wip: group inquiries and booking

tests/Controller/Accommodation/Step3ControllerTest.php

@@ -6,17 +6,13 @@ namespace App\Tests\Controller\Accommodation;
 
 use App\Controller\Groups\Step3Controller;
 use App\Entity\Groups\Accommodation;
-use App\Entity\Groups\AccommodationBooking;
 use App\Entity\Groups\AdditionalService;
 use App\Entity\Groups\BoardService;
-use App\Form\AccommodationStep3ConfirmationType;
-use App\Form\AccommodationStep3Type;
 use App\Form\Model\AccommodationBookingDto;
 use App\Service\AccommodationBookingService;
 use App\Service\AccommodationSessionManager;
 use PHPUnit\Framework\TestCase;
 use Symfony\Component\Form\FormInterface;
-use Symfony\Component\Form\SubmitButton;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -42,13 +38,7 @@ class Step3ControllerTest extends TestCase
         $sessionManager = new AccommodationSessionManager();
         $sessionManager->save($request, $dto);
 
-        $form = $this->createMock(FormInterface::class);
-        $form
-            ->method('handleRequest')
-            ->willReturnSelf();
-        $form
-            ->method('isSubmitted')
-            ->willReturn(false);
+        $form = $this->createFormMock(submitted: false, valid: false);
 
         $accommodation = (new Accommodation())
             ->setName('Hotel')
@@ -84,7 +74,7 @@ class Step3ControllerTest extends TestCase
         self::assertSame([$additionalService], $controller->renderedParameters['ctx']->additionalServices);
     }
 
-    public function testClickingBuchenOpensConfirmationModalWithoutPersisting(): void
+    public function testValidSubmitRedirectsToStep4WithoutPersisting(): void
     {
         $dto = new AccommodationBookingDto();
         $dto->currentStep = 3;
@@ -98,20 +88,7 @@ class Step3ControllerTest extends TestCase
         $sessionManager = new AccommodationSessionManager();
         $sessionManager->save($request, $dto);
 
-        $submitBookingButton = $this->getMockBuilder(SubmitButton::class)
-            ->disableOriginalConstructor()
-            ->onlyMethods(['isClicked'])
-            ->getMock();
-        $submitBookingButton->method('isClicked')->willReturn(true);
-
-        $mainForm = $this->createMock(FormInterface::class);
-        $mainForm->method('handleRequest')->willReturnSelf();
-        $mainForm->method('isSubmitted')->willReturn(true);
-        $mainForm->method('isValid')->willReturn(true);
-        $mainForm->method('has')->with('submitBooking')->willReturn(true);
-        $mainForm->method('get')->with('submitBooking')->willReturn($submitBookingButton);
-
-        $confirmationForm = $this->createMock(FormInterface::class);
+        $form = $this->createFormMock(submitted: true, valid: true);
 
         $accommodation = (new Accommodation())
             ->setName('Hotel')
@@ -126,115 +103,65 @@ class Step3ControllerTest extends TestCase
             'groupedAdditionalServices' => [],
             'ungroupedAdditionalServices' => [],
         ]);
-        $bookingService->expects(self::never())->method('persist');
+        $bookingService->expects(self::never())->method('finalizeBooking');
 
-        $controller = new TestableAccommodationStep3Controller(
-            $bookingService,
-            $sessionManager,
-            [AccommodationStep3Type::class => $mainForm, AccommodationStep3ConfirmationType::class => $confirmationForm],
-        );
+        $controller = new TestableAccommodationStep3Controller($bookingService, $sessionManager, $form);
+
+        $response = $controller->index($request);
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/app_groups_booking_step_4', $response->getTargetUrl());
+        self::assertSame(4, $dto->currentStep);
+        self::assertSame($dto, $sessionManager->getDto($request));
+    }
+
+    public function testInvalidSubmitReRendersFormWithErrors(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 3;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-3', 'POST');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $form = $this->createFormMock(submitted: true, valid: false);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->method('loadAvailableServices')->willReturn([
+            'boardServices' => [],
+            'additionalServices' => [],
+            'groupedAdditionalServices' => [],
+            'ungroupedAdditionalServices' => [],
+        ]);
+
+        $controller = new TestableAccommodationStep3Controller($bookingService, $sessionManager, $form);
 
         $response = $controller->index($request);
 
         self::assertSame(200, $response->getStatusCode());
         self::assertSame('groups/booking/step_3.html.twig', $controller->renderedView);
-        self::assertSame($confirmationForm, $controller->renderedParameters['confirmationForm']);
-        self::assertFalse($dto->forceInquiry);
+        self::assertSame(3, $dto->currentStep);
         self::assertSame($dto, $sessionManager->getDto($request));
     }
 
