Set login constants in request listener

[fritzmg]

Fixes #2576 and other issues.

In #2628 we removed the usage of the deprecated FE_USER_LOGGED_IN constant within the core and switched to using the token checker instead, in order to fix #2576.

However, the core issue still remains: for any Contao extension that still uses the FE_USER_LOGGED_IN constant, the constant will still have the wrong value for any authenticated request without a previous authenticated session. For example: if you implement a custom guard authenticator that authenticates a Contao user e.g. via an Authorization header, or some other custom solution, the constant will always be false (if no session cookie of a previous authenticated request is passed along with the request).

The cause of this is the setting of the constants within ContaoFramework::initialize. ContaoFramework::initialize will be executed very early - earlier than the Firewall listener, which is a regular request listener. So since $this->tokenChecker->hasFrontendUser() will be executed before Symfony's Firewall listener, it will always be false, because no security token has been set by the Symfony Firewall yet.

To fix this we must not query the TokenChecker before the Symfony Firewall listener. i.e. we need to set this constant in a regular request listener that has a lower priority than the Firewall request listener of Symfony. This is implemented in this PR.

[aschempp]

I think there are two things to consider/fix here:

1. The listener should not set the constants if the framework was not initialized
2. if the framework is initialized after the firewall (e.g. if a Symfony route matches), we must still set the constants when booting the framework.

Otherwise 👍 for using a listener after firewall!

[aschempp]

I would change two things here

1. always use getCurrentRequest for the constants to keep it consistent
2. I don't think we need two methods. Calling setLoginConstants() when the framework is not initialised should set the internal flag. Calling the method (again) if the framework is initialised (internally) should set the constants automatically.

[fritzmg]

always use getCurrentRequest for the constants to keep it consistent

Are you sure? Should we not pass the request of the request event?

[aschempp]

Not sure about that request, but it probably does not matter. But why did you remove the mode-check and the session initialization?

[fritzmg]

But why did you remove the mode-check

It does not really make sense to check whether this is a front end request or not via $this->getMode()? Ah I see, because of the $isFrontend variable.

and the session initialization?

I don't understand the purpose of $session->start() here and I do not think it is needed.

Also the previous condition had $this->request->hasPreviousSession() - which also does not make sense. This was likely a workaround, as the Contao framework is initialized early before the firewall listener and thus this bit of code never worked for the initial authentication request.

[aschempp]

Also the previous condition had $this->request->hasPreviousSession() - which also does not make sense. This was likely a workaround, as the Contao framework is initialized early before the firewall listener and thus this bit of code never worked for the initial authentication request.

It made sense because without a previous session you could never be logged in – since a security token would have been stored in the DB. But I agree if the constant is only set after the firewall this should never be necessary.

[leofeyer]

Thank you @fritzmg.