fix: force https redirect

config/packages/security.yaml

@@ -25,13 +25,13 @@ security:
 
     access_control:
         # The login surface itself has to stay reachable, or the entry point redirects in a loop.
-        - { path: ^/(login|auth|logout)$, roles: PUBLIC_ACCESS }
-        - { path: ^/auth/, roles: PUBLIC_ACCESS }
+        - { path: ^/(login|auth|logout)$, roles: PUBLIC_ACCESS, requires_channel: https }
+        - { path: ^/auth/, roles: PUBLIC_ACCESS, requires_channel: https }
         # Before the catch-all, or ROLE_EMPLOYEE would match ^/ first and the admin area would be
         # open to everybody. Order is the whole guard here.
-        - { path: ^/admin, roles: ROLE_ADMIN }
+        - { path: ^/admin, roles: ROLE_ADMIN, requires_channel: https }
         # Either role opens the app -- access_control treats a list of roles as an OR. Not
         # ROLE_USER: myep authenticates far more people than work here, and someone who holds
         # neither of these is refused at login with an explanation rather than let in to an
         # empty screen.
-        - { path: ^/, roles: [ROLE_EMPLOYEE, ROLE_ADMIN] }
+        - { path: ^/, roles: [ROLE_EMPLOYEE, ROLE_ADMIN], , requires_channel: https }