-    public function testConfirmPersistsBookingOnValidConfirmationForm(): void
+    private function createFormMock(bool $submitted, bool $valid): FormInterface
     {
-        $dto = new AccommodationBookingDto();
-        $dto->currentStep = 3;
-        $dto->accommodationId = 1;
-        $dto->isInquiry = false;
+        $form = $this->createMock(FormInterface::class);
+        $form->method('handleRequest')->willReturnSelf();
+        $form->method('isSubmitted')->willReturn($submitted);
+        $form->method('isValid')->willReturn($valid);
 
-        $session = new Session(new MockArraySessionStorage());
-        $request = Request::create('/groups/booking/step-3/confirm', 'POST');
-        $request->setSession($session);
-        $request->headers->set('HX-Request', 'true');
-
-        $sessionManager = new AccommodationSessionManager();
-        $sessionManager->save($request, $dto);
-
-        $confirmationForm = $this->createMock(FormInterface::class);
-        $confirmationForm->method('handleRequest')->willReturnSelf();
-        $confirmationForm->method('isSubmitted')->willReturn(true);
-        $confirmationForm->method('isValid')->willReturn(true);
-
-        $accommodation = (new Accommodation())
-            ->setName('Hotel')
-            ->setCalendarCode('HOTEL')
-            ->setMaxAdolescentAge(17);
-
-        $booking = (new AccommodationBooking())->setIsInquiry(false);
-
-        $bookingService = $this->createMock(AccommodationBookingService::class);
-        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
-        $bookingService->method('loadAvailableServices')->willReturn([
-            'boardServices' => [],
-            'additionalServices' => [],
-            'groupedAdditionalServices' => [],
-            'ungroupedAdditionalServices' => [],
-        ]);
-        $bookingService->method('loadPrices')->willReturn([]);
-        $bookingService->expects(self::once())->method('persist')->willReturn($booking);
-        $bookingService->expects(self::once())->method('sendNotificationEmail');
-
-        $controller = new TestableAccommodationStep3Controller(
-            $bookingService,
-            $sessionManager,
-            [AccommodationStep3ConfirmationType::class => $confirmationForm],
-        );
-
-        $response = $controller->confirm($request);
-
-        self::assertSame(200, $response->getStatusCode());
-        self::assertTrue($response->headers->has('HX-Redirect'));
-        self::assertNull($sessionManager->getDto($request));
-    }
-
-    public function testConfirmRerendersModalWhenTermsNotAccepted(): void
-    {
-        $dto = new AccommodationBookingDto();
-        $dto->currentStep = 3;
-        $dto->accommodationId = 1;
-        $dto->isInquiry = false;
-
-        $session = new Session(new MockArraySessionStorage());
-        $request = Request::create('/groups/booking/step-3/confirm', 'POST');
-        $request->setSession($session);
-
-        $sessionManager = new AccommodationSessionManager();
-        $sessionManager->save($request, $dto);
-
-        $confirmationForm = $this->createMock(FormInterface::class);
-        $confirmationForm->method('handleRequest')->willReturnSelf();
-        $confirmationForm->method('isSubmitted')->willReturn(true);
-        $confirmationForm->method('isValid')->willReturn(false);
-
-        $accommodation = (new Accommodation())
-            ->setName('Hotel')
-            ->setCalendarCode('HOTEL')
-            ->setMaxAdolescentAge(17);
-
-        $bookingService = $this->createMock(AccommodationBookingService::class);
-        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
-        $bookingService->expects(self::never())->method('persist');
-
-        $controller = new TestableAccommodationStep3Controller(
-            $bookingService,
-            $sessionManager,
-            [AccommodationStep3ConfirmationType::class => $confirmationForm],
-        );
-
-        $response = $controller->confirm($request);
-
-        self::assertSame(200, $response->getStatusCode());
-        self::assertFalse($response->headers->has('HX-Redirect'));
-        self::assertSame('groups/booking/_step3_confirmation_modal.html.twig', $controller->renderedView);
-        self::assertNotNull($sessionManager->getDto($request));
+        return $form;
     }
 }
 
@@ -247,13 +174,10 @@ final class TestableAccommodationStep3Controller extends Step3Controller
 
     public string $renderedView = '';
 
