basic migration of old users/zauth/permissions/groups to nucleos

.env

@@ -40,13 +40,12 @@ ZIKULA_INSTALLED='0.0.0'
 # MAILER_DSN=null://null
 ###< symfony/mailer ###
 
-###> symfony/messenger ###
-# Choose one of the transports below
-# MESSENGER_TRANSPORT_DSN=doctrine://default
-# MESSENGER_TRANSPORT_DSN=amqp://guest:guest@localhost:5672/%2f/messages
-# MESSENGER_TRANSPORT_DSN=redis://localhost:6379/messages
-###< symfony/messenger ###
-
 ###> nucleos/user-bundle ###
 MAIL_SENDER=no-reply@localhost
 ###< nucleos/user-bundle ###
+
+###> symfony/lock ###
+# Choose one of the stores below
+# postgresql+advisory://db_user:db_password@localhost/db_name
+LOCK_DSN=flock
+###< symfony/lock ###

.github/workflows/build.yml

@@ -79,7 +79,7 @@ jobs:
           php bin/console lint:yaml src/Zikula/ --parse-tags
           php bin/console lint:twig --show-deprecations src/system/ src/Zikula/
 
-      - name: Iache vulnerability database
+      - name: Cache vulnerability database
         uses: actions/cache@v3
         id: cache-db
         with:

config/bundles.php

@@ -22,12 +22,10 @@
     Zikula\Bundle\CoreBundle\CoreBundle::class => ['all' => true],
     Zikula\Bundle\FormExtensionBundle\ZikulaFormExtensionBundle::class => ['all' => true],
     Zikula\CategoriesBundle\ZikulaCategoriesBundle::class => ['all' => true],
-    Zikula\GroupsBundle\ZikulaGroupsBundle::class => ['all' => true],
     Zikula\LegalBundle\ZikulaLegalBundle::class => ['all' => true],
-    Zikula\PermissionsBundle\ZikulaPermissionsBundle::class => ['all' => true],
     Zikula\ProfileBundle\ZikulaProfileBundle::class => ['all' => true],
-    Zikula\StaticContentBundle\ZikulaStaticContentBundle::class => ['all' => true],
     Zikula\ThemeBundle\ZikulaThemeBundle::class => ['all' => true],
     Zikula\UsersBundle\ZikulaUsersBundle::class => ['all' => true],
-    Zikula\ZAuthBundle\ZikulaZAuthBundle::class => ['all' => true],
+    Nucleos\UserBundle\NucleosUserBundle::class => ['all' => true],
+    Nucleos\ProfileBundle\NucleosProfileBundle::class => ['all' => true],
 ];

config/packages/doctrine.yaml

@@ -6,10 +6,10 @@ doctrine:
             utcdatetime:
                 class: Zikula\Bundle\CoreBundle\Doctrine\DBAL\Type\UTCDateTimeType
     orm:
-        proxy_namespace: DoctrineProxy
-        proxy_dir: '%kernel.cache_dir%/doctrine/orm/DoctrineProxy'
+        auto_generate_proxy_classes: false
+        enable_lazy_ghost_objects: true
+        proxy_dir: '%kernel.build_dir%/doctrine/orm/Proxies'
         default_entity_manager: default
-        auto_generate_proxy_classes: true
         #naming_strategy: doctrine.orm.naming_strategy.underscore_number_aware
         entity_managers:
             # the standard distribution overrides this to be true in debug, false otherwise
@@ -53,7 +53,6 @@ doctrine:
 when@prod:
     doctrine:
         orm:
-            auto_generate_proxy_classes: false
             query_cache_driver:
                 type: pool
                 pool: doctrine.system_cache_pool

config/packages/framework.yaml

@@ -3,6 +3,7 @@ framework:
     secret: '%env(APP_SECRET)%'
     #csrf_protection: true
     http_method_override: false
+    handle_all_throwables: true
 
     default_locale: en
     #enabled_locales: [en, de]

config/packages/nucleos_profile.yaml

@@ -0,0 +1,6 @@
+# see https://docs.nucleos.rocks/projects/profile-bundle/en/1.5.x/configuration.html
+nucleos_profile:
+    registration:
+        confirmation:
+            enabled: true
+            from_email: '%env(MAIL_SENDER)%'

