feat: add supervisor role

tests/Controller/AccessCodeControllerTest.php

@@ -82,6 +82,46 @@ class AccessCodeControllerTest extends WebTestCase
         self::assertStringContainsString('Administration', $card->text());
     }
 
+    /**
+     * A supervisor code is read by supervisors and by administrators, who hold no
+     * ROLE_SUPERVISOR of their own -- role_hierarchy does not reach the stored roles the query
+     * filters on. And a supervisor is not an administrator: the admin-only code stays out of
+     * their response.
+     */
+    public function testASupervisorCodeIsReadBySupervisorsAndAdminsOnly(): void
+    {
+        $this->code('Management office', '5555', visibility: CodeVisibility::SUPERVISOR);
+        $this->code('Serverraum', '9999', visibility: CodeVisibility::ADMIN);
+        $this->em->flush();
+
+        $this->client->loginUser($this->user('[email protected]'));
+        $this->client->request('GET', '/access-codes');
+        self::assertStringNotContainsString('5555', (string) $this->client->getResponse()->getContent());
+
+        $this->client->loginUser($this->user('[email protected]', ['ROLE_EMPLOYEE', 'ROLE_SUPERVISOR']));
+        $card = $this->client->request('GET', '/access-codes')->filter('[data-access-code]');
+        self::assertCount(1, $card);
+        self::assertSame('5555', $card->filter('[data-code]')->text());
+        // The visibility caption the page shows, which is German like all user-facing text.
+        self::assertStringContainsString('Leitung', $card->text());
+        self::assertStringNotContainsString('9999', (string) $this->client->getResponse()->getContent());
+
+        $this->client->loginUser($this->user('[email protected]', ['ROLE_ADMIN']));
+        self::assertCount(2, $this->client->request('GET', '/access-codes')->filter('[data-access-code]'));
+    }
+
+    /**
+     * A supervisor reads codes but does not manage them.
+     */
+    public function testASupervisorIsNotOfferedTheTable(): void
+    {
+        $this->client->loginUser($this->user('[email protected]', ['ROLE_EMPLOYEE', 'ROLE_SUPERVISOR']));
+
+        $crawler = $this->client->request('GET', '/access-codes');
+
+        self::assertCount(0, $crawler->filter('a[href="/admin/access-codes"]'));
+    }
+
     /**
      * Rotating a code. Only the one in force is shown: its predecessor is history, and its
      * successor does not open anything yet -- both would only be another number to mistype.