-    /**
-     * @param FormInterface<mixed>|array<class-string, FormInterface<mixed>> $form
-     */
     public function __construct(
         AccommodationBookingService $bookingService,
         AccommodationSessionManager $sessionManager,
-        private readonly FormInterface|array $form,
+        private readonly FormInterface $form,
     ) {
         parent::__construct($bookingService, $sessionManager);
     }
@@ -263,10 +187,6 @@ final class TestableAccommodationStep3Controller extends Step3Controller
      */
     protected function createForm(string $type, mixed $data = null, array $options = []): FormInterface
     {
-        if (is_array($this->form)) {
-            return $this->form[$type];
-        }
-
         return $this->form;
     }
 

tests/Controller/Groups/OfferControllerTest.php

@@ -5,145 +5,32 @@ declare(strict_types=1);
 namespace App\Tests\Controller\Groups;
 
 use App\Controller\Groups\OfferController;
+use App\Entity\Groups\Accommodation;
 use App\Entity\Groups\AccommodationBooking;
 use App\Repository\Groups\AccommodationBookingRepository;
 use App\Service\AccommodationBookingBreakdownCalculator;
 use App\Service\AccommodationBookingLinkSigner;
 use App\Service\AccommodationBookingService;
 use PHPUnit\Framework\TestCase;
+use Symfony\Component\Form\FormInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\Session\Session;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
 
 class OfferControllerTest extends TestCase
 {
-    public function testGetRendersOfferWithAcceptFormForInquiry(): void
+    public function testAccessAuthorizesSessionAndRedirectsToView(): void
     {
         $booking = new AccommodationBooking();
-        $booking->setIsInquiry(true);
 
         $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
         $bookingRepository->method('findOneBy')->with(['uuid' => $booking->getUuid()])->willReturn($booking);
 
         $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
         $linkSigner->method('isValidLinkRequest')->willReturn(true);
-
-        $breakdownCalculator = $this->createMock(AccommodationBookingBreakdownCalculator::class);
-        $breakdownCalculator->method('compute')->with($booking)->willReturn(['total' => 1000]);
-
-        $bookingService = $this->createMock(AccommodationBookingService::class);
-        $bookingService->expects(self::never())->method('acceptBooking');
-
-        $controller = new TestableOfferController($bookingRepository, $linkSigner, $breakdownCalculator, $bookingService);
-
-        $response = $controller->index($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid()));
-
-        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
-        self::assertSame('<html>offer</html>', $response->getContent());
-        self::assertSame('groups/booking/offer.html.twig', $controller->renderedView);
-        self::assertSame(['booking' => $booking, 'priceBreakdown' => ['total' => 1000]], $controller->renderedParameters);
-    }
-
-    public function testPostAcceptsInquiryAndRedirectsToSameUrl(): void
-    {
-        $booking = new AccommodationBooking();
-        $booking->setIsInquiry(true);
-
-        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
-        $bookingRepository->method('findOneBy')->willReturn($booking);
-
-        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
-        $linkSigner->method('isValidLinkRequest')->willReturn(true);
-
-        $bookingService = $this->createMock(AccommodationBookingService::class);
-        $bookingService->expects(self::once())->method('acceptBooking')->with($booking);
-
-        $controller = new TestableOfferController(
-            $bookingRepository,
-            $linkSigner,
-            $this->createMock(AccommodationBookingBreakdownCalculator::class),
-            $bookingService,
-        );
-
-        $request = Request::create(
-            '/groups/booking/offer/'.$booking->getUuid().'?t=123&_hash=abc',
-            'POST',
-            ['_token' => 'valid-token'],
-        );
-        $response = $controller->index($booking->getUuid(), $request);
-
-        self::assertSame(Response::HTTP_FOUND, $response->getStatusCode());
-        self::assertSame($request->getUri(), $response->headers->get('Location'));
-        self::assertSame('accept_accommodation_offer_'.$booking->getUuid(), $controller->csrfTokenId);
-        self::assertSame('valid-token', $controller->csrfToken);
-    }
-
-    public function testPostRejectsInvalidCsrfToken(): void
-    {
-        $booking = new AccommodationBooking();
-        $booking->setIsInquiry(true);
-
-        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
-        $bookingRepository->method('findOneBy')->willReturn($booking);
-
-        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
-        $linkSigner->method('isValidLinkRequest')->willReturn(true);
-
-        $bookingService = $this->createMock(AccommodationBookingService::class);
-        $bookingService->expects(self::never())->method('acceptBooking');
-
-        $controller = new TestableOfferController(
-            $bookingRepository,
-            $linkSigner,
-            $this->createMock(AccommodationBookingBreakdownCalculator::class),
-            $bookingService,
-        );
-        $controller->csrfValid = false;
-
-        $this->expectException(\Symfony\Component\Security\Core\Exception\AccessDeniedException::class);
-
-        $controller->index(
-            $booking->getUuid(),
-            Request::create('/groups/booking/offer/'.$booking->getUuid(), 'POST', ['_token' => 'invalid']),
-        );
-    }
-
-    public function testGetRendersConfirmationWithoutAcceptFormForBooking(): void
-    {
-        $booking = new AccommodationBooking();
-        $booking->setIsInquiry(false);
-
-        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
-        $bookingRepository->method('findOneBy')->willReturn($booking);
-
-        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
-        $linkSigner->method('isValidLinkRequest')->willReturn(true);
-
-        $bookingService = $this->createMock(AccommodationBookingService::class);
-        $bookingService->expects(self::never())->method('acceptBooking');
-
-        $controller = new TestableOfferController(
-            $bookingRepository,
-            $linkSigner,
-            $this->createMock(AccommodationBookingBreakdownCalculator::class),
-            $bookingService,
-        );
-
-        // A POST on an already-accepted booking should not trigger acceptBooking again — falls through to render.
-        $response = $controller->index($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid(), 'POST'));
-
-        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
-        self::assertSame('groups/booking/offer.html.twig', $controller->renderedView);
-    }
-
-    public function testInvalidLinkReturnsUnavailableResponse(): void
-    {
-        $booking = new AccommodationBooking();
-
-        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
-        $bookingRepository->method('findOneBy')->willReturn($booking);
-
-        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
-        $linkSigner->method('isValidLinkRequest')->willReturn(false);
+        $linkSigner->expects(self::once())->method('authorizeSession')->with(self::anything(), $booking);
 
         $controller = new TestableOfferController(
             $bookingRepository,
@@ -152,13 +39,37 @@ class OfferControllerTest extends TestCase
             $this->createMock(AccommodationBookingService::class),
         );
 
-        $response = $controller->index($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid()));
+        $response = $controller->access($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid()));
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/app_groups_booking_offer_view?uuid='.$booking->getUuid(), $response->getTargetUrl());
+    }
+
+    public function testAccessRendersUnavailableForInvalidLink(): void
+    {
+        $booking = new AccommodationBooking();
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isValidLinkRequest')->willReturn(false);
+        $linkSigner->expects(self::never())->method('authorizeSession');
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $this->createMock(AccommodationBookingService::class),
+        );
+
+        $response = $controller->access($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid()));
 
         self::assertSame(Response::HTTP_OK, $response->getStatusCode());
         self::assertSame('groups/booking/offer_unavailable.html.twig', $controller->renderedView);
     }
 
-    public function testUnknownUuidReturnsUnavailableResponse(): void
+    public function testAccessRendersUnavailableForUnknownUuid(): void
     {
         $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
         $bookingRepository->method('findOneBy')->willReturn(null);
@@ -173,29 +84,340 @@ class OfferControllerTest extends TestCase
             $this->createMock(AccommodationBookingService::class),
         );
 
-        $response = $controller->index('unknown-uuid', Request::create('/groups/booking/offer/unknown-uuid'));
+        $response = $controller->access('unknown-uuid', Request::create('/groups/booking/offer/unknown-uuid'));
 
