feat: soft-delete for teamer accounts

addresses #869dv9br3

tests/Security/BpnAuthenticatorTest.php

@@ -86,6 +86,44 @@ class BpnAuthenticatorTest extends TestCase
         $this->loadUser();
     }
 
+    /**
+     * The CRM must not be able to undo a deletion, in either direction: neither by
+     * refreshing the account's data nor by blocking it further.
+     */
+    public function testDeletedUserIsReturnedWithoutAnyCrmSync(): void
+    {
+        $user = (new User())->setRoles(['ROLE_TEAMER']);
+        $user->setDeleted();
+
+        $this->stubApiClient($this->createCrmAttributes());
+
+        $this->userDataHandler->method('collectRoles')->willReturn(['ROLE_TEAMER']);
+        $this->userDataHandler->method('findLocalUser')->willReturn($user);
+
+        $this->userDataHandler->expects($this->never())->method('updateLocalUser');
+        $this->userDataHandler->expects($this->never())->method('createLocalUser');
+        $this->userDataHandler->expects($this->never())->method('disableForRevokedCrmRoles');
+
+        // returned rather than refused, so the UserChecker can explain the deletion
+        $this->assertSame($user, $this->loadUser());
+    }
+
+    public function testDeletedUserIsNotBlockedWhenTheCrmRevokedEveryRole(): void
+    {
+        $user = (new User())->setRoles(['ROLE_TEAMER']);
+        $user->setDeleted();
+
+        $this->stubApiClient($this->createCrmAttributes());
+
+        $this->userDataHandler->method('collectRoles')->willReturn([]);
+        $this->userDataHandler->method('findLocalUser')->willReturn($user);
+
+        $this->userDataHandler->expects($this->never())->method('disableForRevokedCrmRoles');
+
+        $this->assertSame($user, $this->loadUser());
+        $this->assertFalse($user->isDisabled());
+    }
+
     private function createCrmAttributes(): CrmAttributesResponse
     {
         return (new CrmAttributesResponse())->setAttributeGroups([new CrmAttributeGroup()]);

tests/Security/UserCheckerTest.php

@@ -0,0 +1,69 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security;
+
+use App\Entity\User;
+use App\Security\UserChecker;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException;
+
+class UserCheckerTest extends TestCase
+{
+    private UserChecker $userChecker;
+
+    protected function setUp(): void
+    {
+        $this->userChecker = new UserChecker();
+    }
+
+    public function testDeletedUserIsRefused(): void
+    {
+        $user = (new User())->setRoles(['ROLE_TEAMER']);
+        $user->setDeleted();
+
+        $this->expectException(CustomUserMessageAccountStatusException::class);
+        $this->expectExceptionMessageMatches('/gelöscht/');
+
+        $this->userChecker->checkPreAuth($user);
+    }
+
+    /**
+     * A deletion is the stronger statement, so its message has to win over the block
+     * message when an account carries both.
+     */
+    public function testDeletedAndDisabledUserIsRefusedWithTheDeletionMessage(): void
+    {
+        $user = (new User())->setRoles(['ROLE_TEAMER']);
+        $user->setDisabled(true);
+        $user->setDisabledReason('Disziplinarisch gesperrt');
+        $user->setDeleted();
+
+        $this->expectException(CustomUserMessageAccountStatusException::class);
+        $this->expectExceptionMessageMatches('/gelöscht/');
+
+        $this->userChecker->checkPreAuth($user);
+    }
+
+    public function testDisabledUserStillGetsTheBlockMessage(): void
+    {
+        $user = (new User())->setRoles(['ROLE_TEAMER']);
+        $user->setDisabled(true);
+        $user->setDisabledReason('Disziplinarisch gesperrt');
+
+        $this->expectException(CustomUserMessageAccountStatusException::class);
+        $this->expectExceptionMessage('Dein Account wurde gesperrt: Disziplinarisch gesperrt');
+
+        $this->userChecker->checkPreAuth($user);
+    }
+
+    public function testActiveUserWithValidRolePasses(): void
+    {
+        $user = (new User())->setRoles(['ROLE_TEAMER']);
+
+        $this->userChecker->checkPreAuth($user);
+
+        $this->assertFalse($user->isBlocked());
+    }
+}