feat: local user registration

2026-06-23 16:27:08 +02:00
1 parent 8bb7f08074
commit 161029ec7c
@@ -0,0 +1,118 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\BusProNet\Model;
+
+use App\BusProNet\Model\Address;
+use App\BusProNet\Model\Communication;
+use App\BusProNet\Model\PersonalData;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\ConstraintValidatorFactory;
+use Symfony\Component\Validator\ConstraintValidatorInterface;
+use Symfony\Component\Validator\Constraints\Email;
+use Symfony\Component\Validator\Constraints\EmailValidator;
+use Symfony\Component\Validator\Validation;
+use Symfony\Component\Validator\Validator\ValidatorInterface;
+
+class PersonalDataCompletenessTest extends TestCase
+{
+    public function testCompletePersonalDataPassesPersonalDataValidationGroup(): void
+    {
+        $personalData = $this->createCompletePersonalData();
+        $personalData->remarks = 'Optional note';
+        $personalData->address->district = 'Mitte';
+        $personalData->communication->phone = '0301234567';
+
+        $violations = $this->validator()->validate($personalData, null, ['personal_data']);
+
+        self::assertCount(0, $violations);
+    }
+
+    public function testMissingRequiredPersonalDataFieldFailsPersonalDataValidationGroup(): void
+    {
+        $personalData = $this->createCompletePersonalData();
+        $personalData->name = null;
+
+        $violations = $this->validator()->validate($personalData, null, ['personal_data']);
+
+        self::assertCount(1, $violations);
+        self::assertSame('name', $violations->get(0)->getPropertyPath());
+    }
+
+    public function testAddressCompletenessIgnoresOptionalDistrict(): void
+    {
+        $address = new Address();
+        $address->street = 'Main Street 1';
+        $address->postCode = '12345';
+        $address->city = 'Berlin';
+        $address->country = 'DE';
+        $address->district = 'Mitte';
+
+        $violations = $this->validator()->validate($address, null, ['personal_data']);
+
+        self::assertCount(0, $violations);
+
+        $address->street = null;
+
+        $violations = $this->validator()->validate($address, null, ['personal_data']);
+
+        self::assertCount(1, $violations);
+        self::assertSame('street', $violations->get(0)->getPropertyPath());
+    }
+
+    public function testCommunicationCompletenessIgnoresOptionalPhone(): void
+    {
+        $communication = new Communication();
+        $communication->email = '[email protected]';
+        $communication->mobile = '0123456789';
+        $communication->phone = '0301234567';
+
+        $violations = $this->validator()->validate($communication, null, ['personal_data']);
+
+        self::assertCount(0, $violations);
+
+        $communication->mobile = null;
+
+        $violations = $this->validator()->validate($communication, null, ['personal_data']);
+
+        self::assertCount(1, $violations);
+        self::assertSame('mobile', $violations->get(0)->getPropertyPath());
+    }
+
+    private function createCompletePersonalData(): PersonalData
+    {
+        $personalData = new PersonalData();
+        $personalData->firstName = 'Mia';
+        $personalData->name = 'Muster';
+        $personalData->gender = 'W';
+        $personalData->nationality = 'DE';
+        $personalData->dateOfBirth = new \DateTimeImmutable('1990-05-15');
+        $personalData->address->street = 'Main Street 1';
+        $personalData->address->postCode = '10115';
+        $personalData->address->city = 'Berlin';
+        $personalData->address->country = 'DE';
+        $personalData->communication->email = '[email protected]';
+        $personalData->communication->mobile = '0123456789';
+
+        return $personalData;
+    }
+
+    private function validator(): ValidatorInterface
+    {
+        return Validation::createValidatorBuilder()
+            ->enableAttributeMapping()
+            ->setConstraintValidatorFactory(new class extends ConstraintValidatorFactory {
+                public function getInstance(Constraint $constraint): ConstraintValidatorInterface
+                {
+                    if (true === ($constraint instanceof Email)) {
+                        return new EmailValidator(Email::VALIDATION_MODE_HTML5);
+                    }
+
+                    return parent::getInstance($constraint);
+                }
+            })
+            ->getValidator();
+    }
+}
@@ -11,15 +11,23 @@ use App\Entity\User;
 use App\Model\NewsletterSubscriptionRequestResult;
 use App\Service\BookingEditDataLoader;
 use App\Service\NewsletterManager;
-use App\Service\ProfileCompletenessChecker;
 use Doctrine\ORM\EntityManagerInterface;
 use PHPUnit\Framework\TestCase;
 use Psr\Log\LoggerInterface;
 use Symfony\Component\Form\FormInterface;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\Session\Session;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 use Symfony\Component\Security\Core\User\UserInterface;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\ConstraintValidatorFactory;
+use Symfony\Component\Validator\ConstraintValidatorInterface;
+use Symfony\Component\Validator\Constraints\Email;
+use Symfony\Component\Validator\Constraints\EmailValidator;
+use Symfony\Component\Validator\Validation;
+use Symfony\Component\Validator\Validator\ValidatorInterface;

 class PersonalDataControllerTest extends TestCase
 {
@@ -149,8 +157,55 @@ class PersonalDataControllerTest extends TestCase
        ], $controller->flashes);
    }

