EP/myep-team
4
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: provision a teamer from a received application

Browse Source
This commit is contained in:
fromme committed 2026-09-25 14:36:24 +02:00
1 parent d5f4b12f0a
commit b530679658
23 files changed
+2433 -148
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/Controller/Api/ApplicationFormControllerTest.php
+315 -126
View File
@@ -14,10 +14,16 @@ use Symfony\Component\HttpFoundation\Response;
/**
* The cases here are the ones the TYPO3 side actually produces
* (.ddev/plans/MYEP-APPLICATION-ENDPOINT.md §8): a payload of nothing but the basics, labels
* with slashes and umlauts, a long textarea answer, a duplicate label, and a mapped key this
* application does not know - which must not be a 400, or a later mapping change on the
* website silently stops every submission of that form.
* (.ddev/plans/MYEP-APPLICATION-ENDPOINT.md §8): labels with slashes and umlauts, a long textarea
* answer, a duplicate label, and a mapped key this application does not know - which must not be a
* 400, or a later mapping change on the website silently stops every submission of that form.
*
* The other half is the required nine of the contract: every payload carries lastName, firstName,
* birthDate, email, gender, eu, street, zipCode and city, and every one of them is a 400 when it is
* missing. That is
* deliberately harsh - a 400 costs a whole application - and each rejection case is pinned here
* one field at a time, because these are the fields a teamer cannot be provisioned without
* (.ddev/plans/application-form-teamer-provisioning.md).
*/
class ApplicationFormControllerTest extends WebTestCase
{
@@ -37,19 +43,160 @@ class ApplicationFormControllerTest extends WebTestCase
)->execute();
}
/**
* The endpoint promises JSON out, and on the error path that is not decoration: the TYPO3
* finisher logs the response body, and Symfony's error renderer would answer an HTML error page
* here - one that names the offending field only in dev, inside an HTML comment, and not at all
* in production. See ApiExceptionListener.
*/
public function testARejectionIsJsonNamingTheField(): void
{
$payload = $this->payload();
unset($payload['birthDate']);
$this->post($payload);
$response = $this->client->getResponse();
$this->assertSame(Response::HTTP_BAD_REQUEST, $response->getStatusCode());
$this->assertStringContainsString('application/json', (string) $response->headers->get('Content-Type'));
$this->assertStringNotContainsString('<html', (string) $response->getContent());
$body = $this->decode();
$this->assertSame('error', $body['status']);
$this->assertSame(
[['field' => 'birthDate', 'message' => 'birthDate must not be empty.', 'received' => 'missing']],
$body['errors']
);
// One line for a caller that logs the message alone.
$this->assertSame('birthDate must not be empty.', $body['message']);
}
/**
* The shape of what arrived, which the framework never says: "This value should be of type
* null|string." names the expectation and leaves the sender guessing. A form engine that hands a
* date element straight to json_encode sends an object, and its keys are the whole diagnosis.
*
* Never the value itself - a rejected payload is still personal data.
*
* @dataProvider unusableBirthDateTypes
*/
public function testARejectionNamesTheShapeThatArrived(mixed $birthDate, string $received): void
{
$this->post(['birthDate' => $birthDate] + $this->payload());
$this->assertSame(Response::HTTP_BAD_REQUEST, $this->client->getResponse()->getStatusCode());
$this->assertSame(
[['field' => 'birthDate', 'message' => 'This value should be of type null|string.', 'received' => $received]],
$this->decode()['errors']
);
}
/**
* @return iterable<string, array{mixed, string}>
*/
public static function unusableBirthDateTypes(): iterable
{
yield 'a serialized date object' => [
['date' => '1990-01-01 00:00:00.000000', 'timezone_type' => 3, 'timezone' => 'Europe/Berlin'],
'object with keys: date, timezone_type, timezone',
];
yield 'a list' => [['1990-01-01'], 'list of 1'];
yield 'a number' => [19900101, 'int'];
yield 'a boolean' => [true, 'bool'];
}
/**
* The endpoint's errors are English (the only caller is a machine), but a constraint message this
* application does not phrase itself is translated by the validator - and this application's
* locale is German. The message is therefore rebuilt from its own template rather than read off
* the violation.