         self::assertSame(Response::HTTP_OK, $response->getStatusCode());
         self::assertSame('groups/booking/offer_unavailable.html.twig', $controller->renderedView);
     }
+
+    public function testViewRendersOfferWhenSessionAuthorized(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(true);
+        $booking->setAccommodation(new Accommodation());
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->with(['uuid' => $booking->getUuid()])->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $breakdownCalculator = $this->createMock(AccommodationBookingBreakdownCalculator::class);
+        $breakdownCalculator->method('compute')->with($booking)->willReturn(['total' => 1000]);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::never())->method('acceptBooking');
+        $bookingService->method('loadHotelCmsData')->willReturn(null);
+
+        $controller = new TestableOfferController($bookingRepository, $linkSigner, $breakdownCalculator, $bookingService);
+
+        $request = Request::create('/groups/booking/offer/'.$booking->getUuid().'/view');
+        $request->setSession(new Session(new MockArraySessionStorage()));
+        $response = $controller->view($booking->getUuid(), $request);
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertSame('<html>offer</html>', $response->getContent());
+        self::assertSame('groups/booking/offer.html.twig', $controller->renderedView);
+        self::assertFalse($controller->renderedParameters['justAccepted']);
+        self::assertSame($booking, $controller->renderedParameters['booking']);
+        self::assertSame(['total' => 1000], $controller->renderedParameters['priceBreakdown']);
+        self::assertSame($booking->getAccommodation(), $controller->renderedParameters['ctx']->accommodation);
+    }
+
+    public function testViewRendersUnavailableWhenSessionNotAuthorized(): void
+    {
+        $booking = new AccommodationBooking();
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(false);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $this->createMock(AccommodationBookingService::class),
+        );
+
+        $response = $controller->view($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid().'/view'));
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertSame('groups/booking/offer_unavailable.html.twig', $controller->renderedView);
+    }
+
+    public function testViewMarksJustAcceptedWhenFlashIsPresent(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(false);
+        $booking->setAccommodation(new Accommodation());
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $breakdownCalculator = $this->createMock(AccommodationBookingBreakdownCalculator::class);
+        $breakdownCalculator->method('compute')->willReturn(['total' => 1000]);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $breakdownCalculator,
+            $this->createMock(AccommodationBookingService::class),
+        );
+
+        $session = new Session(new MockArraySessionStorage());
+        $session->getFlashBag()->add('accommodation_offer_accepted', true);
+
+        $request = Request::create('/groups/booking/offer/'.$booking->getUuid().'/view');
+        $request->setSession($session);
+        $response = $controller->view($booking->getUuid(), $request);
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertTrue($controller->renderedParameters['justAccepted']);
+    }
+
+    public function testConfirmGetRendersModalWithFreshForm(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(true);
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->with(['uuid' => $booking->getUuid()])->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(false);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $this->createMock(AccommodationBookingService::class),
+            $confirmationForm,
+        );
+
+        $response = $controller->confirm($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid().'/confirm'));
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertSame('groups/booking/_offer_accept_confirmation_modal.html.twig', $controller->renderedView);
+        self::assertSame($booking, $controller->renderedParameters['booking']);
+        self::assertSame($confirmationForm, $controller->renderedParameters['confirmationForm']);
+    }
+
+    public function testConfirmPostValidAcceptsBookingAndRedirects(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(true);
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::once())->method('acceptBooking')->with($booking);
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(true);
+        $confirmationForm->method('isValid')->willReturn(true);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $bookingService,
+            $confirmationForm,
+        );
+
+        $request = Request::create('/groups/booking/offer/'.$booking->getUuid().'/confirm', 'POST');
+        $response = $controller->confirm($booking->getUuid(), $request);
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/app_groups_booking_offer_view?uuid='.$booking->getUuid(), $response->getTargetUrl());
+    }
+
+    public function testConfirmPostValidViaHtmxReturnsHxRedirect(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(true);
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::once())->method('acceptBooking')->with($booking);
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(true);
+        $confirmationForm->method('isValid')->willReturn(true);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $bookingService,
+            $confirmationForm,
+        );
+
+        $request = Request::create('/groups/booking/offer/'.$booking->getUuid().'/confirm', 'POST');
+        $request->headers->set('HX-Request', 'true');
+        $response = $controller->confirm($booking->getUuid(), $request);
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertTrue($response->headers->has('HX-Redirect'));
+    }
+
+    public function testConfirmPostInvalidReRendersModalWithoutAccepting(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(true);
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::never())->method('acceptBooking');
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(true);
+        $confirmationForm->method('isValid')->willReturn(false);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $bookingService,
+            $confirmationForm,
+        );
+
+        $response = $controller->confirm($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid().'/confirm', 'POST'));
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertFalse($response->headers->has('HX-Redirect'));
+        self::assertSame('groups/booking/_offer_accept_confirmation_modal.html.twig', $controller->renderedView);
+    }
+
+    public function testConfirmRedirectsWhenAlreadyAccepted(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(false);
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $this->createMock(AccommodationBookingService::class),
+        );
+
+        $response = $controller->confirm($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid().'/confirm'));
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+    }
+
+    public function testConfirmRedirectsWhenSessionNotAuthorized(): void
+    {
+        $booking = new AccommodationBooking();
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(false);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $this->createMock(AccommodationBookingService::class),
+        );
+
+        $response = $controller->confirm($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid().'/confirm'));
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+    }
+
+    public function testConfirmRedirectsForUnknownUuid(): void
+    {
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn(null);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->expects(self::never())->method('isSessionAuthorized');
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $this->createMock(AccommodationBookingService::class),
+        );
+
+        $response = $controller->confirm('unknown-uuid', Request::create('/groups/booking/offer/unknown-uuid/confirm'));
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+    }
 }
 
 final class TestableOfferController extends OfferController
 {
-    public bool $csrfValid = true;
-    public ?string $csrfTokenId = null;
-    public ?string $csrfToken = null;
     public ?string $renderedView = null;
 
