Existing application (with existing users)

//see details here: https://github.com/corbado/example-webcomponent-php-symfony/blob/a1ba00f5831a6a3b5fb7b29fa2ad371748766973/src/Controller/WebhookController.php#L42
$webhookUsername = 'webhookUsername'; // Fetch from configuration or database
$webhookPassword = 'webhookPassword'; // Fetch from configuration or database

// Create new webhook instance with "webhookUsername" and "webhookPassword". Both must be
// set in the developer panel (https://app.corbado.com) and are used to secure your
// webhook (this one here) with basic authentication.
$webhook = new Webhook($webhookUsername, $webhookPassword);

// Handle authentication so your webhook is secured (basic authentication). If username
// and/or password are invalid handleAuthentication() will send HTTP status code
// 401 (Unauthorized) and terminate/exit execution here.
$webhook->handleAuthentication();

// Check if request has been made with POST. For Corbado webhooks
// only POST is allowed/used.
if (!$webhook->isPost()) {
    throw new Exception('Only POST is allowed');
}

switch ($webhook->getAction()) {
    // Handle the "authMethods" action which basically checks
    // if a user exists on your side/in your database.
    case $webhook::ACTION_AUTH_METHODS:
        $request = $webhook->getAuthMethodsRequest();

        // Now check if the given user/username exists in your
        // database and send status. Implement getUserStatus()
        // function below.
        $status = $this->userStatus($userRepo, $request->data->username);
        $webhook->sendAuthMethodsResponse($status);

        break;
    
    // ...
}

/**
 * Detects user status
 *
 * @param UserRepository $userRepo
 * @param string $username
 * @return string
 */
private function userStatus(UserRepository $userRepo, string $username): string
{
    $user = $userRepo->findOneBy(['email' => $username]);

    // Look up in database if $username exists and if $username is blocked/not permitted to login

    if ($user == null) {
        return AuthMethodsDataResponse::USER_NOT_EXISTS;
    }

    if ($user->isBlocked()) {
        return AuthMethodsDataResponse::USER_BLOCKED;
    }

    return AuthMethodsDataResponse::USER_EXISTS;
}

// Details: https://github.com/corbado/example-webcomponent-nodejs/blob/c9aeef3f5ef43d529355e97c2cf3a39164767593/src/controllers/corbadoWebhookController.js#L55
// Get the webhook action and act accordingly. Every Corbado
// webhook has an action.
switch ($webhook->getAction()) {
    
    // ...
        
    // Handle the "passwordVerify" action which basically checks
    // if the given username and password are valid.
    case $webhook::ACTION_PASSWORD_VERIFY:
        $request = $webhook->getPasswordVerifyRequest();

        // Now check if the given username and password is
        // valid. Implement verifyPassword() function below.
        $webhook->sendPasswordVerifyResponse($this->verifyPassword($userRepo, $request->data->username, $request->data->password));

        break;
    
    // ...
}


/**
 * Verify given username and password.
 *
 * @param UserRepository $userRepo
 * @param string $username
 * @param string $password
 * @return bool
 */
private function verifyPassword(UserRepository $userRepo, string $username, string $password): bool
{
    $user = $userRepo->findOneBy(['email' => $username]);
    if ($user == null || $user->getPassword() == null) {
        return false;
    }

    return password_verify($password, $user->getPassword());
}