<?php

declare(strict_types=1);

namespace App\Controllers;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Slim\Views\Twig;

/**
 * Lands here when an OIDC-authenticated user has no role grant.
 * `OIDC_DEFAULT_ROLE=none` + no group mapping match means the api
 * response carries `role = "none"`; the OidcController bounces here
 * instead of calling `setUser()`.
 */
final class NoAccessController
{
    public function __construct(private readonly Twig $twig)
    {
    }

    public function __invoke(ServerRequestInterface $request, ResponseInterface $response): ResponseInterface
    {
        return $this->twig->render($response, 'pages/no-access.twig');
    }
}
