feat: add oauth2 login against myep

config/packages/security.yaml

@@ -1,6 +1,6 @@
 security:
-    # No password_hashers: there are no passwords here. Authentication is OAuth2 against myep
-    # (plan step 6); until that lands there is no way to log in outside dev.
+    # No password_hashers: there are no passwords here. Authentication is OAuth2 against myep,
+    # which owns the credentials; ephub only ever sees a userinfo response.
 
     providers:
         app_user_provider:
@@ -15,23 +15,31 @@ security:
         main:
             lazy: true
             provider: app_user_provider
+            entry_point: App\Security\LoginEntryPoint
+            custom_authenticators:
+                - App\Security\EpAuthenticator
             logout:
                 path: app_logout
+                target: app_login
 
     access_control:
-        # ROLE_EMPLOYEE is the gate, not ROLE_USER: myep authenticates more people than are staff,
-        # and only staff may book a desk here.
+        # The login surface itself has to stay reachable, or the entry point redirects in a loop.
+        - { path: ^/(login|auth|logout)$, roles: PUBLIC_ACCESS }
+        - { path: ^/auth/, roles: PUBLIC_ACCESS }
         - { path: ^/dev/, roles: PUBLIC_ACCESS }
-        - { path: ^/, roles: ROLE_EMPLOYEE }
+        # Either role opens the app -- access_control treats a list of roles as an OR. Not
+        # ROLE_USER: myep authenticates far more people than work here, and someone who holds
+        # neither of these is refused at login with an explanation rather than let in to an
+        # empty screen.
+        - { path: ^/, roles: [ROLE_EMPLOYEE, ROLE_ADMIN] }
 
 when@dev:
     security:
         firewalls:
             main:
-                # Real login is blocked on OAuth2 client registration on myep. Until then
-                # /dev/login lists the seeded users and logs one in without credentials.
-                # The entry point, the route and the controller are all dev-only, so this
-                # cannot leak into another environment by accident.
-                entry_point: App\Security\DevLoginEntryPoint
+                # Until a client is registered on myep, /dev/login lists the seeded users and
+                # logs one in without credentials. The route and the controller are both
+                # dev-only, so this cannot leak into another environment by accident.
                 custom_authenticators:
+                    - App\Security\EpAuthenticator
                     - App\Security\DevLoginAuthenticator