*/
public function testAFrameworkMessageIsNotTranslated(): void
{
$this->post(['birthDate' => 19900101] + $this->payload());
$content = (string) $this->client->getResponse()->getContent();
$this->assertStringContainsString('This value should be of type null|string.', $content);
$this->assertStringNotContainsString('Dieser Wert', $content);
}
public function testAnEmptyValueIsDistinguishedFromAnAbsentOne(): void
{
$this->post(['city' => ''] + $this->payload());
$this->assertSame('empty string', $this->decode()['errors'][0]['received']);
}
public function testEveryOffendingFieldIsNamed(): void
{
$payload = $this->payload();
unset($payload['street'], $payload['zipCode'], $payload['city']);
$this->post($payload);
$this->assertEqualsCanonicalizing(['street', 'zipCode', 'city'], $this->rejectedFields());
}
/**
* A malformed body has no field to name, so the resolver's own explanation is passed on rather
* than swallowed - still JSON, still readable in a log.
*/
public function testABrokenBodyIsRejectedAsJson(): void
{
$this->client->request(
'POST',
self::URL,
server: ['CONTENT_TYPE' => 'application/json', 'HTTP_'.strtoupper(str_replace('-', '_', ApiKeyExtractor::HEADER)) => self::KEY],
content: '{"form": "applicationform",'
);
$body = $this->decode();
$this->assertSame(Response::HTTP_BAD_REQUEST, $this->client->getResponse()->getStatusCode());
$this->assertSame([], $body['errors']);
$this->assertNotSame('', $body['message']);
}
/**
* Not only the validation path: a wrong method comes from the router and used to leave as HTML
* too.
*/
public function testAWrongMethodIsJsonToo(): void
{
$this->client->request('GET', self::URL, server: [
'HTTP_'.strtoupper(str_replace('-', '_', ApiKeyExtractor::HEADER)) => self::KEY,
]);
$this->assertSame(Response::HTTP_METHOD_NOT_ALLOWED, $this->client->getResponse()->getStatusCode());
$this->assertSame('error', $this->decode()['status']);
}
public function testAKeylessRequestIsRejected(): void
{
$this->post(['form' => 'applicationform'], key: null);
$this->assertSame(Response::HTTP_UNAUTHORIZED, $this->client->getResponse()->getStatusCode());
$this->assertSame(0, $this->countSubmissions());
$this->assertSame('error', $this->decode()['status']);
}
/**
* A wrong key is answered by the firewall's entry point, which stops the exception before
* ApiExceptionListener sees it: the body stays empty. Pinned because "empty" is the thing to
* recognise in a caller's log - it is not the HTML error page a rejected payload used to get,
* and it is not something this application can phrase without an entry point of its own.
*/
public function testAWrongKeyIsRejected(): void
{
$this->post(['form' => 'applicationform'], key: 'not-the-key');
$this->assertSame(Response::HTTP_UNAUTHORIZED, $this->client->getResponse()->getStatusCode());
$response = $this->client->getResponse();
$this->assertSame(Response::HTTP_UNAUTHORIZED, $response->getStatusCode());
$this->assertStringNotContainsString('<html', (string) $response->getContent());
}
public function testAFullSubmissionIsStored(): void
@@ -65,7 +212,9 @@ class ApplicationFormControllerTest extends WebTestCase
'email' => '[email protected]',
'phone' => '+49 30 1234567',
'mobile' => '+49 170 1234567',
'birthDate' => '01.01.1990',
'birthDate' => '1990-01-01',
'gender' => 'F',
'eu' => true,
'street' => 'Musterstraße 1',
'zipCode' => '10115',
'city' => 'Berlin',
@@ -84,33 +233,132 @@ class ApplicationFormControllerTest extends WebTestCase
$this->assertSame('Bewerbungsformular', $submission->getFormLabel());
$this->assertSame('2026-09-22T12:30:00+02:00', $submission->getSubmittedAt()->format(\DateTimeInterface::ATOM));
$this->assertSame(1421, $submission->getPageUid());
$this->assertSame('01.01.1990', $submission->getBirthDate());
$this->assertSame('1990-01-01', $submission->getBirthDate());
$this->assertSame('1990-01-01', $submission->getDateOfBirth()?->format('Y-m-d'));
$this->assertSame('F', $submission->getGender());
$this->assertSame('[email protected]', $submission->getEmail(), 'the address is normalized like everywhere else');
$this->assertSame(['Reiseleitung', 'Skilehrer'], $submission->getDetails()['Bewerbung als']);
}
/**
* A form may map nothing but the basics, and an absent mapped key means the form has no such
* field - never an empty value that failed validation.