     /** @var array<string, mixed> */
     public array $renderedParameters = [];
 
-    protected function isCsrfTokenValid(string $id, ?string $token): bool
-    {
-        $this->csrfTokenId = $id;
-        $this->csrfToken = $token;
+    public function __construct(
+        AccommodationBookingRepository $bookingRepository,
+        AccommodationBookingLinkSigner $linkSigner,
+        AccommodationBookingBreakdownCalculator $breakdownCalculator,
+        AccommodationBookingService $bookingService,
+        private readonly ?FormInterface $confirmationForm = null,
+    ) {
+        parent::__construct($bookingRepository, $linkSigner, $breakdownCalculator, $bookingService);
+    }
 
-        return $this->csrfValid;
+    protected function createForm(string $type, mixed $data = null, array $options = []): FormInterface
+    {
+        return $this->confirmationForm ?? throw new \LogicException('No confirmation form mock configured for this test.');
+    }
+
+    protected function getParameter(string $name): array|bool|string|int|float|\UnitEnum|null
+    {
+        return 'https://example.test/agb/';
+    }
+
+    protected function addFlash(string $type, mixed $message): void
+    {
+        // no-op: avoids requiring a full service container in these unit tests
+    }
+
+    /**
+     * @param array<string, mixed> $parameters
+     */
+    protected function generateUrl(string $route, array $parameters = [], int $referenceType = 1): string
+    {
+        return '/'.$route.'?'.http_build_query($parameters);
     }
 
     protected function render(string $view, array $parameters = [], ?Response $response = null): Response