config/packages/nucleos_user.yaml

@@ -0,0 +1,12 @@
+# see https://docs.nucleos.rocks/projects/user-bundle/en/2.0.x/configuration_reference.html
+nucleos_user:
+    db_driver: orm
+    user_class: 'Zikula\UsersBundle\Entity\User'
+    firewall_name: main
+    from_email: '%env(MAIL_SENDER)%'
+    deletion:
+        enabled: true
+    group:
+        group_class: 'Zikula\UsersBundle\Entity\Group'
+    loggedin:
+        route: 'user_dashboard' # Redirect route after login

config/packages/rate_limiter.yaml

@@ -1,9 +1,5 @@
 framework:
     rate_limiter:
-        lost_credentials:
-            policy: 'fixed_window'
-            limit: 20
-            interval: '60 minutes'
         test_mails:
             policy: 'fixed_window'
             limit: 5

config/packages/security.yaml

@@ -1,33 +1,41 @@
 security:
-    enable_authenticator_manager: true
-    # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
     password_hashers:
         Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'
-    encoders:
-        Zikula\ZAuthBundle\Entity\AuthenticationMappingEntity:
-            algorithm: auto
-    # https://symfony.com/doc/current/security.html#loading-the-user-the-user-provider
+
     providers:
-        users_in_memory: { memory: null }
+        nucleos_userbundle:
+            id: nucleos_user.user_provider.username_email
+
     firewalls:
         dev:
             pattern: ^/(_(profiler|wdt)|css|images|js)/
             security: false
         main:
-            lazy: true
-            provider: users_in_memory
+            pattern: ^/
+            user_checker: Nucleos\UserBundle\Security\UserChecker
+            form_login:
+                provider: nucleos_userbundle
+                enable_csrf: true
 
-            # activate different ways to authenticate
-            # https://symfony.com/doc/current/security.html#the-firewall
+            logout: true
 
             # https://symfony.com/doc/current/security/impersonating_user.html
             # switch_user: true
 
-    # Easy way to control access for large sections of your site
-    # Note: Only the *first* access control that matches will be used
+    role_hierarchy:
+        ROLE_EDITOR:      ROLE_USER
+        ROLE_ADMIN:       ROLE_EDITOR
+        ROLE_SUPER_ADMIN: ROLE_ADMIN
+
     access_control:
-        # - { path: ^/admin, roles: ROLE_ADMIN }
-        # - { path: ^/profile, roles: ROLE_USER }
+        # public access for login form and password reset page
+        - { path: ^/login, role: PUBLIC_ACCESS }
+        - { path: ^/resetting, role: PUBLIC_ACCESS }
+        # login for password change and profile
+        - { path: ^/change-password, role: IS_AUTHENTICATED_REMEMBERED }
+        - { path: ^/profile, role: IS_AUTHENTICATED_REMEMBERED }
+        # admin dashboard - disabled in favor of #[IsGranted] attribute in AdminDashboardController
+        # - { path: ^/admin, role: ROLE_ADMIN }
 
 when@test:
     security:

config/routes/nucleos_profile.yaml

@@ -0,0 +1,7 @@
+nucleos_profile_profile:
+    resource: "@NucleosProfileBundle/Resources/config/routing/profile.php"
+    prefix: /profile
+
+nucleos_profile_registration:
+    resource: "@NucleosProfileBundle/Resources/config/routing/registration.php"
+    prefix: /registration

config/routes/nucleos_user.yaml

@@ -0,0 +1,14 @@
+nucleos_user_security:
+    resource: "@NucleosUserBundle/Resources/config/routing/security.php"
+
+nucleos_user_resetting:
+    resource: "@NucleosUserBundle/Resources/config/routing/resetting.php"
+    prefix: /resetting
+
+nucleos_user_change_password:
+    resource: "@NucleosUserBundle/Resources/config/routing/change_password.php"
+    prefix: /credentials
+
+nucleos_user_deletion:
+    resource: "@NucleosUserBundle/Resources/config/routing/deletion.php"
+    prefix: /deletion

couscous.yml

@@ -59,27 +59,15 @@ menu:
         content:
             name: Content
             items:
-                content-pages:
-                    text: Static pages
-                    relativeUrl: Content/pages.html
                 categories:
                     text: Categories
                     relativeUrl: Content/Categories/index.html
         access-control:
             name: Access Control
             items:
-                groups:
-                    text: Groups
-                    relativeUrl: AccessControl/Groups/index.html
                 users:
                     text: Users
                     relativeUrl: AccessControl/Users/index.html
-                authentication:
-                    text: Authentication
-                    relativeUrl: AccessControl/Authentication/index.html
-                permissions:
-                    text: Permissions
-                    relativeUrl: AccessControl/Permissions/index.html
         layout:
             name: Layout & Design
             items: