feat: harden the myep OAuth2 login

tests/Security/UserCheckerTest.php

@@ -0,0 +1,82 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security;
+
+use App\Entity\User;
+use App\Security\UserChecker;
+use App\Service\AuditLogger;
+use Monolog\Handler\TestHandler;
+use Monolog\Logger;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException;
+
+/**
+ * The local lockout, which is the one access decision myep has no say in.
+ */
+class UserCheckerTest extends TestCase
+{
+    private TestHandler $auditRecords;
+
+    protected function setUp(): void
+    {
+        $this->auditRecords = new TestHandler();
+    }
+
+    public function testAnOrdinaryAccountPasses(): void
+    {
+        $this->expectNotToPerformAssertions();
+
+        $this->checker()->checkPreAuth(new User('[email protected]', 'Anna'));
+    }
+
+    public function testALockedOutAccountIsRefusedWithItsReason(): void
+    {
+        $user = new User('[email protected]', 'Anna');
+        $user->disable('Auf eigenen Wunsch');
+
+        $this->expectException(CustomUserMessageAccountStatusException::class);
+        $this->expectExceptionMessage('Auf eigenen Wunsch');
+
+        $this->checker()->checkPreAuth($user);
+    }
+
+    public function testALockoutWithoutAReasonStillSaysWhatHappened(): void
+    {
+        $user = new User('[email protected]', 'Anna');
+        $user->disable();
+
+        $this->expectException(CustomUserMessageAccountStatusException::class);
+        $this->expectExceptionMessage('gesperrt');
+
+        $this->checker()->checkPreAuth($user);
+    }
+
+    /**
+     * The authenticator audits the refusals it can see; this one happens after it has handed the
+     * passport over, so the trail would otherwise show a sign-in that simply never completed.
+     */
+    public function testTheRefusalIsAudited(): void
+    {
+        $user = new User('[email protected]', 'Anna');
+        $user->disable('Auf eigenen Wunsch');
+
+        try {
+            $this->checker()->checkPreAuth($user);
+        } catch (CustomUserMessageAccountStatusException) {
+        }
+
+        $records = $this->auditRecords->getRecords();
+
+        self::assertCount(1, $records);
+        self::assertSame('Sign-in refused.', $records[0]->message);
+        self::assertSame('account_disabled', $records[0]->context['reason']);
+        self::assertSame('[email protected]', $records[0]->context['account']);
+    }
+
+    private function checker(): UserChecker
+    {
+        return new UserChecker(new AuditLogger(new Logger('audit', [$this->auditRecords])));
+    }
+}