feat: local user registration

tests/Controller/Account/PersonalDataControllerTest.php

@@ -11,15 +11,23 @@ use App\Entity\User;
 use App\Model\NewsletterSubscriptionRequestResult;
 use App\Service\BookingEditDataLoader;
 use App\Service\NewsletterManager;
-use App\Service\ProfileCompletenessChecker;
 use Doctrine\ORM\EntityManagerInterface;
 use PHPUnit\Framework\TestCase;
 use Psr\Log\LoggerInterface;
 use Symfony\Component\Form\FormInterface;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\Session\Session;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 use Symfony\Component\Security\Core\User\UserInterface;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\ConstraintValidatorFactory;
+use Symfony\Component\Validator\ConstraintValidatorInterface;
+use Symfony\Component\Validator\Constraints\Email;
+use Symfony\Component\Validator\Constraints\EmailValidator;
+use Symfony\Component\Validator\Validation;
+use Symfony\Component\Validator\Validator\ValidatorInterface;
 
 class PersonalDataControllerTest extends TestCase
 {
@@ -149,8 +157,55 @@ class PersonalDataControllerTest extends TestCase
         ], $controller->flashes);
     }
 
-    private function createController(): TestablePersonalDataController
+    public function testIndexRecomputesProfileCompletionAfterSavingPersonalData(): void
     {
+        $personalData = $this->createCompletePersonalData();
+        $controller = $this->createController(true, true, $this->validator());
+
+        $controller->apiClient
+            ->expects(self::once())
+            ->method('getPersonalData')
+            ->with('[email protected]', null, null)
+            ->willReturn($personalData);
+        $controller->apiClient
+            ->expects(self::once())
+            ->method('updatePersonalData')
+            ->with('[email protected]', $personalData)
+            ->willReturn($personalData);
+        $controller->newsletterManager
+            ->expects(self::once())
+            ->method('hasConfirmedOptIn')
+            ->with('[email protected]')
+            ->willReturn(false);
+        $controller->newsletterManager
+            ->expects(self::once())
+            ->method('hasPendingConfirmation')
+            ->with('[email protected]')
+            ->willReturn(false);
+        $controller->dataLoader
+            ->expects(self::once())
+            ->method('invalidateUserBookingCaches')
+            ->with($controller->user);
+        $controller->entityManager
+            ->expects(self::once())
+            ->method('flush');
+
+        $request = Request::create('/personal-data', 'POST');
+        $request->setSession(new Session(new MockArraySessionStorage()));
+        $response = $controller->index($request);
+
+        self::assertSame(302, $response->getStatusCode());
+        self::assertTrue($controller->user->isProfileComplete());
+        self::assertSame([
+            ['success', 'Deine persönlichen Daten wurden aktualisiert'],
+        ], $controller->flashes);
+    }
+
+    private function createController(
+        bool $submitted = false,
+        bool $valid = false,
+        ?ValidatorInterface $validator = null,
+    ): TestablePersonalDataController {
         $user = new User('[email protected]');
         $user->setPassword('secret');
 
@@ -162,12 +217,17 @@ class PersonalDataControllerTest extends TestCase
             ->willReturnSelf();
         $form
             ->method('isSubmitted')
-            ->willReturn(false);
+            ->willReturn($submitted);
+        $form
+            ->method('isValid')
+            ->willReturn($valid);
+
+        $validator ??= $this->createMock(ValidatorInterface::class);
 
         return new TestablePersonalDataController(
             $apiClient,
             $this->createMock(BookingEditDataLoader::class),
-            $this->createMock(ProfileCompletenessChecker::class),
+            $validator,
             $this->createMock(EntityManagerInterface::class),
             $this->createMock(NewsletterManager::class),
             $this->createMock(LoggerInterface::class),
@@ -184,6 +244,41 @@ class PersonalDataControllerTest extends TestCase
 