-    private function createController(): TestablePersonalDataController
+    public function testIndexRecomputesProfileCompletionAfterSavingPersonalData(): void
    {
+        $personalData = $this->createCompletePersonalData();
+        $controller = $this->createController(true, true, $this->validator());
+
+        $controller->apiClient
+            ->expects(self::once())
+            ->method('getPersonalData')
+            ->with('[email protected]', null, null)
+            ->willReturn($personalData);
+        $controller->apiClient
+            ->expects(self::once())
+            ->method('updatePersonalData')
+            ->with('[email protected]', $personalData)
+            ->willReturn($personalData);
+        $controller->newsletterManager
+            ->expects(self::once())
+            ->method('hasConfirmedOptIn')
+            ->with('[email protected]')
+            ->willReturn(false);
+        $controller->newsletterManager
+            ->expects(self::once())
+            ->method('hasPendingConfirmation')
+            ->with('[email protected]')
+            ->willReturn(false);
+        $controller->dataLoader
+            ->expects(self::once())
+            ->method('invalidateUserBookingCaches')
+            ->with($controller->user);
+        $controller->entityManager
+            ->expects(self::once())
+            ->method('flush');
+
+        $request = Request::create('/personal-data', 'POST');
+        $request->setSession(new Session(new MockArraySessionStorage()));
+        $response = $controller->index($request);
+
+        self::assertSame(302, $response->getStatusCode());
+        self::assertTrue($controller->user->isProfileComplete());
+        self::assertSame([
+            ['success', 'Deine persönlichen Daten wurden aktualisiert'],
+        ], $controller->flashes);
+    }
+
+    private function createController(
+        bool $submitted = false,
+        bool $valid = false,
+        ?ValidatorInterface $validator = null,
+    ): TestablePersonalDataController {
        $user = new User('[email protected]');
        $user->setPassword('secret');

@@ -162,12 +217,17 @@ class PersonalDataControllerTest extends TestCase
            ->willReturnSelf();
        $form
            ->method('isSubmitted')
-            ->willReturn(false);
+            ->willReturn($submitted);
+        $form
+            ->method('isValid')
+            ->willReturn($valid);
+
+        $validator ??= $this->createMock(ValidatorInterface::class);

        return new TestablePersonalDataController(
            $apiClient,
            $this->createMock(BookingEditDataLoader::class),
-            $this->createMock(ProfileCompletenessChecker::class),
+            $validator,
            $this->createMock(EntityManagerInterface::class),
            $this->createMock(NewsletterManager::class),
            $this->createMock(LoggerInterface::class),
@@ -184,6 +244,41 @@ class PersonalDataControllerTest extends TestCase

        return $personalData;
    }
+
+    private function createCompletePersonalData(): PersonalData
+    {
+        $personalData = new PersonalData();
+        $personalData->firstName = 'Mia';
+        $personalData->name = 'Muster';
+        $personalData->gender = 'W';
+        $personalData->nationality = 'DE';
+        $personalData->dateOfBirth = new \DateTimeImmutable('1990-05-15');
+        $personalData->address->street = 'Main Street 1';
+        $personalData->address->postCode = '10115';
+        $personalData->address->city = 'Berlin';
+        $personalData->address->country = 'DE';
+        $personalData->communication->email = '[email protected]';
+        $personalData->communication->mobile = '0123456789';
+
+        return $personalData;
+    }
+
+    private function validator(): ValidatorInterface
+    {
+        return Validation::createValidatorBuilder()
+            ->enableAttributeMapping()
+            ->setConstraintValidatorFactory(new class extends ConstraintValidatorFactory {
+                public function getInstance(Constraint $constraint): ConstraintValidatorInterface
+                {
+                    if (true === ($constraint instanceof Email)) {
+                        return new EmailValidator(Email::VALIDATION_MODE_HTML5);
+                    }
+
+                    return parent::getInstance($constraint);
+                }
+            })
+            ->getValidator();
+    }
 }

 final class TestablePersonalDataController extends PersonalDataController
@@ -202,18 +297,18 @@ final class TestablePersonalDataController extends PersonalDataController

