myep-team/tests/Security/Voter/DispositionVoterTest.php

<?php

declare(strict_types=1);

namespace App\Tests\Security\Voter;

use App\Entity\Application;
use App\Entity\Assignment;
use App\Entity\Disposition;
use App\Entity\Teamer;
use App\Entity\User;
use App\Security\Voter\DispositionVoter;
use PHPUnit\Framework\MockObject\MockObject;
use PHPUnit\Framework\TestCase;
use Symfony\Bundle\SecurityBundle\Security;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;

/**
 * The documents and the feedback simply do not exist on a skip-formalities assignment, so the
 * voter is where that is enforced: it closes the blank-PDF routes and the upload and feedback
 * screens at once, and every template that gates on is_granted() follows without a change.
 */
class DispositionVoterTest extends TestCase
{
    private Security&MockObject $security;

    protected function setUp(): void
    {
        $this->security = $this->createMock(Security::class);
    }

    /**
     * @dataProvider documentAndFeedbackAttributes
     */
    public function testAnAdminIsDeniedOnASkipFormalitiesAssignment(string $attribute): void
    {
        $this->security->method('isGranted')->willReturn(true);

        $this->assertSame(
            VoterInterface::ACCESS_DENIED,
            $this->vote($attribute, $this->createDisposition(skipFormalities: true)),
        );
    }

    /**
     * The same admin on a normal assignment must still get through - the flag is the only thing
     * that may take these away.
     *
     * @dataProvider documentAndFeedbackAttributes
     */
    public function testTheSameAdminIsGrantedOnANormalAssignment(string $attribute): void
    {
        $this->security->method('isGranted')->willReturn(true);

        $this->assertSame(
            VoterInterface::ACCESS_GRANTED,
            $this->vote($attribute, $this->createDisposition(skipFormalities: false)),
        );
    }

    /**
     * @return array<string, array{string}>
     */
    public static function documentAndFeedbackAttributes(): array
    {
        return [
            'contract pdf and upload' => [DispositionVoter::CONTRACT],
            'invoice pdf and upload' => [DispositionVoter::INVOICE],
            'office upload on behalf of the teamer' => [DispositionVoter::CONTRACT_SUPPLEMENTARY],
            'office upload of either document' => [DispositionVoter::ADMIN_DOCUMENT_UPLOAD],
            'providing the feedback' => [DispositionVoter::FEEDBACK],
        ];
    }

    /**
     * Viewing the placement and calling it off are unrelated to the formalities and have to keep
     * working, or an admin could no longer cancel a teamer on such an assignment.
     */
    public function testViewingAndCallingOffAreUnaffected(): void
    {
        $this->security->method('isGranted')->willReturn(true);
        $disposition = $this->createDisposition(skipFormalities: true);

        $this->assertSame(VoterInterface::ACCESS_GRANTED, $this->vote(DispositionVoter::VIEW, $disposition));
        $this->assertSame(VoterInterface::ACCESS_GRANTED, $this->vote(DispositionVoter::CALL_OFF, $disposition));
    }

    /**
     * The receipt window is the one permission in this voter that is not derived from a workflow
     * transition, because there is none to derive it from: while the Honorarnote is being checked
     * the state machine offers nothing at all, and that is exactly when receipts must stay
     * manageable.
     *
     * @dataProvider receiptWindowStatuses
     */
    public function testTheReceiptWindowIsTheTwoInvoiceStates(string $status, bool $expected): void
    {
        $this->security->method('isGranted')->willReturn(true);

        $disposition = $this->createDisposition(skipFormalities: false)->setStatus($status);

        $this->assertSame(
            $expected ? VoterInterface::ACCESS_GRANTED : VoterInterface::ACCESS_DENIED,
            $this->vote(DispositionVoter::MANAGE_RECEIPTS, $disposition),
        );
    }

    /**
     * @return array<string, array{string, bool}>
     */
    public static function receiptWindowStatuses(): array
    {
        return [
            'invoice may still be uploaded' => [Disposition::STATUS_ENDED, true],
            'invoice is being checked' => [Disposition::STATUS_CHECKING_INVOICE, true],
            'nothing has happened yet' => [Disposition::STATUS_NEW, false],
            'contract is being checked' => [Disposition::STATUS_CHECKING_CONTRACT, false],
            'assignment is still ahead' => [Disposition::STATUS_CONFIRMED, false],
            'invoice was accepted' => [Disposition::STATUS_COMPLETED, false],
            'placement was cancelled' => [Disposition::STATUS_CALLED_OFF, false],
        ];
    }

    public function testReceiptsAreDeniedOnASkipFormalitiesAssignment(): void
    {
        $this->security->method('isGranted')->willReturn(true);

        $disposition = $this
            ->createDisposition(skipFormalities: true)
            ->setStatus(Disposition::STATUS_CHECKING_INVOICE)
        ;

        $this->assertSame(
            VoterInterface::ACCESS_DENIED,
            $this->vote(DispositionVoter::MANAGE_RECEIPTS, $disposition),
        );
    }

    /**
     * The owning teamer gets in without being administrative; anyone else's teamer does not.
     *
     * @dataProvider receiptOwnership
     */
    public function testOnlyTheOwningTeamerMayManageTheirReceipts(bool $owning, bool $expected): void
    {
        $this->security
            ->method('isGranted')
            ->willReturnCallback(fn (string $role): bool => 'ROLE_TEAMER' === $role)
        ;

        $teamer = new Teamer();
        $assignment = (new Assignment())->setSkipFormalities(false);

        $disposition = (new Disposition(new Application($assignment, $teamer)))
            ->setStatus(Disposition::STATUS_CHECKING_INVOICE)
        ;

        $user = (new User())->setTeamer($owning ? $teamer : new Teamer());

        $token = $this->createMock(TokenInterface::class);
        $token->method('getUser')->willReturn($user);

        $this->assertSame(
            $expected ? VoterInterface::ACCESS_GRANTED : VoterInterface::ACCESS_DENIED,
            (new DispositionVoter($this->security))->vote($token, $disposition, [DispositionVoter::MANAGE_RECEIPTS]),
        );
    }

    /**
     * @return array<string, array{bool, bool}>
     */
    public static function receiptOwnership(): array
    {
        return [
            'their own placement' => [true, true],
            'somebody else\'s placement' => [false, false],
        ];
    }

    private function vote(string $attribute, Disposition $disposition): int
    {
        return (new DispositionVoter($this->security))->vote(
            $this->createMock(TokenInterface::class),
            $disposition,
            [$attribute],
        );
    }

    private function createDisposition(bool $skipFormalities): Disposition
    {
        $assignment = (new Assignment())->setSkipFormalities($skipFormalities);

        return new Disposition(new Application($assignment, new Teamer()));
    }
}