feat: let admins notify all users about updated access codes

tests/Controller/Admin/AccessCodeAdminControllerTest.php

@@ -56,6 +56,10 @@ class AccessCodeAdminControllerTest extends WebTestCase
         self::assertResponseStatusCodeSame(Response::HTTP_FORBIDDEN);
         $this->em->clear();
         self::assertNotNull($this->em->find(AccessCode::class, $code->getId()));
+
+        $this->client->request('POST', '/admin/access-codes/notify', ['_token' => 'whatever'], server: ['HTTP_HX-Request' => 'true']);
+        self::assertResponseStatusCodeSame(Response::HTTP_FORBIDDEN);
+        self::assertEmailCount(0);
     }
 
     /**
@@ -219,6 +223,59 @@ class AccessCodeAdminControllerTest extends WebTestCase
         self::assertNotNull($this->em->find(AccessCode::class, $code->getId()));
     }
 
+    /**
+     * Everybody who can sign in gets a mail of their own, and none of them contains a code -- not
+     * even one only the recipient's own role could read.
+     */
+    public function testNotifyingTheStaffMailsEveryActiveUserWithoutTheCodes(): void
+    {
+        $this->code('Aufzug', '4711');
+        $this->code('Tresor', '9876');
+        $admin = $this->admin();
+        $this->user('[email protected]');
+        $locked = $this->user('[email protected]');
+        $locked->disable('ausgeschieden');
+        $this->em->flush();
+        $expected = $this->em->getRepository(User::class)->count(['disabledAt' => null]);
+        $this->client->loginUser($admin);
+        $uri = '/admin/access-codes/notify';
+
+        $modal = $this->client->request('GET', $uri, server: ['HTTP_HX-Request' => 'true']);
+        self::assertStringContainsString(\sprintf('%d Mitarbeitende', $expected), $modal->text());
+
+        $this->client->request('POST', $uri, ['_token' => $this->confirmationToken($uri)], server: ['HTTP_HX-Request' => 'true']);
+
+        self::assertSame('/admin/access-codes', $this->client->getResponse()->headers->get('HX-Redirect'));
+        self::assertEmailCount($expected);
+
+        $recipients = [];
+        foreach (self::getMailerMessages() as $email) {
+            self::assertCount(1, $email->getTo());
+            $recipients[] = $email->getTo()[0]->getAddress();
+
+            foreach ([$email->getTextBody(), $email->getHtmlBody()] as $body) {
+                self::assertStringContainsString('https://localhost/access-codes', $body);
+                self::assertStringNotContainsString('4711', $body);
+                self::assertStringNotContainsString('9876', $body);
+                self::assertStringNotContainsString('Aufzug', $body);
+            }
+        }
+
+        self::assertContains('[email protected]', $recipients);
+        self::assertContains('[email protected]', $recipients);
+        self::assertNotContains('[email protected]', $recipients);
+    }
+
+    public function testNotifyingTheStaffNeedsAValidToken(): void
+    {
+        $this->client->loginUser($this->admin());
+
+        $this->client->request('POST', '/admin/access-codes/notify', ['_token' => 'whatever'], server: ['HTTP_HX-Request' => 'true']);
+
+        self::assertResponseStatusCodeSame(Response::HTTP_FORBIDDEN);
+        self::assertEmailCount(0);
+    }
+
     /**
      * Opens the modal, then posts the given fields with its CSRF token -- the round trip a
      * browser makes.