    public function __construct(
        public readonly ApiClient $apiClient,
-        BookingEditDataLoader $dataLoader,
-        ProfileCompletenessChecker $completenessChecker,
-        EntityManagerInterface $entityManager,
+        public readonly BookingEditDataLoader $dataLoader,
+        public readonly ValidatorInterface $validator,
+        public readonly EntityManagerInterface $entityManager,
        public readonly NewsletterManager $newsletterManager,
        LoggerInterface $logger,
-        private readonly User $user,
+        public readonly User $user,
        private readonly FormInterface $form,
    ) {
        parent::__construct(
            $apiClient,
            $dataLoader,
-            $completenessChecker,
+            $validator,
            $entityManager,
            $newsletterManager,
            $logger,
@@ -0,0 +1,353 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller;
+
+use App\BusProNet\ApiClient;
+use App\BusProNet\Exception\ApiClientException;
+use App\BusProNet\Model\BaseData;
+use App\BusProNet\Model\Country;
+use App\BusProNet\Model\RegistrationResponse;
+use App\Entity\User;
+use App\Repository\UserRepository;
+use App\Service\PublicFormRateLimiter;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+
+class RegistrationControllerTest extends WebTestCase
+{
+    public function testRegistrationIsThrottledAtHttpLayer(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $userRepository = $this->createMock(UserRepository::class);
+        $userRepository
+            ->expects(self::once())
+            ->method('findOneByNormalizedEmail')
+            ->with('[email protected]')
+            ->willReturn(null);
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter
+            ->expects(self::once())
+            ->method('isRegistrationAllowed')
+            ->with('[email protected]', self::isInstanceOf(Request::class))
+            ->willReturn(false);
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $this->configureBaseData($apiClient);
+        $apiClient->expects(self::never())->method('register');
+        $apiClient->expects(self::never())->method('getCrmAttributesWithPassword');
+        $apiClient->expects(self::never())->method('getPersonalDataWithPassword');
+
+        self::getContainer()->set(UserRepository::class, $userRepository);
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(ApiClient::class, $apiClient);
+
+        $crawler = $client->request('GET', '/registration');
+        $form = $crawler->selectButton('Jetzt registrieren')->form([
+            'registration[firstName]' => 'Customer',
+            'registration[name]' => 'Example',
+            'registration[plainPassword][first]' => 'secret-password',
+            'registration[plainPassword][second]' => 'secret-password',
+            'registration[personalData][gender]' => 'M',
+            'registration[personalData][dateOfBirth][day]' => '1',
+            'registration[personalData][dateOfBirth][month]' => '1',
+            'registration[personalData][dateOfBirth][year]' => '1990',
+            'registration[personalData][street]' => 'Main Street 1',
+            'registration[personalData][postCode]' => '12345',
+            'registration[personalData][city]' => 'Berlin',
+            'registration[personalData][country]' => 'DE',
+            'registration[personalData][nationality]' => 'DE',
+            'registration[personalData][email]' => '[email protected]',
+            'registration[personalData][mobile]' => '0123456789',
+        ]);
+        $client->submit($form);
+
+        self::assertResponseStatusCodeSame(429);
+        self::assertStringContainsString(PublicFormRateLimiter::THROTTLED_MESSAGE, $client->getResponse()->getContent());
+    }
+
+    public function testDuplicateLocalUserRedirectsToResetPassword(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $existingUser = new User('[email protected]');
+
+        $userRepository = $this->createMock(UserRepository::class);
+        $userRepository
+            ->expects(self::once())
+            ->method('findOneByNormalizedEmail')
+            ->with('[email protected]')
+            ->willReturn($existingUser);
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter->expects(self::never())->method('isRegistrationAllowed');
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $this->configureBaseData($apiClient);
+        $apiClient->expects(self::never())->method('register');
+        $apiClient->expects(self::never())->method('getCrmAttributesWithPassword');
+        $apiClient->expects(self::never())->method('getPersonalDataWithPassword');
+
+        self::getContainer()->set(UserRepository::class, $userRepository);
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(ApiClient::class, $apiClient);
+
+        $crawler = $client->request('GET', '/registration');
+        $form = $crawler->selectButton('Jetzt registrieren')->form([
+            'registration[firstName]' => 'Customer',
+            'registration[name]' => 'Example',
+            'registration[plainPassword][first]' => 'secret-password',
+            'registration[plainPassword][second]' => 'secret-password',
+            'registration[personalData][gender]' => 'M',
+            'registration[personalData][dateOfBirth][day]' => '1',
+            'registration[personalData][dateOfBirth][month]' => '1',
+            'registration[personalData][dateOfBirth][year]' => '1990',
+            'registration[personalData][street]' => 'Main Street 1',
+            'registration[personalData][postCode]' => '12345',
+            'registration[personalData][city]' => 'Berlin',
+            'registration[personalData][country]' => 'DE',
+            'registration[personalData][nationality]' => 'DE',
+            'registration[personalData][email]' => '[email protected]',
+            'registration[personalData][mobile]' => '0123456789',
+        ]);
+        $client->submit($form);
+
+        self::assertResponseRedirects('/reset-password');
+    }
+
+    public function testIncompleteRegistrationSubmissionIsRejectedByValidation(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $userRepository = $this->createMock(UserRepository::class);
+        $userRepository->expects(self::never())->method('findOneByNormalizedEmail');
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter->expects(self::never())->method('isRegistrationAllowed');
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $this->configureBaseData($apiClient);
+        $apiClient->expects(self::never())->method('register');
+        $apiClient->expects(self::never())->method('getCrmAttributesWithPassword');
+        $apiClient->expects(self::never())->method('getPersonalDataWithPassword');
+
+        self::getContainer()->set(UserRepository::class, $userRepository);
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(ApiClient::class, $apiClient);
+
+        $crawler = $client->request('GET', '/registration');
+        $form = $crawler->selectButton('Jetzt registrieren')->form([
+            'registration[firstName]' => 'Customer',
+            'registration[name]' => 'Example',
+            'registration[plainPassword][first]' => 'secret-password',
+            'registration[plainPassword][second]' => 'secret-password',
+            'registration[personalData][gender]' => 'M',
+            'registration[personalData][dateOfBirth][day]' => '1',
+            'registration[personalData][dateOfBirth][month]' => '1',
+            'registration[personalData][dateOfBirth][year]' => '1990',
+            'registration[personalData][street]' => 'Main Street 1',
+            'registration[personalData][postCode]' => '12345',
+            'registration[personalData][city]' => 'Berlin',
