53 lines
1.7 KiB
PHP
53 lines
1.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Security;
|
|
|
|
/**
|
|
* The roles this application knows about.
|
|
*
|
|
* **This list is a whitelist, not a mirror.** myep's `roles` claim is filtered through it on every
|
|
* login, so a role invented on the identity provider -- or injected into a userinfo response --
|
|
* can never appear on a local account. myep already strips its own `*_PENDING` markers and
|
|
* non-granting roles before exporting them, but that is its policy, not our guarantee.
|
|
*
|
|
* Kept deliberately small: ephub has no notion of teamers, managers or house managers, and
|
|
* storing roles it assigns no meaning to would only invite someone to start checking them.
|
|
*/
|
|
final class Role
|
|
{
|
|
/** Derived on myep from the account's email domain: "works here". */
|
|
public const EMPLOYEE = 'ROLE_EMPLOYEE';
|
|
|
|
/** Administrative on myep -- nominated by the CRM, but only exported once approved there. */
|
|
public const ADMIN = 'ROLE_ADMIN';
|
|
|
|
/**
|
|
* The roles that entitle someone to use ephub at all. Someone who holds neither is refused
|
|
* at login rather than let in without access, so they get an explanation instead of an
|
|
* empty screen they cannot act on.
|
|
*
|
|
* @var list<string>
|
|
*/
|
|
public const ELIGIBLE = [
|
|
self::EMPLOYEE,
|
|
self::ADMIN,
|
|
];
|
|
|
|
/**
|
|
* Whatever of a claimed role set this application recognises, in a stable order.
|
|
*
|
|
* @param list<string> $claimed
|
|
*
|
|
* @return list<string>
|
|
*/
|
|
public static function eligibleOnly(array $claimed): array
|
|
{
|
|
return array_values(array_filter(
|
|
self::ELIGIBLE,
|
|
static fn (string $role): bool => \in_array($role, $claimed, true),
|
|
));
|
|
}
|
|
}
|