feat: add a dev-only login and seed command

src/Security/DevLoginAuthenticator.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Security;
+
+use App\Repository\UserRepository;
+use Symfony\Component\DependencyInjection\Attribute\When;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
+use Symfony\Component\Security\Http\Authenticator\AbstractAuthenticator;
+use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
+use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
+use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
+
+/**
+ * Logs in whoever was picked on /dev/login, with no credentials at all.
+ *
+ * Dev only. It deliberately has the same shape the real OAuth2 authenticator will take in plan
+ * step 6 -- supports() matches one route, authenticate() returns a SelfValidatingPassport -- so
+ * swapping it out is a deletion rather than a rewrite.
+ */
+#[When('dev')]
+final class DevLoginAuthenticator extends AbstractAuthenticator
+{
+    public function __construct(
+        private readonly UserRepository $users,
+        private readonly UrlGeneratorInterface $urlGenerator,
+    ) {
+    }
+
+    public function supports(Request $request): bool
+    {
+        return 'app_dev_login' === $request->attributes->get('_route') && $request->isMethod('POST');
+    }
+
+    public function authenticate(Request $request): Passport
+    {
+        $id = $request->request->getInt('user');
+
+        return new SelfValidatingPassport(new UserBadge((string) $id, function (string $identifier) {
+            $user = $this->users->find((int) $identifier);
+
+            if (null === $user) {
+                throw new CustomUserMessageAuthenticationException('Unbekannter Benutzer.');
+            }
+
+            return $user;
+        }));
+    }
+
+    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
+    {
+        return new RedirectResponse($this->urlGenerator->generate('app_dashboard'));
+    }
+
+    public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response
+    {
+        $request->getSession()->getFlashBag()->add('error', $exception->getMessageKey());
+
+        return new RedirectResponse($this->urlGenerator->generate('app_dev_login'));
+    }
+}

src/Security/DevLoginEntryPoint.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Security;
+
+use Symfony\Component\DependencyInjection\Attribute\When;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
+
+/**
+ * Sends an unauthenticated visitor to the dev login picker.
+ *
+ * Dev only -- it exists so UI work is not gated on the OAuth2 client registration on myep.
+ * When the real authenticator lands (plan step 6) the entry point for every environment becomes
+ * the OAuth2 init route and this class goes away.
+ */
+#[When('dev')]
+final readonly class DevLoginEntryPoint implements AuthenticationEntryPointInterface
+{
+    public function __construct(private UrlGeneratorInterface $urlGenerator)
+    {
+    }
+
+    public function start(Request $request, ?AuthenticationException $authException = null): Response
+    {
+        return new RedirectResponse($this->urlGenerator->generate('app_dev_login'));
+    }
+}