* Beyond the required nine everything stays optional: a form is configured without a mobile
* number as often as with it, and the teamer fills those in themselves afterwards. An absent
* optional key means the form has no such field - never an empty value that failed validation.
*/
public function testTheBasicsAloneAreEnough(): void
public function testTheRequiredFieldsAloneAreEnough(): void
{
$this->post([
'form' => 'contactform',
'formLabel' => 'Kontaktformular',
'submittedAt' => '2026-09-22T12:30:00+02:00',
'details' => [],
]);
$this->post($this->payload());
$this->assertSame(Response::HTTP_ACCEPTED, $this->client->getResponse()->getStatusCode());
$submission = $this->lastSubmission();
$this->assertNull($submission->getFirstName());
$this->assertNull($submission->getEmail());
$this->assertNull($submission->getPhone());
$this->assertNull($submission->getMobile());
$this->assertSame([], $submission->getDetails());
}
/**
* @dataProvider requiredFields
*/
public function testAPayloadMissingARequiredFieldIsRejected(string $field): void
{
$payload = $this->payload();
unset($payload[$field]);
$this->post($payload);
$this->assertSame(Response::HTTP_BAD_REQUEST, $this->client->getResponse()->getStatusCode());
$this->assertSame(0, $this->countSubmissions());
// The whole point of the rejection: the caller logs this body and has to see the field.
$this->assertContains($field, $this->rejectedFields());
}
/**
* An empty string is the shape a form posts for a field the visitor left blank, and it is as
* unusable as an absent key - except for eu, where "" is a lawful no and has its own case.
*
* @dataProvider requiredFields
*/
public function testAPayloadWithAnEmptyRequiredFieldIsRejected(string $field): void
{
if ('eu' === $field) {
$this->markTestSkipped('An empty eu is a no, not a missing answer - see its own test');
}
$this->post([$field => ''] + $this->payload());
$this->assertSame(Response::HTTP_BAD_REQUEST, $this->client->getResponse()->getStatusCode());
$this->assertSame(0, $this->countSubmissions());
}
/**
* @return iterable<string, array{string}>
*/
public static function requiredFields(): iterable
{
yield 'form' => ['form'];
yield 'formLabel' => ['formLabel'];
yield 'submittedAt' => ['submittedAt'];
yield 'firstName' => ['firstName'];
yield 'lastName' => ['lastName'];
yield 'email' => ['email'];
yield 'birthDate' => ['birthDate'];
yield 'gender' => ['gender'];
yield 'eu' => ['eu'];
yield 'street' => ['street'];
yield 'zipCode' => ['zipCode'];
yield 'city' => ['city'];
}
/**
* The one field whose format is nailed down: provisioning parses it as a date, so the day the
* TYPO3 side switches a form back to a free-text birthday has to be a 400 here rather than a
* failure in front of a reviewer weeks later.
