feat: demotion of user accounts via crm

2026-08-10 13:01:01 +02:00
parent b01c2e84c7
commit b39a78da82
11 changed files with 240 additions and 3 deletions
@@ -213,6 +213,58 @@ class UserDataHandlerTest extends TestCase
        ];
    }

+    public function testDisableForRevokedCrmRolesBlocksTheUserAndDropsThePendingMarkers(): void
+    {
+        $user = (new User())
+            ->setFirstName('First')
+            ->setLastName('Last')
+            ->setEmail('[email protected]')
+            ->setRoles(['ROLE_ADMIN', User::PENDING_ROLES['ROLE_MANAGER']])
+        ;
+
+        $this->entityManager
+            ->expects($this->once())
+            ->method('flush');
+
+        $handler = new UserDataHandler($this->entityManager, $this->logger);
+        $handler->disableForRevokedCrmRoles($user);
+
+        $this->assertTrue($user->isDisabled());
+        $this->assertNotNull($user->getDisabledAt());
+        $this->assertSame('Für deinen Account liegt in BusPro keine Berechtigung mehr vor.', $user->getDisabledReason());
+        $this->assertSame('Automatisch gesperrt: keine Rollen in BusPro.', $user->getDisabledReasonInternal());
+
+        // the granted role is kept so the user stays reviewable, the marker is not
+        $this->assertSame(['ROLE_ADMIN'], $user->getAssignedRoles());
+        $this->assertSame([], $user->getPendingRoles());
+    }
+
+    public function testDisableForRevokedCrmRolesLeavesAnExistingBlockUntouched(): void
+    {
+        $disabledAt = new \DateTimeImmutable('2026-01-01 08:00:00');
+
+        $user = (new User())
+            ->setFirstName('First')
+            ->setLastName('Last')
+            ->setEmail('[email protected]')
+            ->setRoles(['ROLE_ADMIN'])
+            ->setDisabledAt($disabledAt)
+            ->setDisabledReason('Wegen Fehlverhaltens gesperrt.')
+            ->setDisabledReasonInternal('Siehe Vorgang 4711.')
+        ;
+
+        $this->entityManager
+            ->expects($this->never())
+            ->method('flush');
+
+        $handler = new UserDataHandler($this->entityManager, $this->logger);
+        $handler->disableForRevokedCrmRoles($user);
+
+        $this->assertSame($disabledAt, $user->getDisabledAt());
+        $this->assertSame('Wegen Fehlverhaltens gesperrt.', $user->getDisabledReason());
+        $this->assertSame('Siehe Vorgang 4711.', $user->getDisabledReasonInternal());
+    }
+
    public function testFindLocalUserFallsBackToUniqueEmailAndRefreshesBusProIds(): void
    {
        $user = (new User())
@@ -77,6 +77,47 @@ class UserTest extends TestCase
        $this->assertCount(0, $this->validate($user));
    }

+    public function testSetDisabledBlocksAndUnblocksTheAccount(): void
+    {
+        $user = new User();
+
+        $user->setDisabled(true);
+
+        $this->assertTrue($user->isDisabled());
+        $this->assertNotNull($user->getDisabledAt());
+
+        $user
+            ->setDisabledReason('Gesperrt.')
+            ->setDisabledReasonInternal('Siehe Vorgang 4711.')
+            ->setDisabled(false)
+        ;
+
+        $this->assertFalse($user->isDisabled());
+        $this->assertNull($user->getDisabledAt());
+        $this->assertNull($user->getDisabledReason());
+        $this->assertNull($user->getDisabledReasonInternal());
+    }
+
+    public function testSetDisabledKeepsTheOriginalTimestampWhenTheStateIsUnchanged(): void
+    {
+        $disabledAt = new \DateTimeImmutable('2026-01-01 08:00:00');
+
+        $user = (new User())
+            ->setDisabledAt($disabledAt)
+            ->setDisabledReason('Gesperrt.')
+        ;
+
+        $user->setDisabled(true);
+
+        $this->assertSame($disabledAt, $user->getDisabledAt());
+        $this->assertSame('Gesperrt.', $user->getDisabledReason());
+
+        $enabled = new User();
+        $enabled->setDisabled(false);
+
+        $this->assertNull($enabled->getDisabledAt());
+    }
+
    private function validate(User $user): ConstraintViolationListInterface
    {
        return Validation::createValidatorBuilder()
@@ -84,6 +84,49 @@ class UserTypeTest extends KernelTestCase
        $this->assertCount(1, $form->get('superAdmin')->getErrors());
    }

+    public function testSubmitBlocksTheAccountWithAReason(): void
+    {
+        $user = (new User())->setRoles(['ROLE_ADMIN']);
+
+        $form = $this->createForm($user);
+        $form->submit([
+            'roles' => ['ROLE_ADMIN'],
+            'superAdmin' => null,
+            'hotelCodes' => [],
+            'disabled' => '1',
+            'disabledReason' => 'Wegen Fehlverhaltens gesperrt.',
+        ]);
+
+        $this->assertTrue($form->isValid());
+        $this->assertTrue($user->isDisabled());
+        $this->assertSame('Wegen Fehlverhaltens gesperrt.', $user->getDisabledReason());
+    }
+
+    public function testSubmitUnblocksTheAccountAndClearsTheReasons(): void
+    {
+        $user = (new User())
+            ->setRoles(['ROLE_ADMIN'])
+            ->setDisabledAt(new \DateTimeImmutable('2026-01-01 08:00:00'))
+            ->setDisabledReason('Für deinen Account liegt in BusPro keine Berechtigung mehr vor.')
+            ->setDisabledReasonInternal('Automatisch gesperrt: keine Rollen in BusPro.')
+        ;
+
+        $form = $this->createForm($user);
+        $form->submit([
+            'roles' => ['ROLE_ADMIN'],
+            'superAdmin' => null,
+            'hotelCodes' => [],
+            'disabled' => null,
+            'disabledReason' => null,
+        ]);
+
+        $this->assertTrue($form->isValid());
+        $this->assertFalse($user->isDisabled());
+        $this->assertNull($user->getDisabledReason());
+        $this->assertNull($user->getDisabledReasonInternal());
+        $this->assertSame(['ROLE_ADMIN'], $user->getAssignedRoles());
+    }
+
    private function createForm(User $user): \Symfony\Component\Form\FormInterface
    {
        self::bootKernel();