feat: add oauth2 login against myep

config/packages/security.yaml

@@ -1,6 +1,6 @@
 security:
-    # No password_hashers: there are no passwords here. Authentication is OAuth2 against myep
-    # (plan step 6); until that lands there is no way to log in outside dev.
+    # No password_hashers: there are no passwords here. Authentication is OAuth2 against myep,
+    # which owns the credentials; ephub only ever sees a userinfo response.
 
     providers:
         app_user_provider:
@@ -15,23 +15,31 @@ security:
         main:
             lazy: true
             provider: app_user_provider
+            entry_point: App\Security\LoginEntryPoint
+            custom_authenticators:
+                - App\Security\EpAuthenticator
             logout:
                 path: app_logout
+                target: app_login
 
     access_control:
-        # ROLE_EMPLOYEE is the gate, not ROLE_USER: myep authenticates more people than are staff,
-        # and only staff may book a desk here.
+        # The login surface itself has to stay reachable, or the entry point redirects in a loop.
+        - { path: ^/(login|auth|logout)$, roles: PUBLIC_ACCESS }
+        - { path: ^/auth/, roles: PUBLIC_ACCESS }
         - { path: ^/dev/, roles: PUBLIC_ACCESS }
-        - { path: ^/, roles: ROLE_EMPLOYEE }
+        # Either role opens the app -- access_control treats a list of roles as an OR. Not
+        # ROLE_USER: myep authenticates far more people than work here, and someone who holds
+        # neither of these is refused at login with an explanation rather than let in to an
+        # empty screen.
+        - { path: ^/, roles: [ROLE_EMPLOYEE, ROLE_ADMIN] }
 
 when@dev:
     security:
         firewalls:
             main:
-                # Real login is blocked on OAuth2 client registration on myep. Until then
-                # /dev/login lists the seeded users and logs one in without credentials.
-                # The entry point, the route and the controller are all dev-only, so this
-                # cannot leak into another environment by accident.
-                entry_point: App\Security\DevLoginEntryPoint
+                # Until a client is registered on myep, /dev/login lists the seeded users and
+                # logs one in without credentials. The route and the controller are both
+                # dev-only, so this cannot leak into another environment by accident.
                 custom_authenticators:
+                    - App\Security\EpAuthenticator
                     - App\Security\DevLoginAuthenticator

config/services.yaml

@@ -19,5 +19,19 @@ services:
     App\:
         resource: '../src/'
 
+    # The myep OAuth2 client. Endpoint URLs are configuration rather than constants (same as
+    # myep-team), so dev, staging and production differ by .env alone. Empty credentials are a
+    # valid state: the login page then says the client is not registered yet instead of bouncing
+    # the browser at a broken authorize URL.
+    App\Security\OAuth2\EpClient:
+        arguments:
+            $options:
+                client_id: '%env(string:EP_OAUTH2_CLIENT_ID)%'
+                client_secret: '%env(string:EP_OAUTH2_CLIENT_SECRET)%'
+                url_authorize: '%env(string:EP_OAUTH2_URL_AUTHORIZE)%'
+                url_access_token: '%env(string:EP_OAUTH2_URL_ACCESS_TOKEN)%'
+                url_userinfo: '%env(string:EP_OAUTH2_URL_USERINFO)%'
+                scopes: '%env(csv:EP_OAUTH2_SCOPES)%'
+
     # add more service definitions when explicit configuration is needed
     # please note that last definitions always *replace* previous ones