From dc1822b8cfb1835af7a5ec04168e7cda838dff0e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= Date: Thu, 17 Sep 2026 17:55:58 +0200 Subject: [PATCH] chore: remove the seed command and the dev login --- config/packages/security.yaml | 12 -- config/routes/dev_login.yaml | 7 -- src/Command/SeedCommand.php | 147 ------------------------- src/Controller/Dev/LoginController.php | 38 ------- src/Security/DevLoginAuthenticator.php | 68 ------------ templates/dev/login.html.twig | 40 ------- templates/security/login.html.twig | 8 -- 7 files changed, 320 deletions(-) delete mode 100644 config/routes/dev_login.yaml delete mode 100644 src/Command/SeedCommand.php delete mode 100644 src/Controller/Dev/LoginController.php delete mode 100644 src/Security/DevLoginAuthenticator.php delete mode 100644 templates/dev/login.html.twig diff --git a/config/packages/security.yaml b/config/packages/security.yaml index a81bf21..5d78b96 100644 --- a/config/packages/security.yaml +++ b/config/packages/security.yaml @@ -27,7 +27,6 @@ security: # The login surface itself has to stay reachable, or the entry point redirects in a loop. - { path: ^/(login|auth|logout)$, roles: PUBLIC_ACCESS } - { path: ^/auth/, roles: PUBLIC_ACCESS } - - { path: ^/dev/, roles: PUBLIC_ACCESS } # Before the catch-all, or ROLE_EMPLOYEE would match ^/ first and the admin area would be # open to everybody. Order is the whole guard here. - { path: ^/admin, roles: ROLE_ADMIN } @@ -36,14 +35,3 @@ security: # neither of these is refused at login with an explanation rather than let in to an # empty screen. - { path: ^/, roles: [ROLE_EMPLOYEE, ROLE_ADMIN] } - -when@dev: - security: - firewalls: - main: - # Until a client is registered on myep, /dev/login lists the seeded users and - # logs one in without credentials. The route and the controller are both - # dev-only, so this cannot leak into another environment by accident. - custom_authenticators: - - App\Security\EpAuthenticator - - App\Security\DevLoginAuthenticator diff --git a/config/routes/dev_login.yaml b/config/routes/dev_login.yaml deleted file mode 100644 index 5c1b56f..0000000 --- a/config/routes/dev_login.yaml +++ /dev/null @@ -1,7 +0,0 @@ -# Dev-only stand-in for the OAuth2 login. The controller carries no #[Route] attribute, so -# outside dev this route simply does not exist. -when@dev: - app_dev_login: - path: /dev/login - controller: App\Controller\Dev\LoginController::index - methods: [GET, POST] diff --git a/src/Command/SeedCommand.php b/src/Command/SeedCommand.php deleted file mode 100644 index f69f24a..0000000 --- a/src/Command/SeedCommand.php +++ /dev/null @@ -1,147 +0,0 @@ - $label) { - [$room, $isNew] = $this->ensureGroup(ResourceType::DESK, $label, $position); - $rooms[] = $room; - $created += $isNew; - } - - for ($i = 1; $i <= 12; ++$i) { - $created += $this->ensureResource( - ResourceType::DESK, - \sprintf('Schreibtisch %02d', $i), - $rooms[intdiv($i - 1, 3)], - ); - } - - // Parking is deliberately left ungrouped: the car park is one area, and it is what keeps - // the "a plan without rooms" path exercised by real data. - for ($i = 1; $i <= 6; ++$i) { - $created += $this->ensureResource(ResourceType::PARKING, \sprintf('Parkplatz %02d', $i)); - } - - // One administrator on purpose, so the dev environment exercises both roles that open - // the app. An admin here is also staff, which is the realistic case. - foreach ([ - ['anna.berger@example.test', 'Anna Berger', [Role::EMPLOYEE]], - ['ben.kuhn@example.test', 'Ben Kuhn', [Role::EMPLOYEE, Role::ADMIN]], - ['clara.dietz@example.test', 'Clara Dietz', [Role::EMPLOYEE]], - ['david.roth@example.test', 'David Roth', [Role::EMPLOYEE]], - ['elif.yilmaz@example.test', 'Elif Yılmaz', [Role::EMPLOYEE]], - ] as [$email, $name, $roles]) { - $created += $this->ensureUser($email, $name, $roles); - } - - $this->em->flush(); - - $io->success(\sprintf('%d new records created.', $created)); - - return Command::SUCCESS; - } - - private function ensureResource(ResourceType $type, string $label, ?ResourceGroup $group = null): int - { - $resource = $this->resources->findOneBy(['type' => $type, 'label' => $label]); - - if (null !