feat: expose winter placements to n8n over an api endpoint

tests/Security/AccessToken/ApiKeyTokenHandlerTest.php

@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security\AccessToken;
+
+use App\Security\AccessToken\ApiKeyTokenHandler;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+use Symfony\Component\Security\Core\Exception\BadCredentialsException;
+
+/**
+ * Each key resolves to its own caller, and an unconfigured key must not open the door for an
+ * empty one: hash_equals('', '') is true.
+ */
+class ApiKeyTokenHandlerTest extends TestCase
+{
+    public function testEachKeyResolvesToItsOwnCaller(): void
+    {
+        $handler = $this->handler(['api' => 'forms-key', 'n8n' => 'n8n-key']);
+
+        $this->assertSame('api', $handler->getUserBadgeFrom('forms-key')->getUserIdentifier());
+        $this->assertSame('n8n', $handler->getUserBadgeFrom('n8n-key')->getUserIdentifier());
+    }
+
+    public function testAWrongKeyIsRejected(): void
+    {
+        $this->expectException(BadCredentialsException::class);
+
+        $this->handler(['api' => 'forms-key', 'n8n' => 'n8n-key'])->getUserBadgeFrom('other-key');
+    }
+
+    /**
+     * The extractor never hands over an empty key, but the handler must not rely on that.
+     */
+    public function testAnUnconfiguredKeyDoesNotAcceptAnEmptyOne(): void
+    {
+        $this->expectException(BadCredentialsException::class);
+
+        $this->handler(['api' => 'forms-key', 'n8n' => ''])->getUserBadgeFrom('');
+    }
+
+    public function testAnUnconfiguredKeyLeavesTheOtherWorking(): void
+    {
+        $this->assertSame('api', $this->handler(['api' => 'forms-key', 'n8n' => ''])->getUserBadgeFrom('forms-key')->getUserIdentifier());
+    }
+
+    #[DataProvider('anyKey')]
+    public function testNoConfiguredKeyRejectsEverything(string $key): void
+    {
+        $this->expectException(BadCredentialsException::class);
+
+        $this->handler(['api' => '', 'n8n' => ''])->getUserBadgeFrom($key);
+    }
+
+    public static function anyKey(): iterable
+    {
+        yield 'empty' => [''];
+        yield 'some' => ['forms-key'];
+    }
+
+    /**
+     * @param array<string, string> $keys
+     */
+    private function handler(array $keys): ApiKeyTokenHandler
+    {
+        return new ApiKeyTokenHandler($keys, new NullLogger());
+    }
+}

tests/Security/Voter/ApplicationVoterTest.php

@@ -0,0 +1,61 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security\Voter;
+
+use App\Entity\Application;
+use App\Entity\Assignment;
+use App\Entity\Disposition;
+use App\Entity\Teamer;
+use App\Security\Voter\ApplicationVoter;
+use PHPUnit\Framework\TestCase;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+
+/**
+ * A called-off placement frees its place. Counting it would leave the office with raising
+ * availableDispositions as the only way to re-staff - which adds a place to the n8n feed, where a
+ * place is a row the Wechselpass hangs off.
+ */
+class ApplicationVoterTest extends TestCase
+{
+    public function testACalledOffPlaceCanBeStaffedAgain(): void
+    {
+        $assignment = (new Assignment())->setAvailableDispositions(2);
+        $this->dispose($assignment);
+        $this->dispose($assignment)->setStatus(Disposition::STATUS_CALLED_OFF);
+
+        $this->assertSame(VoterInterface::ACCESS_GRANTED, $this->voteDispose($assignment));
+    }
+
+    public function testAFullAssignmentCannotBeStaffed(): void
+    {
+        $assignment = (new Assignment())->setAvailableDispositions(2);
+        $this->dispose($assignment);
+        $this->dispose($assignment);
+
+        $this->assertSame(VoterInterface::ACCESS_DENIED, $this->voteDispose($assignment));
+    }
+
+    private function dispose(Assignment $assignment): Disposition
+    {
+        $disposition = new Disposition(new Application($assignment, new Teamer()));
+        $assignment->addDisposition($disposition);
+
+        return $disposition;
+    }
+
+    private function voteDispose(Assignment $assignment): int
+    {
+        $security = $this->createStub(Security::class);
+        $security->method('isGranted')->willReturnCallback(fn (string $role) => 'ROLE_ADMINISTRATIVE' === $role);
+
+        return (new ApplicationVoter($security))->vote(
+            $this->createStub(TokenInterface::class),
+            new Application($assignment, new Teamer()),
+            [ApplicationVoter::DISPOSE],
+        );
+    }
+}