feat: harden the myep oauth2 client

src/Security/MyEpAuthenticator.php

@@ -6,6 +6,7 @@ use App\BusProNet\UserDataHandler;
 use App\Entity\Teamer;
 use App\Entity\User;
 use App\RequiredTeamerCheck\RequiredTeamerCheckRegistry;
+use App\Security\OAuth2\AuthorizationDeniedException;
 use App\Security\OAuth2\AuthorizationRequestException;
 use App\Security\OAuth2\MyEpClient;
 use Doctrine\ORM\EntityManagerInterface;
@@ -34,6 +35,12 @@ class MyEpAuthenticator extends AbstractAuthenticator
      * The roles that entitle someone to log in here at all. Anything else MyE&P reports
      * is dropped rather than stored, so that no role this application assigns a meaning
      * to can be set from the outside.
+     *
+     * This list exists a second time on MyE&P, as the required_roles of this application's
+     * oauth2_client row: MyE&P refuses the authorization request outright when the account
+     * holds none of them, and explains why on its own page. The two are one policy written
+     * twice and must be changed together — widening only one either strands a user at MyE&P
+     * with no explanation this side can give, or lets one through to be refused here.
      */
     private const ELIGIBLE_ROLES = ['ROLE_TEAM_ADMIN', 'ROLE_TEAMER', 'ROLE_MANAGER', 'ROLE_HOUSE_MANAGER'];
 
@@ -63,11 +70,18 @@ class MyEpAuthenticator extends AbstractAuthenticator
     {
         try {
             $accessToken = $this->client->fetchAccessToken($request);
+        } catch (AuthorizationDeniedException $e) {
+            // MyE&P said why it sent no code, so this is not a failure to report as one
+            $this->logger->info('Login via MyE&P was denied', [
+                'error' => $e->getError(),
+                'error_description' => $e->getErrorDescription(),
+            ]);
+            throw new CustomUserMessageAuthenticationException('Login via MyE&P wurde abgebrochen');
         } catch (AuthorizationRequestException|IdentityProviderException $e) {
             $this->logger->error('Login via MyE&P failed due to unobtainable access token', [
                 'exception' => $e,
             ]);
-            throw new CustomUserMessageAuthenticationException('Invalid token');
+            throw new CustomUserMessageAuthenticationException('Login via MyE&P nicht möglich');
         }
 
         try {