feat: align role assignment logic with myep-team

2026-08-19 12:14:09 +02:00
parent 5a3957e143
commit 0c667d6b69
23 changed files with 1109 additions and 527 deletions
@@ -0,0 +1,110 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller\Admin\User;
+
+use App\Controller\Admin\User\ShowController;
+use App\Entity\User;
+use App\Security\Role;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+class ShowControllerTest extends TestCase
+{
+    public function testNominationsAreOfferedForApproval(): void
+    {
+        $controller = new TestableShowController();
+
+        $controller->index($this->nominatedUser(), $this->permissionsRequest());
+
+        self::assertSame(
+            [Role::MANAGER => 'Manager:in', Role::GROUPS_ADMIN => 'Preisrechner Admin'],
+            $controller->parameters['approvableRoles'],
+        );
+        self::assertSame([], $controller->parameters['selfRefusedRoles']);
+    }
+
+    public function testWhatCannotBeSelfApprovedIsNotOffered(): void
+    {
+        $user = (new User('[email protected]'))->setRoles([Role::ADMIN, Role::pending(Role::ADMIN), Role::pending(Role::MANAGER)]);
+
+        $controller = new TestableShowController(currentUser: $user);
+
+        $controller->index($user, $this->permissionsRequest());
+
+        // ROLE_ADMIN needs a second administrator, so no button leads into an access denied page.
+        self::assertSame([Role::MANAGER => 'Manager:in'], $controller->parameters['approvableRoles']);
+        self::assertSame([Role::ADMIN => 'Administration'], $controller->parameters['selfRefusedRoles']);
+    }
+
+    public function testTheReturnUrlOfTheListIsForwardedUntouched(): void
+    {
+        $controller = new TestableShowController();
+
+        $controller->index($this->nominatedUser(), $this->permissionsRequest());
+
+        // Calling return_url() in the template instead would hand the approval this very modal
+        // and redirect the browser onto a bare modal fragment afterwards.
+        self::assertSame('%2Fadmin%2Fuser%3Fpage%3D2', $controller->parameters['returnUrl']);
+    }
+
+    public function testWithoutAReturnUrlTheListIsUsed(): void
+    {
+        $controller = new TestableShowController();
+
+        $controller->index($this->nominatedUser(), Request::create('/admin/user/7/permissions'));
+
+        self::assertSame(rawurlencode('/app_admin_user'), $controller->parameters['returnUrl']);
+    }
+
+    private function nominatedUser(): User
+    {
+        return (new User('[email protected]'))
+            ->setRoles([Role::TEAMER, Role::pending(Role::MANAGER), Role::pending(Role::GROUPS_ADMIN)]);
+    }
+
+    /**
+     * The list links the modal with r=return_url(), which rawurlencodes the URI, and path()
+     * encodes that again as a query value — so what arrives here is encoded exactly once.
+     */
+    private function permissionsRequest(): Request
+    {
+        return Request::create('/admin/user/7/permissions?r='.rawurlencode(rawurlencode('/admin/user?page=2')));
+    }
+}
+
+final class TestableShowController extends ShowController
+{
+    /** @var array<string, mixed> */
+    public array $parameters = [];
+
+    public function __construct(private readonly ?UserInterface $currentUser = null)
+    {
+    }
+
+    protected function getUser(): ?UserInterface
+    {
+        return $this->currentUser;
+    }
+
+    /**
+     * @param array<string, mixed> $parameters
+     */
+    protected function render(string $view, array $parameters = [], ?Response $response = null): Response
+    {
+        $this->parameters = $parameters;
+
+        return new Response();
+    }
+
+    /**
+     * @param array<string, mixed> $parameters
+     */
+    protected function generateUrl(string $route, array $parameters = [], int $referenceType = 1): string
+    {
+        return '/'.$route;
+    }
+}