feat: share the role policy across identity sources

2026-08-12 17:55:16 +02:00
parent 8b09845d96
commit 450f5b0515
2 changed files with 100 additions and 6 deletions
@@ -83,6 +83,59 @@ class UserDataHandlerTest extends TestCase
        ];
    }

+    /**
+     * The role policy has to be identical whichever identity source claims the role, so
+     * toPendingRoles() must agree with collectPendingRoles() on equivalent input.
+     *
+     * @dataProvider toPendingRolesProvider
+     */
+    public function testToPendingRolesMatchesTheCrmPolicy(array $claimedRoles, CrmAttributesResponse $crmAttributes, array $expectedRoles): void
+    {
+        $handler = new UserDataHandler($this->entityManager, $this->logger);
+
+        $this->assertSame($expectedRoles, $handler->toPendingRoles($claimedRoles));
+        $this->assertSame($expectedRoles, $handler->collectPendingRoles($crmAttributes));
+    }
+
+    public static function toPendingRolesProvider(): iterable
+    {
+        yield 'admin' => [
+            ['ROLE_ADMIN'],
+            (new CrmAttributesResponse())->setAdmin(true),
+            [User::PENDING_ROLES['ROLE_ADMIN']],
+        ];
+
+        yield 'manager takes precedence over house manager' => [
+            ['ROLE_HOUSE_MANAGER', 'ROLE_MANAGER'],
+            (new CrmAttributesResponse())->setManager(true)->setHouseManager(true),
+            [User::PENDING_ROLES['ROLE_MANAGER']],
+        ];
+
+        yield 'house manager' => [
+            ['ROLE_HOUSE_MANAGER'],
+            (new CrmAttributesResponse())->setHouseManager(true),
+            [User::PENDING_ROLES['ROLE_HOUSE_MANAGER']],
+        ];
+
+        yield 'admin and house manager' => [
+            ['ROLE_ADMIN', 'ROLE_HOUSE_MANAGER'],
+            (new CrmAttributesResponse())->setAdmin(true)->setHouseManager(true),
+            [User::PENDING_ROLES['ROLE_ADMIN'], User::PENDING_ROLES['ROLE_HOUSE_MANAGER']],
+        ];
+
+        yield 'teamer has no marker' => [
+            ['ROLE_TEAMER'],
+            (new CrmAttributesResponse())->setTeamer(true),
+            [],
+        ];
+
+        yield 'nothing claimed' => [
+            [],
+            new CrmAttributesResponse(),
+            [],
+        ];
+    }
+
    public function testUpdateLocalUserSyncsUserAndTeamerDataFromBusPro(): void
    {
        $user = (new User())