+            'registration[personalData][country]' => 'DE',
+            'registration[personalData][nationality]' => 'DE',
+            'registration[personalData][email]' => '[email protected]',
+        ]);
+        $client->submit($form);
+
+        self::assertResponseStatusCodeSame(422);
+    }
+
+    public function testSuccessfulRegistrationDoesNotRefetchPersonalData(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $userRepository = $this->createMock(UserRepository::class);
+        $userRepository
+            ->expects(self::once())
+            ->method('findOneByNormalizedEmail')
+            ->with('[email protected]')
+            ->willReturn(null);
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter
+            ->expects(self::once())
+            ->method('isRegistrationAllowed')
+            ->with('[email protected]', self::isInstanceOf(Request::class))
+            ->willReturn(true);
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $this->configureBaseData($apiClient);
+        $apiClient
+            ->expects(self::once())
+            ->method('register')
+            ->with(self::callback(function ($registrationData): bool {
+                self::assertSame('[email protected]', $registrationData->communication->email);
+
+                return true;
+            }))
+            ->willReturn(new RegistrationResponse(123, 456, true));
+        $apiClient
+            ->expects(self::never())
+            ->method('getPersonalDataWithPassword');
+        $apiClient
+            ->expects(self::never())
+            ->method('getCrmAttributesWithPassword');
+
+        $passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
+        $passwordHasher
+            ->expects(self::once())
+            ->method('hashPassword')
+            ->with(self::isInstanceOf(User::class), 'secret-password')
+            ->willReturn('hashed-secret');
+
+        $persistedUser = null;
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager
+            ->expects(self::once())
+            ->method('persist')
+            ->with(self::callback(static function (User $user) use (&$persistedUser): bool {
+                $persistedUser = $user;
+
+                return true;
+            }));
+        $entityManager
+            ->expects(self::once())
+            ->method('flush');
+
+        self::getContainer()->set(UserRepository::class, $userRepository);
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(ApiClient::class, $apiClient);
+        self::getContainer()->set(UserPasswordHasherInterface::class, $passwordHasher);
+        self::getContainer()->set(EntityManagerInterface::class, $entityManager);
+
+        $crawler = $client->request('GET', '/registration');
+        $form = $crawler->selectButton('Jetzt registrieren')->form([
+            'registration[firstName]' => 'Customer',
+            'registration[name]' => 'Example',
+            'registration[plainPassword][first]' => 'secret-password',
+            'registration[plainPassword][second]' => 'secret-password',
+            'registration[personalData][gender]' => 'M',
+            'registration[personalData][dateOfBirth][day]' => '1',
+            'registration[personalData][dateOfBirth][month]' => '1',
+            'registration[personalData][dateOfBirth][year]' => '1990',
+            'registration[personalData][street]' => 'Main Street 1',
+            'registration[personalData][postCode]' => '12345',
+            'registration[personalData][city]' => 'Berlin',
+            'registration[personalData][country]' => 'DE',
+            'registration[personalData][nationality]' => 'DE',
+            'registration[personalData][email]' => '[email protected]',
+            'registration[personalData][mobile]' => '0123456789',
+        ]);
+        $client->submit($form);
+
+        self::assertResponseRedirects('/');
+        self::assertInstanceOf(User::class, $persistedUser);
+        self::assertSame('[email protected]', $persistedUser->getEmail());
+        self::assertSame('hashed-secret', $persistedUser->getPassword());
+        self::assertSame(123, $persistedUser->getAddressId());
+        self::assertSame(456, $persistedUser->getPersonId());
+        self::assertSame(['ROLE_USER'], $persistedUser->getRoles());
+        self::assertSame([], $persistedUser->getHotelCodes());
+        self::assertTrue($persistedUser->isProfileComplete());
+    }
+
+    public function testRegistrationApiFailureRendersFormInsteadOfResetPassword(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $userRepository = $this->createMock(UserRepository::class);
+        $userRepository
+            ->expects(self::once())
+            ->method('findOneByNormalizedEmail')
+            ->with('[email protected]')
+            ->willReturn(null);
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter
+            ->expects(self::once())
+            ->method('isRegistrationAllowed')
+            ->with('[email protected]', self::isInstanceOf(Request::class))
+            ->willReturn(true);
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $this->configureBaseData($apiClient);
+        $apiClient
+            ->expects(self::once())
+            ->method('register')
+            ->willThrowException(new ApiClientException('Registrierung momentan nicht möglich.'));
+        $apiClient
+            ->expects(self::never())
+            ->method('getCrmAttributesWithPassword');
+        $apiClient
+            ->expects(self::never())
+            ->method('getPersonalDataWithPassword');
+
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager
+            ->expects(self::never())
+            ->method('persist');
+        $entityManager
+            ->expects(self::never())
+            ->method('flush');
+
+        self::getContainer()->set(UserRepository::class, $userRepository);
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(ApiClient::class, $apiClient);
+        self::getContainer()->set(EntityManagerInterface::class, $entityManager);
+
+        $crawler = $client->request('GET', '/registration');
+        $form = $crawler->selectButton('Jetzt registrieren')->form([
+            'registration[firstName]' => 'Customer',
+            'registration[name]' => 'Example',
+            'registration[plainPassword][first]' => 'secret-password',
+            'registration[plainPassword][second]' => 'secret-password',
+            'registration[personalData][gender]' => 'M',
+            'registration[personalData][dateOfBirth][day]' => '1',
+            'registration[personalData][dateOfBirth][month]' => '1',
+            'registration[personalData][dateOfBirth][year]' => '1990',
+            'registration[personalData][street]' => 'Main Street 1',
+            'registration[personalData][postCode]' => '12345',
+            'registration[personalData][city]' => 'Berlin',
+            'registration[personalData][country]' => 'DE',
+            'registration[personalData][nationality]' => 'DE',
+            'registration[personalData][email]' => '[email protected]',
+            'registration[personalData][mobile]' => '0123456789',
+        ]);
+        $client->submit($form);
+
+        self::assertResponseStatusCodeSame(502);
+        self::assertStringContainsString('Registrierung momentan nicht möglich.', $client->getResponse()->getContent());
+    }
+
+    private function configureBaseData(ApiClient $apiClient): void
+    {
+        $country = new Country();
+        $country->token = 'DE';
+        $country->name = 'Germany';
+        $country->nationality = 'DE';
+
+        $apiClient
+            ->method('getBaseData')
+            ->willReturn(new BaseData(['DE' => $country]));
+    }
+}
@@ -6,6 +6,7 @@ namespace App\Tests\Controller;