*
* @dataProvider unusableBirthDates
*/
public function testAnUnusableBirthDateIsRejected(string $birthDate): void
{
$this->post(['birthDate' => $birthDate] + $this->payload());
$this->assertSame(Response::HTTP_BAD_REQUEST, $this->client->getResponse()->getStatusCode());
$this->assertSame(0, $this->countSubmissions());
}
/**
* @return iterable<string, array{string}>
*/
public static function unusableBirthDates(): iterable
{
yield 'the German spelling the forms used before the contract' => ['01.01.1990'];
yield 'free text' => ['irgendwann 1990'];
yield 'a day that does not exist' => ['1990-02-31'];
yield 'a year alone' => ['1990'];
}
public function testAnUnknownGenderIsRejected(): void
{
$this->post(['gender' => 'weiblich'] + $this->payload());
$this->assertSame(Response::HTTP_BAD_REQUEST, $this->client->getResponse()->getStatusCode());
$this->assertSame(0, $this->countSubmissions());
}
/**
* D is passed through to BusPro as it is - what BusPro makes of it is unverified, and guessing
* a replacement here would be worse than finding out.
*/
public function testEveryGenderTheApplicationKnowsIsAccepted(): void
{
foreach (['F', 'M', 'D'] as $gender) {
$this->post(['gender' => $gender] + $this->payload());
$this->assertSame(Response::HTTP_ACCEPTED, $this->client->getResponse()->getStatusCode());
$this->assertSame($gender, $this->lastSubmission()->getGender());
}
}
/**
* The mapped vocabulary grows on the website side without a release here. An unknown key is
* ignored, and kept in the raw payload so it can be mapped later without losing the answers
@@ -118,13 +366,7 @@ class ApplicationFormControllerTest extends WebTestCase
*/
public function testAnUnknownMappedKeyIsIgnoredAndKept(): void
{
$this->post([
'form' => 'applicationform',
'formLabel' => 'Bewerbungsformular',
'submittedAt' => '2026-09-22T12:30:00+02:00',
'nationality' => 'deutsch',
'details' => [],
]);
$this->post(['nationality' => 'deutsch'] + $this->payload());
$this->assertSame(Response::HTTP_ACCEPTED, $this->client->getResponse()->getStatusCode());
$this->assertSame('deutsch', $this->lastSubmission()->getPayload()['nationality']);
@@ -145,12 +387,7 @@ class ApplicationFormControllerTest extends WebTestCase
'Geburtsdatum (text-10)' => '02.02.1992',
];
$this->post([
'form' => 'applicationform',
'formLabel' => 'Bewerbungsformular',
'submittedAt' => '2026-09-22T12:30:00+02:00',
'details' => $details,
]);
$this->post(['details' => $details] + $this->payload());
$this->assertSame(Response::HTTP_ACCEPTED, $this->client->getResponse()->getStatusCode());
@@ -165,12 +402,7 @@ class ApplicationFormControllerTest extends WebTestCase
{
$answer = str_repeat('ä', 3000);
$this->post([
'form' => 'applicationform',
'formLabel' => 'Bewerbungsformular',
'submittedAt' => '2026-09-22T12:30:00+02:00',
'details' => ['Warum ich' => $answer],
]);
$this->post(['details' => ['Warum ich' => $answer]] + $this->payload());
$this->assertSame(Response::HTTP_ACCEPTED, $this->client->getResponse()->getStatusCode());
$this->assertSame($answer, $this->lastSubmission()->getDetails()['Warum ich']);
@@ -178,12 +410,7 @@ class ApplicationFormControllerTest extends WebTestCase
public function testAPayloadWithoutPageInformationIsAccepted(): void
{
$this->post([
'form' => 'applicationform',
'formLabel' => 'Bewerbungsformular',
'submittedAt' => '2026-09-22T12:30:00+02:00',
'details' => ['Nationalität' => 'deutsch'],
]);
$this->post(['details' => ['Nationalität' => 'deutsch']] + $this->payload());
$this->assertSame(Response::HTTP_ACCEPTED, $this->client->getResponse()->getStatusCode());
$this->assertNull($this->lastSubmission()->getPageUid());
@@ -196,13 +423,7 @@ class ApplicationFormControllerTest extends WebTestCase
*/
public function testANumericStringPageUidIsAccepted(): void
{
$this->post([
'form' => 'applicationform',
'formLabel' => 'Bewerbungsformular',
'submittedAt' => '2026-09-22T12:30:00+02:00',
'pageUid' => '1421',
'details' => [],
]);
$this->post(['pageUid' => '1421'] + $this->payload());
$this->assertSame(Response::HTTP_ACCEPTED, $this->client->getResponse()->getStatusCode());