tests/Controller/Groups/Step4ControllerTest.php

@@ -0,0 +1,402 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller\Groups;
+
+use App\Controller\Groups\Step4Controller;
+use App\Entity\Groups\Accommodation;
+use App\Entity\Groups\AccommodationBooking;
+use App\Form\Model\AccommodationBookingDto;
+use App\Service\AccommodationBookingService;
+use App\Service\AccommodationSessionManager;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Form\FormInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\Session\Session;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
+
+class Step4ControllerTest extends TestCase
+{
+    public function testIndexRendersRecapWhenStepFourReached(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+        $dto->isInquiry = false;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4', 'GET');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->method('loadAvailableServices')->willReturn([
+            'boardServices' => [],
+            'additionalServices' => [],
+            'groupedAdditionalServices' => [],
+            'ungroupedAdditionalServices' => [],
+        ]);
+
+        $controller = new TestableStep4Controller($bookingService, $sessionManager, $this->createMock(FormInterface::class));
+
+        $response = $controller->index($request);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame('groups/booking/step_4.html.twig', $controller->renderedView);
+        self::assertSame($dto, $controller->renderedParameters['dto']);
+    }
+
+    public function testIndexRedirectsToStep3WhenNotYetReached(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 3;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4', 'GET');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $controller = new TestableStep4Controller(
+            $this->createMock(AccommodationBookingService::class),
+            $sessionManager,
+            $this->createMock(FormInterface::class),
+        );
+
+        $response = $controller->index($request);
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/app_groups_booking_step_3', $response->getTargetUrl());
+    }
+
+    public function testIndexPostWithValidCsrfPersistsAsInquiryAndRedirects(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4', 'POST');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $booking = (new AccommodationBooking())->setIsInquiry(true);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->method('loadAvailableServices')->willReturn([
+            'boardServices' => [],
+            'additionalServices' => [],
+            'groupedAdditionalServices' => [],
+            'ungroupedAdditionalServices' => [],
+        ]);
+        $bookingService->method('loadPrices')->willReturn([]);
+        $bookingService->expects(self::once())->method('finalizeBooking')->willReturn($booking);
+
+        $inquiryForm = $this->createMock(FormInterface::class);
+        $inquiryForm->method('handleRequest')->willReturnSelf();
+        $inquiryForm->method('isSubmitted')->willReturn(true);
+        $inquiryForm->method('isValid')->willReturn(true);
+
+        $controller = new TestableStep4Controller($bookingService, $sessionManager, $inquiryForm);
+
+        $response = $controller->index($request);
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/app_groups_booking_success', $response->getTargetUrl());
+        self::assertTrue($dto->forceInquiry);
+        self::assertNull($sessionManager->getDto($request));
+    }
+
+    public function testIndexPostWithInvalidFormThrowsAccessDenied(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4', 'POST');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->method('loadAvailableServices')->willReturn([
+            'boardServices' => [],
+            'additionalServices' => [],
+            'groupedAdditionalServices' => [],
+            'ungroupedAdditionalServices' => [],
+        ]);
+        $bookingService->expects(self::never())->method('finalizeBooking');
+
+        $inquiryForm = $this->createMock(FormInterface::class);
+        $inquiryForm->method('handleRequest')->willReturnSelf();
+        $inquiryForm->method('isSubmitted')->willReturn(true);
+        $inquiryForm->method('isValid')->willReturn(false);
+
+        $controller = new TestableStep4Controller($bookingService, $sessionManager, $inquiryForm);
+
+        $this->expectException(\Symfony\Component\Security\Core\Exception\AccessDeniedException::class);
+
+        $controller->index($request);
+    }
+
+    public function testConfirmInquiryGetRendersModal(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4/confirm-inquiry', 'GET');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $controller = new TestableStep4Controller(
+            $this->createMock(AccommodationBookingService::class),
+            $sessionManager,
+            $this->createMock(FormInterface::class),
+        );
+
+        $response = $controller->confirmInquiry($request);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame('groups/booking/_step4_inquiry_confirmation_modal.html.twig', $controller->renderedView);
+    }
+
+    public function testConfirmInquiryRedirectsToStep3WhenNotYetReached(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 3;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4/confirm-inquiry', 'GET');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $controller = new TestableStep4Controller(
+            $this->createMock(AccommodationBookingService::class),
+            $sessionManager,
+            $this->createMock(FormInterface::class),
+        );
+
+        $response = $controller->confirmInquiry($request);
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/app_groups_booking_step_3', $response->getTargetUrl());
+    }
+
+    public function testConfirmGetRendersModalWithFreshForm(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4/confirm', 'GET');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->expects(self::never())->method('finalizeBooking');
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(false);
+
+        $controller = new TestableStep4Controller($bookingService, $sessionManager, $confirmationForm);
+
+        $response = $controller->confirm($request);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame('groups/booking/_step4_booking_confirmation_modal.html.twig', $controller->renderedView);
+        self::assertSame($confirmationForm, $controller->renderedParameters['confirmationForm']);
+        self::assertSame($dto, $sessionManager->getDto($request));
+    }
+
+    public function testConfirmPostValidPersistsAndRedirects(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4/confirm', 'POST');
+        $request->setSession($session);
+        $request->headers->set('HX-Request', 'true');
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $booking = (new AccommodationBooking())->setIsInquiry(false);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->method('loadAvailableServices')->willReturn([
+            'boardServices' => [],
+            'additionalServices' => [],
+            'groupedAdditionalServices' => [],
+            'ungroupedAdditionalServices' => [],
+        ]);
+        $bookingService->method('loadPrices')->willReturn([]);
+        $bookingService->expects(self::once())->method('finalizeBooking')->willReturn($booking);
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(true);
+        $confirmationForm->method('isValid')->willReturn(true);
+
+        $controller = new TestableStep4Controller($bookingService, $sessionManager, $confirmationForm);
+
+        $response = $controller->confirm($request);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertTrue($response->headers->has('HX-Redirect'));
+        self::assertNull($sessionManager->getDto($request));
+    }
+
+    public function testConfirmPostInvalidReRendersModalWithoutPersisting(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4/confirm', 'POST');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->expects(self::never())->method('finalizeBooking');
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(true);
+        $confirmationForm->method('isValid')->willReturn(false);
+
+        $controller = new TestableStep4Controller($bookingService, $sessionManager, $confirmationForm);
+
+        $response = $controller->confirm($request);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertFalse($response->headers->has('HX-Redirect'));
+        self::assertSame('groups/booking/_step4_booking_confirmation_modal.html.twig', $controller->renderedView);
+        self::assertNotNull($sessionManager->getDto($request));
+    }
+}
+
+final class TestableStep4Controller extends Step4Controller
+{
+    /**
+     * @var array<string, mixed>
+     */
+    public array $renderedParameters = [];
+
+    public string $renderedView = '';
+
+    public function __construct(
+        AccommodationBookingService $bookingService,
+        AccommodationSessionManager $sessionManager,
+        private readonly FormInterface $form,
+    ) {
+        parent::__construct($bookingService, $sessionManager);
+    }
+
+    /**
+     * @return FormInterface<mixed>
+     */
+    protected function createForm(string $type, mixed $data = null, array $options = []): FormInterface
+    {
+        return $this->form;
+    }
+
+    protected function getParameter(string $name): array|bool|string|int|float|\UnitEnum|null
+    {
+        return 'https://example.test/agb/';
+    }
+
+    /**
+     * @param array<string, mixed> $parameters
+     */
+    protected function redirectToRoute(string $route, array $parameters = [], int $status = 302): RedirectResponse
+    {
+        return new RedirectResponse('/'.$route, $status);
+    }
+
+    /**
+     * @param array<string, mixed> $parameters
+     */
+    protected function generateUrl(string $route, array $parameters = [], int $referenceType = 1): string
+    {
+        return '/'.$route;
+    }
+
+    protected function addFlash(string $type, mixed $message): void
+    {
+        // no-op: avoids requiring a full service container in these unit tests
+    }
+
+    /**
+     * @param array<string, mixed> $parameters
+     */
+    protected function render(string $view, array $parameters = [], ?Response $response = null): Response
+    {
+        $this->renderedView = $view;
+        $this->renderedParameters = $parameters;
+
+        return new Response('ok');
+    }
+}