== $resource) { - // Backfill only. A resource seeded before groups existed has no room and would never - // be listed under one, but a group somebody moved it into by hand is left alone. - if (null !== $group && null === $resource->getGroup()) { - $resource->setGroup($group); - } - - return 0; - } - - $resource = new Resource($type, $label); - $resource->setGroup($group); - $this->em->persist($resource); - - return 1; - } - - /** - * @return array{ResourceGroup, int} the group, and 1 if it was created - */ - private function ensureGroup(ResourceType $type, string $label, int $position): array - { - $group = $this->groups->findOneBy(['type' => $type, 'label' => $label]); - - if (null !== $group) { - return [$group, 0]; - } - - $group = new ResourceGroup($type, $label, $position); - $this->em->persist($group); - - return [$group, 1]; - } - - /** - * @param list $roles - */ - private function ensureUser(string $email, string $name, array $roles): int - { - if (null !== $this->users->findOneBy(['email' => $email])) { - return 0; - } - - $user = new User($email, $name); - // Mirrors what EpAuthenticator does: whatever myep claims is filtered through - // Role::ELIGIBLE, and only those roles are ever stored. - $user->setRoles(Role::eligibleOnly($roles)); - $this->em->persist($user); - - return 1; - } -} diff --git a/src/Controller/Dev/LoginController.php b/src/Controller/Dev/LoginController.php deleted file mode 100644 index e173e53..0000000 --- a/src/Controller/Dev/LoginController.php +++ /dev/null @@ -1,38 +0,0 @@ -getUser()) { - return $this->redirectToRoute('app_dashboard'); - } - - // POST never reaches here -- DevLoginAuthenticator intercepts it on the firewall. - return $this->render('dev/login.html.twig', [ - 'users' => $this->users->findBy([], ['name' => 'ASC']), - ]); - } -} diff --git a/src/Security/DevLoginAuthenticator.php b/src/Security/DevLoginAuthenticator.php deleted file mode 100644 index 115f389..0000000 --- a/src/Security/DevLoginAuthenticator.php +++ /dev/null @@ -1,68 +0,0 @@ -attributes->get('_route') && $request->isMethod('POST'); - } - - public function authenticate(Request $request): Passport - { - $id = $request->request->getInt('user'); - - return new SelfValidatingPassport(new UserBadge((string) $id, function (string $identifier) { - $user = $this->users->find((int) $identifier); - - if (null === $user) { - throw new CustomUserMessageAuthenticationException('Unbekannter Benutzer.'); - } - - return $user; - })); - } - - public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response - { - return new RedirectResponse($this->urlGenerator->generate('app_dashboard')); - } - - public function onAuthenticationFailure(Request $request, AuthenticationException $exception): ?Response - { - $request->getSession()->getFlashBag()->add('error', $exception->getMessageKey()); - - return new RedirectResponse($this->urlGenerator->generate('app_dev_login')); - } -} diff --git a/templates/dev/login.html.twig b/templates/dev/login.html.twig deleted file mode 100644 index 1209765..0000000 --- a/templates/dev/login.html.twig +++ /dev/null @@ -1,40 +0,0 @@ -{% extends 'base.html.twig' %} - -{% block title %}Anmelden · ephub{% endblock %} - -{% block body %} -
-
- ephub - -
- Nur für die Entwicklung. - Die echte Anmeldung läuft über myep (OAuth2) und wartet auf die Client-Registrierung dort. -
- -

- Zur regulären Anmeldung -

- - {% if users is empty %} -

- Keine Benutzer vorhanden. bin/console app:seed ausführen. -

- {% else %} -
- {% for user in users %} - - {% endfor %} -
- {% endif %} - -
- {% include '_partials/_flashes.html.twig' %} -
-
-
-{% endblock %} diff --git a/templates/security/login.html.twig b/templates/security/login.html.twig index 5790552..863fb05 100644 --- a/templates/security/login.html.twig +++ b/templates/security/login.html.twig @@ -18,14 +18,6 @@ Mit myep anmelden - {% if app.environment == 'dev' %} -

- - Entwickler-Login - -

- {% endif %} -
{% include '_partials/_flashes.html.twig' %}