md5(uniqid())); // Custom token logic
   $requestManager->saveRequest($request);
   

2. Event-Driven Extensions Listen for events to customize behavior (e.g., email sending, token expiration):

   # config/services.yaml
   services:
       App\EventListener\PasswordResetListener:
           tags:
               - { name: kernel.event_listener, event: dcs_password_reset.request.created, method: onRequestCreated }
   

   // src/EventListener/PasswordResetListener.php
   public function onRequestCreated(PasswordResetRequestEvent $event) {
       $request = $event->getRequest();
       // Send email via custom logic (e.g., SwiftMailer)
   }
   

3. Token Validation Validate a reset token before processing:

   $request = $requestManager->findRequestByToken($token);
   if ($request && !$request->isExpired()) {
       $requestManager->markRequestAsUsed($request);
       // Proceed with password update
   }
   

4. Password Update Use DCSUserCoreBundle's UserManager to update the password:

   $userManager = $this->container->get('dcs_user.user_manager');
   $userManager->changePassword($user, $newPassword);
   

Integration Tips

• Email Integration: Pair with symfony/mailer or swiftmailer to send reset links. Example:

  $url = $this->router->generate('reset_password', ['token' => $request->getToken()]);
  $email = (new Email())
      ->to($user->getEmail())
      ->subject('Reset Password')
      ->html($this->twig->render('emails/reset_password.html.twig', ['url' => $url]));
  $mailer->send($email);
  

• Frontend: Expose endpoints for:
  • POST /reset/request → Trigger reset request.
  • GET /reset/{token} → Show reset form.
  • POST /reset/{token} → Update password.

Gotchas and Tips

Pitfalls

1. Missing Token Logic The bundle does not generate tokens automatically. Implement your own (e.g., Str::random(60) or hash('sha256', ...)). Example:

   $request->setToken(hash('sha256', $user->getEmail() . time()));
   

2. Event Naming Confusion Events like dcs_password_reset.request.created are not documented in the README. Check the source (Event/PasswordResetRequestEvent.php) for available events.

3. No Built-in Email Templates The bundle lacks default templates. Create your own (e.g., templates/emails/reset_password.html.twig).

4. Token Expiration The bundle does not enforce expiration by default. Add a TTL field to the password_reset_request table and validate in isExpired():

   public function isExpired(): bool {
       return $this->getCreatedAt() < new \DateTime('-1 hour'); // Custom logic
   }
   

Debugging Tips

• Check Request Existence:

  $request = $requestManager->findRequestByToken($token);
  if (!$request) {
      throw new \RuntimeException('Invalid or expired token.');
  }
  

• Log Events: Use Symfony’s logger to track reset flows:

  $this->logger->info('Password reset requested for user', ['user_id' => $user->getId()]);
  

Extension Points

1. Custom Request Model Extend the default PasswordResetRequest entity to add fields (e.g., ipAddress, userAgent):

   namespace App\Entity;
   use DCS\PasswordReset\CoreBundle\Entity\PasswordResetRequest as BaseRequest;
   
   class PasswordResetRequest extends BaseRequest {
       private $ipAddress;
       // Add getters/setters
   }
   

   Update the bundle’s configuration to use your entity.

2. Override Services Replace the default PasswordResetRequestManager with a custom implementation:

   # config/services.yaml
   services:
       App\Service\CustomPasswordResetManager:
           arguments:
               $entityManager: '@doctrine.orm.entity_manager'
           tags: ['dcs_password_reset.request_manager']
   

3. Add Rate Limiting Use Symfony’s RateLimiter to prevent abuse:

   $limiter = new RateLimiter(5, '1 hour');
   if (!$limiter->isAllowed($user->getEmail())) {
       throw new \RuntimeException('Too many reset requests.');
   }