$this->assertSame(1421, $this->lastSubmission()->getPageUid());
@@ -214,12 +435,7 @@ class ApplicationFormControllerTest extends WebTestCase
'POST',
self::URL,
server: ['HTTP_'.strtoupper(str_replace('-', '_', ApiKeyExtractor::HEADER)) => self::KEY],
content: json_encode([
'form' => 'applicationform',
'formLabel' => 'Bewerbungsformular',
'submittedAt' => '2026-09-22T12:30:00+02:00',
'details' => [],
], JSON_THROW_ON_ERROR)
content: json_encode($this->payload(), JSON_THROW_ON_ERROR)
);
$this->assertSame(0, $this->countSubmissions());
@@ -241,26 +457,9 @@ class ApplicationFormControllerTest extends WebTestCase
$this->assertSame(0, $this->countSubmissions());
}
public function testAMissingFormIsRejected(): void
{
$this->post([
'formLabel' => 'Bewerbungsformular',
'submittedAt' => '2026-09-22T12:30:00+02:00',
'details' => [],
]);
$this->assertSame(Response::HTTP_BAD_REQUEST, $this->client->getResponse()->getStatusCode());
$this->assertSame(0, $this->countSubmissions());
}
public function testAnUnparseableSubmissionTimeIsRejected(): void
{
$this->post([
'form' => 'applicationform',
'formLabel' => 'Bewerbungsformular',
'submittedAt' => 'gestern',
'details' => [],
]);
$this->post(['submittedAt' => 'gestern'] + $this->payload());
$this->assertSame(Response::HTTP_BAD_REQUEST, $this->client->getResponse()->getStatusCode());
$this->assertSame(0, $this->countSubmissions());
@@ -268,25 +467,14 @@ class ApplicationFormControllerTest extends WebTestCase
public function testAnInvalidEmailAddressIsRejected(): void
{
$this->post([
'form' => 'applicationform',
'formLabel' => 'Bewerbungsformular',
'submittedAt' => '2026-09-22T12:30:00+02:00',
'email' => 'not-an-address',
'details' => [],
]);
$this->post(['email' => 'not-an-address'] + $this->payload());
$this->assertSame(Response::HTTP_BAD_REQUEST, $this->client->getResponse()->getStatusCode());
}
public function testANestedDetailValueIsRejected(): void
{
$this->post([
'form' => 'applicationform',
'formLabel' => 'Bewerbungsformular',
'submittedAt' => '2026-09-22T12:30:00+02:00',
'details' => ['Bewerbung als' => ['erste' => ['Reiseleitung']]],
]);
$this->post(['details' => ['Bewerbung als' => ['erste' => ['Reiseleitung']]]] + $this->payload());
$this->assertSame(Response::HTTP_BAD_REQUEST, $this->client->getResponse()->getStatusCode());
$this->assertSame(0, $this->countSubmissions());
@@ -307,13 +495,7 @@ class ApplicationFormControllerTest extends WebTestCase
*/
public function testTheSamePayloadTwiceIsStoredTwiceForNow(): void
{
$payload = [
'form' => 'applicationform',
'formLabel' => 'Bewerbungsformular',
'submittedAt' => '2026-09-22T12:30:00+02:00',
'email' => '[email protected]',
'details' => [],
];
$payload = $this->payload();
$this->post($payload);
$this->post($payload);
@@ -329,7 +511,7 @@ class ApplicationFormControllerTest extends WebTestCase
*/
public function testTheReceiptGoesOutForAnEuApplicant(): void
{
$this->post($this->eligiblePayload());
$this->post($this->payload());
$this->assertSame(Response::HTTP_ACCEPTED, $this->client->getResponse()->getStatusCode());
$this->assertEmailCount(1);
@@ -339,7 +521,7 @@ class ApplicationFormControllerTest extends WebTestCase
public function testNoReceiptForANonEuApplicant(): void
{
$this->post(['eu' => false] + $this->eligiblePayload());
$this->post(['eu' => false] + $this->payload());
$this->assertSame(Response::HTTP_ACCEPTED, $this->client->getResponse()->getStatusCode());
$this->assertEmailCount(0);
@@ -347,26 +529,13 @@ class ApplicationFormControllerTest extends WebTestCase
$this->assertFalse($this->lastSubmission()->isEu());
}
public function testNoReceiptWhenTheFormDoesNotAsk(): void
{
$payload = $this->eligiblePayload();
unset($payload['eu']);
$this->post($payload);
$this->assertSame(Response::HTTP_ACCEPTED, $this->client->getResponse()->getStatusCode());
$this->assertEmailCount(0);
$this->assertNull($this->lastSubmission()->isEu());
$this->assertNull($this->lastSubmission()->getFirstMailSentAt());
}
/**
* A form posts "1" as readily as a JSON true, and dropping an application over the spelling
* would be absurd - the same tolerance pageUid has.