 use App\Entity\User;
 use App\Service\PasswordResetManager;
+use App\Service\PublicFormRateLimiter;
 use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
 use Symfony\Component\HttpFoundation\Request;

@@ -65,6 +66,44 @@ class ResetPasswordControllerTest extends WebTestCase
        self::assertStringContainsString('Du erhältst in Kürze eine E-Mail mit einem Link zum Zurücksetzen deines Passworts', $client->getResponse()->getContent());
    }

+    public function testPasswordResetRequestReturns429WhenThrottled(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $email = sprintf('throttle-%[email protected]', bin2hex(random_bytes(4)));
+
+        $manager = $this->createMock(PasswordResetManager::class);
+        $manager
+            ->expects(self::exactly(5))
+            ->method('requestPasswordReset')
+            ->with($email)
+            ->willReturn(true);
+        self::getContainer()->set(PasswordResetManager::class, $manager);
+
+        for ($i = 0; $i < 5; ++$i) {
+            $crawler = $client->request('GET', '/reset-password');
+            $form = $crawler->selectButton('Passwort-Reset-Link anfordern')->form([
+                'form[email]' => $email,
+            ]);
+            $client->submit($form);
+
+            self::assertResponseRedirects('/');
+            $client->followRedirect();
+        }
+
+        $crawler = $client->request('GET', '/reset-password');
+        $form = $crawler->selectButton('Passwort-Reset-Link anfordern')->form([
+            'form[email]' => $email,
+        ]);
+        $client->submit($form);
+
+        self::assertResponseStatusCodeSame(429);
+        self::assertStringContainsString(PublicFormRateLimiter::THROTTLED_MESSAGE, $client->getResponse()->getContent());
+    }
+
    public function testPasswordResetConfirmationDisplaysFormAndUpdatesPassword(): void
    {
        $client = self::createClient([], [
@@ -5,26 +5,35 @@ declare(strict_types=1);
 namespace App\Tests\Security;