         return $personalData;
     }
+
+    private function createCompletePersonalData(): PersonalData
+    {
+        $personalData = new PersonalData();
+        $personalData->firstName = 'Mia';
+        $personalData->name = 'Muster';
+        $personalData->gender = 'W';
+        $personalData->nationality = 'DE';
+        $personalData->dateOfBirth = new \DateTimeImmutable('1990-05-15');
+        $personalData->address->street = 'Main Street 1';
+        $personalData->address->postCode = '10115';
+        $personalData->address->city = 'Berlin';
+        $personalData->address->country = 'DE';
+        $personalData->communication->email = '[email protected]';
+        $personalData->communication->mobile = '0123456789';
+
+        return $personalData;
+    }
+
+    private function validator(): ValidatorInterface
+    {
+        return Validation::createValidatorBuilder()
+            ->enableAttributeMapping()
+            ->setConstraintValidatorFactory(new class extends ConstraintValidatorFactory {
+                public function getInstance(Constraint $constraint): ConstraintValidatorInterface
+                {
+                    if (true === ($constraint instanceof Email)) {
+                        return new EmailValidator(Email::VALIDATION_MODE_HTML5);
+                    }
+
+                    return parent::getInstance($constraint);
+                }
+            })
+            ->getValidator();
+    }
 }
 
 final class TestablePersonalDataController extends PersonalDataController
@@ -202,18 +297,18 @@ final class TestablePersonalDataController extends PersonalDataController
 
     public function __construct(
         public readonly ApiClient $apiClient,
-        BookingEditDataLoader $dataLoader,
-        ProfileCompletenessChecker $completenessChecker,
-        EntityManagerInterface $entityManager,
+        public readonly BookingEditDataLoader $dataLoader,
+        public readonly ValidatorInterface $validator,
+        public readonly EntityManagerInterface $entityManager,
         public readonly NewsletterManager $newsletterManager,
         LoggerInterface $logger,
-        private readonly User $user,
+        public readonly User $user,
         private readonly FormInterface $form,
     ) {
         parent::__construct(
             $apiClient,
             $dataLoader,
-            $completenessChecker,
+            $validator,
             $entityManager,
             $newsletterManager,
             $logger,

