add ACL-based identity validation to the authenticator

- Introduce `AuthenticatorTrait` to verify user permissions against configured customer and backoffice ACL resources during login.
- Configure the DI extension to inject the `FancyAdmin` service into the authenticator to facilitate resource lookups.

Author: thorewi

src/DI/FancyAdminExtension.php

@@ -16,6 +16,7 @@
 use ADT\FancyAdmin\Model\Entities\Profile;
 use ADT\FancyAdmin\Model\Entities\ProfileTrait;
 use ADT\FancyAdmin\Model\FancyAdmin;
+use ADT\FancyAdmin\Model\Security\Authenticator;
 use ADT\FancyAdmin\Model\Security\SecurityUser;
 use ADT\FancyAdmin\UI\Components\Controls\SidePanel\SidePanelControl;
 use ADT\FancyAdmin\UI\Components\Controls\SidePanel\SidePanelControlFactory;
@@ -134,6 +135,9 @@ public function beforeCompile(): void
 		$securityUserDef = $builder->getDefinitionByType(SecurityUser::class);
 		$securityUserDef->addSetup('setFullDataAclResource', [$this->config->fullDataAclResource]);
 		$securityUserDef->addSetup('setBackofficeAclResource', [$this->config->backofficeAclResource]);
+
+		$authenticatorDef = $builder->getDefinitionByType(Authenticator::class);
+		$authenticatorDef->addSetup('setFancyAdmin', [$this->prefix('@administration')]);
 	}
 
 	private function validateTraitInterfaceCompliance(): void

src/Model/Security/AuthenticatorTrait.php

@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace ADT\FancyAdmin\Model\Security;
+
+use ADT\DoctrineAuthenticator\OTP\Identity;
+use ADT\FancyAdmin\Model\FancyAdmin;
+use Nette\Security\AuthenticationException;
+
+trait AuthenticatorTrait
+{
+	protected FancyAdmin $fancyAdmin;
+
+	public function setFancyAdmin(FancyAdmin $fancyAdmin): void
+	{
+		$this->fancyAdmin = $fancyAdmin;
+	}
+
+	protected function validateIdentity(Identity $identity, ?string $context = null, array $metadata = []): void
+	{
+		/** @var \ADT\FancyAdmin\Model\Entities\Identity $identity */
+		if (
+			!$identity->isAllowed($this->fancyAdmin->getCustomerAclResource())
+			&&
+			!$identity->isAllowed($this->fancyAdmin->getBackofficeAclResource())
+		) {
+			throw new AuthenticationException('Nemáte oprávnění pro přihlášení');
+		}
+	}
+}