chore: code cleanup

src/Controller/Security/AuthCheckController.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Security;
+
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\Routing\Attribute\Route;
+
+final class AuthCheckController extends AbstractController
+{
+    /**
+     * The registered callback URL. Never executed: EpAuthenticator::supports() matches this
+     * route and the firewall handles the request before it reaches a controller. The route has
+     * to exist all the same, because the redirect URI is generated from it.
+     */
+    #[Route('/auth/check', name: 'app_auth_check', methods: ['GET'])]
+    public function index(): never
+    {
+        throw new \LogicException('Intercepted by EpAuthenticator on the main firewall.');
+    }
+}

src/Controller/Security/AuthInitController.php

@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Security;
+
+use App\Security\OAuth2\EpClient;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+
+final class AuthInitController extends AbstractController
+{
+    public function __construct(private readonly EpClient $client)
+    {
+    }
+
+    /**
+     * Starts the authorization code flow: stores the state on the session and sends the browser
+     * to myep.
+     */
+    #[Route('/auth/init', name: 'app_auth_init', methods: ['GET'])]
+    public function index(Request $request): Response
+    {
+        if (!$this->client->isConfigured()) {
+            $this->addFlash('error', 'Für ephub ist auf myep noch kein OAuth2-Client registriert.');
+
+            return $this->redirectToRoute('app_login');
+        }
+
+        return new RedirectResponse($this->client->authorizationUrl($request));
+    }
+}

src/Controller/Security/LoginController.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Security;
+
+use App\Security\OAuth2\EpClient;
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Attribute\Route;
+
+final class LoginController extends AbstractController
+{
+    public function __construct(private readonly EpClient $client)
+    {
+    }
+
+    #[Route('/login', name: 'app_login', methods: ['GET'])]
+    public function index(): Response
+    {
+        if ($this->getUser()) {
+            return $this->redirectToRoute('app_dashboard');
+        }
+
+        return $this->render('security/login.html.twig', [
+            'oauth2_configured' => $this->client->isConfigured(),
+        ]);
+    }
+}

src/Controller/Security/LogoutController.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Controller\Security;
+
+use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\Routing\Attribute\Route;
+
+final class LogoutController extends AbstractController
+{
+    /**
+     * Never executed: the firewall's logout listener intercepts this route.
+     */
+    #[Route('/logout', name: 'app_logout', methods: ['GET'])]
+    public function index(): never
+    {
+        throw new \LogicException('Intercepted by the logout key on the main firewall.');
+    }
+}