tests/Service/AccommodationBookingLinkSignerTest.php

@@ -8,6 +8,8 @@ use App\Entity\Groups\AccommodationBooking;
 use App\Service\AccommodationBookingLinkSigner;
 use PHPUnit\Framework\TestCase;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Session\Session;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 
 class AccommodationBookingLinkSignerTest extends TestCase
@@ -94,6 +96,77 @@ class AccommodationBookingLinkSignerTest extends TestCase
         self::assertSame('2026-04-01T00:00:00+00:00', $signer->expiresAt($booking)?->format(\DATE_ATOM));
     }
 
+    public function testSessionIsAuthorizedAfterAuthorizeSession(): void
+    {
+        $booking = $this->bookingWithAccessLink();
+        $signer = $this->createSigner();
+        $request = $this->requestWithSession();
+
+        self::assertFalse($signer->isSessionAuthorized($request, $booking));
+
+        $signer->authorizeSession($request, $booking);
+
+        self::assertTrue($signer->isSessionAuthorized($request, $booking));
+    }
+
+    public function testSessionAuthorizationIsPerBooking(): void
+    {
+        $booking = $this->bookingWithAccessLink();
+        $otherBooking = $this->bookingWithAccessLink();
+        $signer = $this->createSigner();
+        $request = $this->requestWithSession();
+
+        $signer->authorizeSession($request, $booking);
+
+        self::assertTrue($signer->isSessionAuthorized($request, $booking));
+        self::assertFalse($signer->isSessionAuthorized($request, $otherBooking));
+    }
+
+    public function testSessionAuthorizationIsRevokedWhenLinkIsRegenerated(): void
+    {
+        $booking = $this->bookingWithAccessLink();
+        $signer = $this->createSigner();
+        $request = $this->requestWithSession();
+
+        $signer->authorizeSession($request, $booking);
+        self::assertTrue($signer->isSessionAuthorized($request, $booking));
+
+        // Regenerating the access link overwrites accessLinkIssuedAt — the
+        // previously-authorized session no longer matches.
+        $booking->setAccessLinkIssuedAt(new \DateTimeImmutable('+1 minute'));
+
+        self::assertFalse($signer->isSessionAuthorized($request, $booking));
+    }
+
+    public function testSessionAuthorizationFailsPastTtlEvenIfSessionMatches(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setAccessLinkIssuedAt(new \DateTimeImmutable('-91 days'));
+        $signer = $this->createSigner();
+        $request = $this->requestWithSession();
+
+        $signer->authorizeSession($request, $booking);
+
+        self::assertFalse($signer->isSessionAuthorized($request, $booking));
+    }
+
+    public function testSessionAuthorizationFailsWithoutAccessLinkIssuedAt(): void
+    {
+        $booking = new AccommodationBooking();
+        $signer = $this->createSigner();
+        $request = $this->requestWithSession();
+
+        self::assertFalse($signer->isSessionAuthorized($request, $booking));
+    }
+
+    private function requestWithSession(): Request
+    {
+        $request = Request::create('https://example.com/');
+        $request->setSession(new Session(new MockArraySessionStorage()));
+
+        return $request;
+    }
+
     private function bookingWithAccessLink(): AccommodationBooking
     {
         $booking = new AccommodationBooking();