feat: add oauth2 login against myep

src/Security/Role.php

@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Security;
+
+/**
+ * The roles this application knows about.
+ *
+ * **This list is a whitelist, not a mirror.** myep's `roles` claim is filtered through it on every
+ * login, so a role invented on the identity provider -- or injected into a userinfo response --
+ * can never appear on a local account. myep already strips its own `*_PENDING` markers and
+ * non-granting roles before exporting them, but that is its policy, not our guarantee.
+ *
+ * Kept deliberately small: ephub has no notion of teamers, managers or house managers, and
+ * storing roles it assigns no meaning to would only invite someone to start checking them.
+ */
+final class Role
+{
+    /** Derived on myep from the account's email domain: "works here". */
+    public const EMPLOYEE = 'ROLE_EMPLOYEE';
+
+    /** Administrative on myep -- nominated by the CRM, but only exported once approved there. */
+    public const ADMIN = 'ROLE_ADMIN';
+
+    /**
+     * The roles that entitle someone to use ephub at all. Someone who holds neither is refused
+     * at login rather than let in without access, so they get an explanation instead of an
+     * empty screen they cannot act on.
+     *
+     * @var list<string>
+     */
+    public const ELIGIBLE = [
+        self::EMPLOYEE,
+        self::ADMIN,
+    ];
+
+    /**
+     * Whatever of a claimed role set this application recognises, in a stable order.
+     *
+     * @param list<string> $claimed
+     *
+     * @return list<string>
+     */
+    public static function eligibleOnly(array $claimed): array
+    {
+        return array_values(array_filter(
+            self::ELIGIBLE,
+            static fn (string $role): bool => \in_array($role, $claimed, true),
+        ));
+    }
+}