*/
public function testAQuotedEuFlagStillEarnsTheReceipt(): void
{
$this->post(['eu' => '1'] + $this->eligiblePayload());
$this->post(['eu' => '1'] + $this->payload());
$this->assertEmailCount(1);
$this->assertTrue($this->lastSubmission()->isEu());
@@ -374,7 +543,7 @@ class ApplicationFormControllerTest extends WebTestCase
public function testAnEmptyEuFlagIsNotAYes(): void
{
$this->post(['eu' => ''] + $this->eligiblePayload());
$this->post(['eu' => ''] + $this->payload());
$this->assertEmailCount(0);
$this->assertFalse($this->lastSubmission()->isEu());
@@ -386,30 +555,21 @@ class ApplicationFormControllerTest extends WebTestCase
*/
public function testAnUnparseableEuFlagIsRejected(): void
{
$this->post(['eu' => 'vielleicht'] + $this->eligiblePayload());
$this->post(['eu' => 'vielleicht'] + $this->payload());
$this->assertSame(Response::HTTP_BAD_REQUEST, $this->client->getResponse()->getStatusCode());
$this->assertSame(0, $this->countSubmissions());
$this->assertEmailCount(0);
}
public function testAnEligibleSubmissionWithoutAnEmailAddressIsStillStored(): void
{
$payload = $this->eligiblePayload();
unset($payload['email']);
$this->post($payload);
$this->assertSame(Response::HTTP_ACCEPTED, $this->client->getResponse()->getStatusCode());
$this->assertEmailCount(0);
$this->assertSame(1, $this->countSubmissions());
$this->assertNull($this->lastSubmission()->getFirstMailSentAt());
}
/**
* A payload with nothing but the required six, which is the smallest thing the endpoint
* accepts. Spread an override in front of it - ['gender' => 'X'] + $this->payload() - rather
* than rebuilding it, so a field added to the contract reaches every case at once.
*
* @return array<string, mixed>
*/
private function eligiblePayload(): array
private function payload(): array
{
return [
'form' => 'applicationform',
@@ -418,11 +578,40 @@ class ApplicationFormControllerTest extends WebTestCase
'firstName' => 'Anna',
'lastName' => 'Muster',
'email' => '[email protected]',
'birthDate' => '1990-01-01',
'gender' => 'F',
'eu' => true,
// The postal address, required as a whole: street and postcode are BusPro's own
// mandatory fields for a new address.
'street' => 'Musterstraße 1',
'zipCode' => '10115',
'city' => 'Berlin',
'details' => [],
];
}
/**
* The fields the endpoint named as the reason for a rejection.
*
* @return list<string>
*/
private function rejectedFields(): array
{
return array_values(array_filter(array_column($this->decode()['errors'], 'field')));
}
/**
* @return array<string, mixed>
*/
private function decode(): array
{
$body = json_decode((string) $this->client->getResponse()->getContent(), true);
$this->assertIsArray($body, 'The endpoint has to answer JSON, on the error path as well');
return $body;
}
/**
* @param array<string, mixed> $payload
*/