feat: add oauth2 login against myep

tests/Security/RoleTest.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security;
+
+use App\Security\Role;
+use PHPUnit\Framework\TestCase;
+
+class RoleTest extends TestCase
+{
+    public function testBothEligibleRolesAreRecognised(): void
+    {
+        self::assertSame([Role::EMPLOYEE, Role::ADMIN], Role::eligibleOnly(['ROLE_ADMIN', 'ROLE_EMPLOYEE']));
+    }
+
+    public function testEitherRoleOnItsOwnIsEnough(): void
+    {
+        self::assertSame([Role::EMPLOYEE], Role::eligibleOnly(['ROLE_EMPLOYEE']));
+        self::assertSame([Role::ADMIN], Role::eligibleOnly(['ROLE_ADMIN']));
+    }
+
+    /**
+     * The whole point of the whitelist: myep knows roles this application assigns no meaning to,
+     * and an injected one must not become storable just because it was in the response.
+     */
+    public function testRolesThisApplicationDoesNotKnowAreDropped(): void
+    {
+        $claimed = ['ROLE_TEAMER', 'ROLE_CUSTOMER', 'ROLE_HOUSE_MANAGER', 'ROLE_SUPER_ADMIN', 'ROLE_EMPLOYEE'];
+
+        self::assertSame([Role::EMPLOYEE], Role::eligibleOnly($claimed));
+    }
+
+    public function testAPendingMarkerDoesNotCountAsTheRole(): void
+    {
+        // myep strips these before exporting, but that is its policy and not our guarantee.
+        self::assertSame([], Role::eligibleOnly(['ROLE_ADMIN_PENDING']));
+    }
+
+    public function testTheOrderIsStableRegardlessOfWhatMyepSends(): void
+    {
+        self::assertSame(
+            Role::eligibleOnly(['ROLE_ADMIN', 'ROLE_EMPLOYEE']),
+            Role::eligibleOnly(['ROLE_EMPLOYEE', 'ROLE_ADMIN']),
+        );
+    }
+
+    public function testAnEmptyClaimYieldsNothing(): void
+    {
+        self::assertSame([], Role::eligibleOnly([]));
+        self::assertSame([], Role::eligibleOnly(['ROLE_USER']));
+    }
+}