feat: expose winter placements to n8n over an api endpoint

tests/Security/AccessToken/ApiKeyTokenHandlerTest.php

@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security\AccessToken;
+
+use App\Security\AccessToken\ApiKeyTokenHandler;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+use Symfony\Component\Security\Core\Exception\BadCredentialsException;
+
+/**
+ * Each key resolves to its own caller, and an unconfigured key must not open the door for an
+ * empty one: hash_equals('', '') is true.
+ */
+class ApiKeyTokenHandlerTest extends TestCase
+{
+    public function testEachKeyResolvesToItsOwnCaller(): void
+    {
+        $handler = $this->handler(['api' => 'forms-key', 'n8n' => 'n8n-key']);
+
+        $this->assertSame('api', $handler->getUserBadgeFrom('forms-key')->getUserIdentifier());
+        $this->assertSame('n8n', $handler->getUserBadgeFrom('n8n-key')->getUserIdentifier());
+    }
+
+    public function testAWrongKeyIsRejected(): void
+    {
+        $this->expectException(BadCredentialsException::class);
+
+        $this->handler(['api' => 'forms-key', 'n8n' => 'n8n-key'])->getUserBadgeFrom('other-key');
+    }
+
+    /**
+     * The extractor never hands over an empty key, but the handler must not rely on that.
+     */
+    public function testAnUnconfiguredKeyDoesNotAcceptAnEmptyOne(): void
+    {
+        $this->expectException(BadCredentialsException::class);
+
+        $this->handler(['api' => 'forms-key', 'n8n' => ''])->getUserBadgeFrom('');
+    }
+
+    public function testAnUnconfiguredKeyLeavesTheOtherWorking(): void
+    {
+        $this->assertSame('api', $this->handler(['api' => 'forms-key', 'n8n' => ''])->getUserBadgeFrom('forms-key')->getUserIdentifier());
+    }
+
+    #[DataProvider('anyKey')]
+    public function testNoConfiguredKeyRejectsEverything(string $key): void
+    {
+        $this->expectException(BadCredentialsException::class);
+
+        $this->handler(['api' => '', 'n8n' => ''])->getUserBadgeFrom($key);
+    }
+
+    public static function anyKey(): iterable
+    {
+        yield 'empty' => [''];
+        yield 'some' => ['forms-key'];
+    }
+
+    /**
+     * @param array<string, string> $keys
+     */
+    private function handler(array $keys): ApiKeyTokenHandler
+    {
+        return new ApiKeyTokenHandler($keys, new NullLogger());
+    }
+}