feat: harden the myep OAuth2 login

tests/Command/LockUserCommandTest.php

@@ -0,0 +1,88 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Command;
+
+use App\Entity\User;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Console\Application;
+use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
+use Symfony\Component\Console\Tester\CommandTester;
+
+/**
+ * The only way to set the flag the UserChecker reads.
+ */
+class LockUserCommandTest extends KernelTestCase
+{
+    private EntityManagerInterface $em;
+    private CommandTester $command;
+
+    protected function setUp(): void
+    {
+        self::bootKernel();
+        $this->em = self::getContainer()->get(EntityManagerInterface::class);
+        $this->em->getConnection()->beginTransaction();
+        $this->command = new CommandTester((new Application(self::$kernel))->find('app:user:lock'));
+    }
+
+    protected function tearDown(): void
+    {
+        $this->em->getConnection()->rollBack();
+        parent::tearDown();
+    }
+
+    public function testAnAccountIsLockedWithItsReason(): void
+    {
+        $user = $this->user();
+
+        $this->command->execute(['email' => '[email protected]', 'reason' => 'Auf eigenen Wunsch']);
+
+        $this->command->assertCommandIsSuccessful();
+        self::assertTrue($user->isDisabled());
+        self::assertSame('Auf eigenen Wunsch', $user->getDisabledReason());
+    }
+
+    public function testTheLockIsReleasedAgain(): void
+    {
+        $user = $this->user();
+        $user->disable('Auf eigenen Wunsch');
+        $this->em->flush();
+
+        $this->command->execute(['email' => '[email protected]', '--release' => true]);
+
+        $this->command->assertCommandIsSuccessful();
+        self::assertFalse($user->isDisabled());
+        self::assertNull($user->getDisabledReason());
+    }
+
+    /**
+     * Addresses are stored normalised, so a differently cased argument has to find the row
+     * rather than report that there is none.
+     */
+    public function testTheAddressIsMatchedTheWayALoginMatchesIt(): void
+    {
+        $user = $this->user();
+
+        $this->command->execute(['email' => ' [email protected] ']);
+
+        $this->command->assertCommandIsSuccessful();
+        self::assertTrue($user->isDisabled());
+    }
+
+    public function testAnUnknownAddressFails(): void
+    {
+        self::assertSame(1, $this->command->execute(['email' => '[email protected]']));
+        self::assertStringContainsString('No account', $this->command->getDisplay());
+    }
+
+    private function user(): User
+    {
+        $user = new User('[email protected]', 'Anna');
+        $user->setRoles(['ROLE_EMPLOYEE']);
+        $this->em->persist($user);
+        $this->em->flush();
+
+        return $user;
+    }
+}