feat: add user authentication (#2)

.docker/mariadb/init/01-grant-test-databases.sql

@@ -0,0 +1,20 @@
+-- Create the test database used by PHPUnit and grant the application
+-- user access to it (plus any future ParaTest-suffixed siblings).
+--
+-- Symfony's `when@test` doctrine config appends `_test` to the configured
+-- database name, and the MariaDB image only creates MYSQL_DATABASE and
+-- grants MYSQL_USER on it. Without this file the test suite fails with
+-- either "Unknown database 'db_test'" (database absent) or "Access
+-- denied for user 'db'@'%'" (database present but no grant).
+--
+-- The `\_test` escape on the GRANT pattern matches `db_test`,
+-- `db_test_paratest_1`, etc. — but not unrelated names like `dbXtest`.
+--
+-- This file is mounted into `/docker-entrypoint-initdb.d/` and runs
+-- once when the container's data volume is first initialised. The
+-- `task db-prepare-test` target re-applies the same logic for local
+-- devs whose volume predates the mount.
+
+CREATE DATABASE IF NOT EXISTS `db_test`;
+GRANT ALL PRIVILEGES ON `db\_test%`.* TO `db`@`%`;
+FLUSH PRIVILEGES;

.env

@@ -34,3 +34,7 @@ BRAND_NAME="AI Bibliotek"
 BRAND_TAGLINE="del & hjemtag assistenter"
 BRAND_INITIALS="AI"
 ###< brand identity ###
+
+###> doctrine/doctrine-bundle ###
+DATABASE_URL="mysql://db:db@mariadb:3306/db?serverVersion=10.11.16-MariaDB&charset=utf8mb4"
+###< doctrine/doctrine-bundle ###

.php-cs-fixer.dist.php

@@ -15,6 +15,11 @@
 
 $config->setRules([
   '@Symfony' => true,
+  // Override the Symfony default that vertically aligns @param / @return
+  // columns by padding names and descriptions with spaces. We keep tags
+  // left-aligned so descriptions don't get pushed into hard-to-read
+  // multi-line wraps.
+  'phpdoc_align' => ['align' => 'left'],
 ]);
 
 return $config;

CHANGELOG.md

@@ -16,6 +16,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - PHPUnit test harness with 100% coverage gate enforced in CI via
   `rregeer/phpunit-coverage-check`
   ([#31](https://github.com/itk-dev/ai-lib/issues/31)).
+- User authentication: `User` Doctrine entity (email, hashed password,
+  roles), `UserRepository` (with `PasswordUpgraderInterface`), the
+  `UserManager` service that hides persistence + hashing, form-login
+  firewall + `/login` + `/logout`, fixtures for two baseline users
+  (`alice@example.test`, `bob@example.test` — password `password`),
+  console commands `app:user:create` and `app:user:change-password`,
+  and end-to-end functional + unit tests
+  ([#2](https://github.com/itk-dev/ai-lib/issues/2)).
 
 ### Changed
 

README.md

@@ -145,6 +145,21 @@ task open
 The site is served through Traefik on a `*.local.itkdev.dk` domain (the exact
 URL is printed by the start task).
 
+### Creating the first user
+
+```sh
+# Option A — load the local-dev fixtures (alice + bob, password `password`)
+task console -- doctrine:fixtures:load -n
+
+# Option B — create a single user explicitly
+task console -- app:user:create alice@example.test secret
+
+# Change an existing user's password
+task console -- app:user:change-password alice@example.test newsecret
+```
+
+Then sign in at `/login`.
+
 ## Testing
 
 Tests live under `tests/` (PSR-4 namespace `App\Tests\`) and run with

Taskfile.yml

@@ -36,11 +36,12 @@ tasks:
   # ---- Lifecycle --------------------------------------------------------
 
   site-install:
-    desc: 'Pull images, start the stack, and install Composer dependencies.'
+    desc: 'Pull images, start the stack, install Composer dependencies, and apply database migrations.'
     cmds:
       - task compose -- pull
       - task compose -- up --detach --remove-orphans --wait
       - task composer-install
+      - task console -- doctrine:migrations:migrate --no-interaction
     silent: true
 
   # ---- Composer ---------------------------------------------------------
@@ -91,15 +92,27 @@ tasks:
 
   # ---- Tests ------------------------------------------------------------
 
+  db-prepare-test:
+    desc: 'Ensure the test database exists and the app user can write to it (idempotent).'
+    cmds:
+      # Re-apply the init SQL on every invocation so local devs whose
+      # mariadb data volume predates the init mount also pick up the
+      # CREATE DATABASE + GRANT. The script is IF-NOT-EXISTS / additive
+      # only — no row data is read or written.
+      - cat .docker/mariadb/init/01-grant-test-databases.sql | task compose-exec -- mariadb mariadb -uroot -ppassword
+    silent: true
+
   test:
     desc: 'Run the PHPUnit test suite (no coverage).'
     cmds:
+      - task: db-prepare-test
       - task compose-exec -- phpfpm vendor/bin/phpunit
     silent: true
 
   test-coverage:
     desc: 'Run PHPUnit with coverage and enforce the 100% gate.'
     cmds:
+      - task: db-prepare-test
       - task compose -- exec -e XDEBUG_MODE=coverage phpfpm vendor/bin/phpunit --coverage-clover=coverage/clover.xml
       - task compose-exec -- phpfpm vendor/bin/coverage-check coverage/clover.xml 100
     silent: true

composer.json

@@ -7,13 +7,17 @@
         "php": ">=8.4",
         "ext-ctype": "*",
         "ext-iconv": "*",
+        "doctrine/doctrine-bundle": "^3.2",
+        "doctrine/doctrine-migrations-bundle": "^4.0",
+        "doctrine/orm": "^3.6",
         "symfony/asset": "^8.1",
         "symfony/asset-mapper": "^8.1",
         "symfony/console": "~8.1.0",
         "symfony/dotenv": "~8.1.0",
         "symfony/flex": "^2",
         "symfony/framework-bundle": "~8.1.0",
         "symfony/runtime": "~8.1.0",
+        "symfony/security-bundle": "~8.1.0",
         "symfony/stimulus-bundle": "^3.1",
         "symfony/translation": "~8.1.0",
         "symfony/twig-bundle": "~8.1.0",
@@ -24,12 +28,14 @@
         "twig/twig": "^2.12 || ^3.0"
     },
     "require-dev": {
+        "doctrine/doctrine-fixtures-bundle": "^4.3",
         "ergebnis/composer-normalize": "^2.52",
         "friendsofphp/php-cs-fixer": "^3.95.5",
         "phpunit/phpunit": "^11.5",
         "rregeer/phpunit-coverage-check": "^0.3.1",
         "symfony/browser-kit": "~8.1.0",
         "symfony/css-selector": "~8.1.0",
+        "symfony/maker-bundle": "^1.67",
         "symfony/phpunit-bridge": "~8.1.0",
         "vincentlanglet/twig-cs-fixer": "^3.14"
     },