 use App\BusProNet\ApiClient;
+use App\BusProNet\Exception\TimeoutException;
 use App\BusProNet\Model\CrmAttributes;
 use App\BusProNet\Model\PersonalData;
 use App\Entity\User;
+use App\Repository\UserRepository;
 use App\Security\BpnAuthenticator;
 use App\Security\Crypt;
+use App\Service\UserBootstrapper;
 use Doctrine\ORM\EntityManagerInterface;
-use Doctrine\ORM\EntityRepository;
 use PHPUnit\Framework\TestCase;
 use Psr\Log\LoggerInterface;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
 use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
-use App\Service\ProfileCompletenessChecker;
+use Symfony\Component\Validator\ConstraintViolationList;
+use Symfony\Component\Validator\Validator\ValidatorInterface;

 class BpnAuthenticatorTest extends TestCase
 {
    public function testAuthenticateAcceptsLocalPasswordHashWithoutLegacyDecryption(): void
    {
        $user = new User('[email protected]');
+        $user
+            ->setAddressId(10)
+            ->setPersonId(20)
+            ->setProfileComplete(false)
+        ;
        $user->setPassword(password_hash('secret', PASSWORD_BCRYPT));

        $passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
@@ -34,14 +43,52 @@ class BpnAuthenticatorTest extends TestCase
            ->with($user, 'secret')
            ->willReturn(true);

+        $personalData = new PersonalData();
+        $personalData->addressId = 123;
+        $personalData->personId = 456;
+        $personalData->firstName = 'Mia';
+        $personalData->name = 'Muster';
+        $personalData->gender = 'W';
+        $personalData->nationality = 'DE';
+        $personalData->dateOfBirth = new \DateTimeImmutable('1990-05-15');
+        $personalData->communication->email = '[email protected]';
+        $personalData->address->street = 'Main Street 1';
+        $personalData->address->postCode = '10115';
+        $personalData->address->city = 'Berlin';
+        $personalData->address->country = 'DE';
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $apiClient
+            ->expects(self::once())
+            ->method('getPersonalData')
+            ->with('[email protected]', 10, 20)
+            ->willReturn($personalData);
+        $apiClient
+            ->expects(self::once())
+            ->method('getCrmAttributes')
+            ->with('[email protected]', 123, 456)
+            ->willReturn((function (): CrmAttributes {
+                $crmAttributes = new CrmAttributes();
+                $crmAttributes->roles = ['ROLE_ADMIN'];
+                $crmAttributes->hotelCodes = ['AAA'];
+
+                return $crmAttributes;
+            })());
+
        $authenticator = $this->createAuthenticator(
            user: $user,
+            apiClient: $apiClient,
            passwordHasher: $passwordHasher,
        );

        $passport = $authenticator->authenticate($this->createRequest('[email protected]', 'secret'));

        self::assertInstanceOf(SelfValidatingPassport::class, $passport);
+        self::assertSame(123, $user->getAddressId());
+        self::assertSame(456, $user->getPersonId());
+        self::assertTrue($user->isProfileComplete());
+        self::assertSame(['ROLE_USER', 'ROLE_ADMIN'], $user->getRoles());
+        self::assertSame(['AAA'], $user->getHotelCodes());
    }

    public function testAuthenticateMigratesLegacyPasswordToLocalHashOnSuccess(): void
@@ -66,8 +113,41 @@ class BpnAuthenticatorTest extends TestCase
            ->with($user, 'secret')
            ->willReturn('local-hash');

+        $personalData = new PersonalData();
+        $personalData->addressId = 123;
+        $personalData->personId = 456;
+        $personalData->firstName = 'Mia';
+        $personalData->name = 'Muster';
+        $personalData->gender = 'W';
+        $personalData->nationality = 'DE';
+        $personalData->dateOfBirth = new \DateTimeImmutable('1990-05-15');
+        $personalData->communication->email = '[email protected]';
+        $personalData->address->street = 'Main Street 1';
+        $personalData->address->postCode = '10115';
+        $personalData->address->city = 'Berlin';
+        $personalData->address->country = 'DE';
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $apiClient
+            ->expects(self::once())
+            ->method('getPersonalData')
+            ->with('[email protected]', null, null)
+            ->willReturn($personalData);
+        $apiClient
+            ->expects(self::once())
+            ->method('getCrmAttributes')
+            ->with('[email protected]', 123, 456)
+            ->willReturn((function (): CrmAttributes {
+                $crmAttributes = new CrmAttributes();
+                $crmAttributes->roles = ['ROLE_CUSTOMER'];
+                $crmAttributes->hotelCodes = [];
+
+                return $crmAttributes;
+            })());
+
        $authenticator = $this->createAuthenticator(
            user: $user,
+            apiClient: $apiClient,
            crypt: $crypt,
            passwordHasher: $passwordHasher,
        );
@@ -76,6 +156,70 @@ class BpnAuthenticatorTest extends TestCase

