feat: add oauth2 login against myep

src/Controller/SecurityController.php

@@ -4,14 +4,58 @@ declare(strict_types=1);
 
 namespace App\Controller;
 
+use App\Security\OAuth2\EpClient;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
 
-/**
- * Gains /auth/init and /auth/check when OAuth2 against myep lands (plan step 6).
- */
 final class SecurityController extends AbstractController
 {
+    public function __construct(private readonly EpClient $client)
+    {
+    }
+
+    #[Route('/login', name: 'app_login', methods: ['GET'])]
+    public function login(): Response
+    {
+        if ($this->getUser()) {
+            return $this->redirectToRoute('app_dashboard');
+        }
+
+        return $this->render('security/login.html.twig', [
+            'oauth2_configured' => $this->client->isConfigured(),
+        ]);
+    }
+
+    /**
+     * Starts the authorization code flow: stores the state on the session and sends the browser
+     * to myep.
+     */
+    #[Route('/auth/init', name: 'app_auth_init', methods: ['GET'])]
+    public function authInit(Request $request): Response
+    {
+        if (!$this->client->isConfigured()) {
+            $this->addFlash('error', 'Für ephub ist auf myep noch kein OAuth2-Client registriert.');
+
+            return $this->redirectToRoute('app_login');
+        }
+
+        return new RedirectResponse($this->client->authorizationUrl($request));
+    }
+
+    /**
+     * The registered callback URL. Never executed: EpAuthenticator::supports() matches this
+     * route and the firewall handles the request before it reaches a controller. The route has
+     * to exist all the same, because the redirect URI is generated from it.
+     */
+    #[Route('/auth/check', name: 'app_auth_check', methods: ['GET'])]
+    public function authCheck(): never
+    {
+        throw new \LogicException('Intercepted by EpAuthenticator on the main firewall.');
+    }
+
     /**
      * Never executed: the firewall's logout listener intercepts this route.
      */