        self::assertInstanceOf(SelfValidatingPassport::class, $passport);
        self::assertSame('local-hash', $user->getPassword());
+        self::assertSame(123, $user->getAddressId());
+        self::assertSame(456, $user->getPersonId());
+    }
+
+    public function testAuthenticateFailsClosedWhenCrmSyncFailsAfterLocalPasswordValidation(): void
+    {
+        $user = new User('[email protected]');
+        $user
+            ->setPassword(password_hash('secret', PASSWORD_BCRYPT))
+            ->setRoles(['ROLE_ADMIN'])
+            ->setHotelCodes(['STALE'])
+        ;
+
+        $passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
+        $passwordHasher
+            ->expects(self::once())
+            ->method('isPasswordValid')
+            ->with($user, 'secret')
+            ->willReturn(true);
+
+        $personalData = new PersonalData();
+        $personalData->addressId = 123;
+        $personalData->personId = 456;
+        $personalData->firstName = 'Mia';
+        $personalData->name = 'Muster';
+        $personalData->gender = 'W';
+        $personalData->nationality = 'DE';
+        $personalData->dateOfBirth = new \DateTimeImmutable('1990-05-15');
+        $personalData->communication->email = '[email protected]';
+        $personalData->address->street = 'Main Street 1';
+        $personalData->address->postCode = '10115';
+        $personalData->address->city = 'Berlin';
+        $personalData->address->country = 'DE';
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $apiClient
+            ->expects(self::once())
+            ->method('getPersonalData')
+            ->with('[email protected]', null, null)
+            ->willReturn($personalData);
+        $apiClient
+            ->expects(self::once())
+            ->method('getCrmAttributes')
+            ->with('[email protected]', 123, 456)
+            ->willThrowException(new TimeoutException());
+
+        $validator = $this->createMock(ValidatorInterface::class);
+        $validator
+            ->expects(self::once())
+            ->method('validate')
+            ->with($personalData, null, ['personal_data'])
+            ->willReturn(new ConstraintViolationList());
+
+        $authenticator = $this->createAuthenticator(
+            user: $user,
+            apiClient: $apiClient,
+            passwordHasher: $passwordHasher,
+            validator: $validator,
+            expectFlush: false,
+        );
+
+        $this->expectException(CustomUserMessageAuthenticationException::class);
+
+        $authenticator->authenticate($this->createRequest('[email protected]', 'secret'));
    }

    public function testAuthenticateBootstrapsMissingUserFromBpn(): void
@@ -119,19 +263,20 @@ class BpnAuthenticatorTest extends TestCase
            ->with(self::isInstanceOf(User::class), $password)
            ->willReturn('local-hash');

-        $completenessChecker = $this->createMock(ProfileCompletenessChecker::class);
-        $completenessChecker
+        $validator = $this->createMock(ValidatorInterface::class);
+        $validator
            ->expects(self::once())
-            ->method('isComplete')
-            ->with($personalData)
-            ->willReturn(true);
+            ->method('validate')
+            ->with($personalData, null, ['personal_data'])
+            ->willReturn(new ConstraintViolationList());
+        $userBootstrapper = new UserBootstrapper();

        $persistedUser = null;
-        $repository = $this->createMock(EntityRepository::class);
+        $repository = $this->createMock(UserRepository::class);
        $repository
            ->expects(self::once())
-            ->method('findOneBy')
-            ->with(['email' => $email])
+            ->method('findOneByNormalizedEmail')
+            ->with($email)
            ->willReturn(null);

        $entityManager = $this->createMock(EntityManagerInterface::class);
@@ -155,8 +300,9 @@ class BpnAuthenticatorTest extends TestCase
            $apiClient,
            $entityManager,
            $this->createMock(Crypt::class),
-            $completenessChecker,
            $passwordHasher,
+            $validator,
+            $userBootstrapper,
            $this->createMock(LoggerInterface::class),
        );

@@ -172,19 +318,108 @@ class BpnAuthenticatorTest extends TestCase
        self::assertTrue($persistedUser->isProfileComplete());
    }

+    public function testAuthenticatePreservesNullBpnIdsWhenBootstrappingMissingUser(): void
+    {
+        $email = '[email protected]';
+        $password = 'secret';
+
+        $personalData = new PersonalData();
+        $personalData->addressId = null;
+        $personalData->personId = null;
+
+        $crmAttributes = new CrmAttributes();
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $apiClient->expects(self::once())
+            ->method('getPersonalDataWithPassword')
+            ->with($email, $password)
+            ->willReturn($personalData);
+        $apiClient->expects(self::once())
+            ->method('getCrmAttributesWithPassword')
+            ->with($email, $password)
+            ->willReturn($crmAttributes);
+
+        $passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
+        $passwordHasher
+            ->expects(self::once())
+            ->method('hashPassword')
+            ->with(self::isInstanceOf(User::class), $password)
+            ->willReturn('local-hash');
+
+        $validator = $this->createMock(ValidatorInterface::class);
+        $validator
+            ->expects(self::once())
+            ->method('validate')
+            ->with($personalData, null, ['personal_data'])
+            ->willReturn(new ConstraintViolationList());
+
+        $persistedUser = null;
+        $repository = $this->createMock(UserRepository::class);
+        $repository
+            ->expects(self::once())
+            ->method('findOneByNormalizedEmail')
+            ->with($email)
+            ->willReturn(null);
+
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager
+            ->method('getRepository')
+            ->willReturn($repository);
+        $entityManager
+            ->expects(self::once())
+            ->method('persist')
+            ->with(self::callback(static function (User $user) use (&$persistedUser): bool {
+                $persistedUser = $user;
+
+                return true;
+            }));
+        $entityManager
+            ->expects(self::once())
+            ->method('flush');
+
+        $authenticator = new BpnAuthenticator(
+            $this->createMock(UrlGeneratorInterface::class),
+            $apiClient,
+            $entityManager,
+            $this->createMock(Crypt::class),
+            $passwordHasher,
+            $validator,
+            new UserBootstrapper(),
+            $this->createMock(LoggerInterface::class),
+        );
+
+        $authenticator->authenticate($this->createRequest($email, $password));
+
+        self::assertInstanceOf(User::class, $persistedUser);
+        self::assertNull($persistedUser->getAddressId());
+        self::assertNull($persistedUser->getPersonId());
+    }
+
    private function createAuthenticator(
        ?User $user = null,
        ?ApiClient $apiClient = null,
        ?Crypt $crypt = null,
-        ?ProfileCompletenessChecker $completenessChecker = null,
        ?UserPasswordHasherInterface $passwordHasher = null,
+        ?ValidatorInterface $validator = null,
+        ?UserBootstrapper $userBootstrapper = null,
+        bool $expectFlush = true,
    ): BpnAuthenticator {
-        $repository = $this->createMock(EntityRepository::class);
+        $validatorProvided = null !== $validator;
+        $passwordHasher ??= $this->createMock(UserPasswordHasherInterface::class);
+        $validator ??= $this->createMock(ValidatorInterface::class);
+        if (!$validatorProvided) {
+            $validator
+                ->method('validate')
+                ->willReturn(new ConstraintViolationList());
+        }
+        $userBootstrapper ??= new UserBootstrapper();
+
+        $repository = $this->createMock(UserRepository::class);
        $repository
            ->expects(self::once())
-            ->method('findOneBy')
-            ->with(self::callback(static function (array $criteria): bool {
-                return isset($criteria['email']) && is_string($criteria['email']);
+            ->method('findOneByNormalizedEmail')
+            ->with(self::callback(static function (string $email): bool {
+                return '' !== trim($email);
            }))
            ->willReturn($user);

@@ -194,7 +429,7 @@ class BpnAuthenticatorTest extends TestCase
            ->with(User::class)
            ->willReturn($repository);
        $entityManager
-            ->expects(self::once())
+            ->expects($expectFlush ? self::once() : self::never())
            ->method('flush');
        $entityManager
            ->expects(null === $user ? self::once() : self::never())
@@ -205,8 +440,9 @@ class BpnAuthenticatorTest extends TestCase
            $apiClient ?? $this->createMock(ApiClient::class),
            $entityManager,
            $crypt ?? $this->createMock(Crypt::class),
-            $completenessChecker ?? $this->createMock(ProfileCompletenessChecker::class),
-            $passwordHasher ?? $this->createMock(UserPasswordHasherInterface::class),
+            $passwordHasher,
+            $validator,
+            $userBootstrapper,
            $this->createMock(LoggerInterface::class),
        );
    }
@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Support;
+
+use App\Service\PublicFormRateLimiter;
+use Symfony\Component\HttpFoundation\Request;
+
+class TestPublicFormRateLimiter extends PublicFormRateLimiter
+{
+    /**
+     * @var array<string, int>
+     */
+    private array $counters = [];
+
+    public function __construct()
+    {
+    }
+
+    public function isRegistrationAllowed(string $email, Request $request): bool
+    {
+        return $this->consume($email, $request);
+    }
+
+    public function isPasswordResetAllowed(string $email, Request $request): bool
+    {
+        return $this->consume($email, $request);
+    }
+
+    public function createBucketKey(string $email, ?string $clientIp): string
+    {
+        return hash('sha256', mb_strtolower(trim($email)).'|'.($clientIp ?? 'unknown'));
+    }
+
+    private function consume(string $email, Request $request): bool
+    {
+        $bucketKey = $this->createBucketKey($email, $request->getClientIp());
+        $current = $this->counters[$bucketKey] ?? 0;
+        $this->counters[$bucketKey] = ++$current;
+
+        return 5 >= $current;
+    }
+}