tests/Controller/RegistrationControllerTest.php

@@ -0,0 +1,353 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller;
+
+use App\BusProNet\ApiClient;
+use App\BusProNet\Exception\ApiClientException;
+use App\BusProNet\Model\BaseData;
+use App\BusProNet\Model\Country;
+use App\BusProNet\Model\RegistrationResponse;
+use App\Entity\User;
+use App\Repository\UserRepository;
+use App\Service\PublicFormRateLimiter;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+
+class RegistrationControllerTest extends WebTestCase
+{
+    public function testRegistrationIsThrottledAtHttpLayer(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $userRepository = $this->createMock(UserRepository::class);
+        $userRepository
+            ->expects(self::once())
+            ->method('findOneByNormalizedEmail')
+            ->with('[email protected]')
+            ->willReturn(null);
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter
+            ->expects(self::once())
+            ->method('isRegistrationAllowed')
+            ->with('[email protected]', self::isInstanceOf(Request::class))
+            ->willReturn(false);
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $this->configureBaseData($apiClient);
+        $apiClient->expects(self::never())->method('register');
+        $apiClient->expects(self::never())->method('getCrmAttributesWithPassword');
+        $apiClient->expects(self::never())->method('getPersonalDataWithPassword');
+
+        self::getContainer()->set(UserRepository::class, $userRepository);
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(ApiClient::class, $apiClient);
+
+        $crawler = $client->request('GET', '/registration');
+        $form = $crawler->selectButton('Jetzt registrieren')->form([
+            'registration[firstName]' => 'Customer',
+            'registration[name]' => 'Example',
+            'registration[plainPassword][first]' => 'secret-password',
+            'registration[plainPassword][second]' => 'secret-password',
+            'registration[personalData][gender]' => 'M',
+            'registration[personalData][dateOfBirth][day]' => '1',
+            'registration[personalData][dateOfBirth][month]' => '1',
+            'registration[personalData][dateOfBirth][year]' => '1990',
+            'registration[personalData][street]' => 'Main Street 1',
+            'registration[personalData][postCode]' => '12345',
+            'registration[personalData][city]' => 'Berlin',
+            'registration[personalData][country]' => 'DE',
+            'registration[personalData][nationality]' => 'DE',
+            'registration[personalData][email]' => '[email protected]',
+            'registration[personalData][mobile]' => '0123456789',
+        ]);
+        $client->submit($form);
+
+        self::assertResponseStatusCodeSame(429);
+        self::assertStringContainsString(PublicFormRateLimiter::THROTTLED_MESSAGE, $client->getResponse()->getContent());
+    }
+
+    public function testDuplicateLocalUserRedirectsToResetPassword(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $existingUser = new User('[email protected]');
+
+        $userRepository = $this->createMock(UserRepository::class);
+        $userRepository
+            ->expects(self::once())
+            ->method('findOneByNormalizedEmail')
+            ->with('[email protected]')
+            ->willReturn($existingUser);
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter->expects(self::never())->method('isRegistrationAllowed');
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $this->configureBaseData($apiClient);
+        $apiClient->expects(self::never())->method('register');
+        $apiClient->expects(self::never())->method('getCrmAttributesWithPassword');
+        $apiClient->expects(self::never())->method('getPersonalDataWithPassword');
+
+        self::getContainer()->set(UserRepository::class, $userRepository);
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(ApiClient::class, $apiClient);
+
+        $crawler = $client->request('GET', '/registration');
+        $form = $crawler->selectButton('Jetzt registrieren')->form([
+            'registration[firstName]' => 'Customer',
+            'registration[name]' => 'Example',
+            'registration[plainPassword][first]' => 'secret-password',
+            'registration[plainPassword][second]' => 'secret-password',
+            'registration[personalData][gender]' => 'M',
+            'registration[personalData][dateOfBirth][day]' => '1',
+            'registration[personalData][dateOfBirth][month]' => '1',
+            'registration[personalData][dateOfBirth][year]' => '1990',
+            'registration[personalData][street]' => 'Main Street 1',
+            'registration[personalData][postCode]' => '12345',
+            'registration[personalData][city]' => 'Berlin',
+            'registration[personalData][country]' => 'DE',
+            'registration[personalData][nationality]' => 'DE',
+            'registration[personalData][email]' => '[email protected]',
+            'registration[personalData][mobile]' => '0123456789',
+        ]);
+        $client->submit($form);
+
+        self::assertResponseRedirects('/reset-password');
+    }
+
+    public function testIncompleteRegistrationSubmissionIsRejectedByValidation(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $userRepository = $this->createMock(UserRepository::class);
+        $userRepository->expects(self::never())->method('findOneByNormalizedEmail');
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter->expects(self::never())->method('isRegistrationAllowed');
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $this->configureBaseData($apiClient);
+        $apiClient->expects(self::never())->method('register');
+        $apiClient->expects(self::never())->method('getCrmAttributesWithPassword');
+        $apiClient->expects(self::never())->method('getPersonalDataWithPassword');
+
+        self::getContainer()->set(UserRepository::class, $userRepository);
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(ApiClient::class, $apiClient);
+
+        $crawler = $client->request('GET', '/registration');
+        $form = $crawler->selectButton('Jetzt registrieren')->form([
+            'registration[firstName]' => 'Customer',
+            'registration[name]' => 'Example',
+            'registration[plainPassword][first]' => 'secret-password',
+            'registration[plainPassword][second]' => 'secret-password',
+            'registration[personalData][gender]' => 'M',
+            'registration[personalData][dateOfBirth][day]' => '1',
+            'registration[personalData][dateOfBirth][month]' => '1',
+            'registration[personalData][dateOfBirth][year]' => '1990',
+            'registration[personalData][street]' => 'Main Street 1',
+            'registration[personalData][postCode]' => '12345',
+            'registration[personalData][city]' => 'Berlin',
+            'registration[personalData][country]' => 'DE',
+            'registration[personalData][nationality]' => 'DE',
+            'registration[personalData][email]' => '[email protected]',
+        ]);
+        $client->submit($form);
+
+        self::assertResponseStatusCodeSame(422);
+    }
+
+    public function testSuccessfulRegistrationDoesNotRefetchPersonalData(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $userRepository = $this->createMock(UserRepository::class);
+        $userRepository
+            ->expects(self::once())
+            ->method('findOneByNormalizedEmail')
+            ->with('[email protected]')
+            ->willReturn(null);
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter
+            ->expects(self::once())
+            ->method('isRegistrationAllowed')
+            ->with('[email protected]', self::isInstanceOf(Request::class))
+            ->willReturn(true);
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $this->configureBaseData($apiClient);
+        $apiClient
+            ->expects(self::once())
+            ->method('register')
+            ->with(self::callback(function ($registrationData): bool {
+                self::assertSame('[email protected]', $registrationData->communication->email);
+
+                return true;
+            }))
+            ->willReturn(new RegistrationResponse(123, 456, true));
+        $apiClient
+            ->expects(self::never())
+            ->method('getPersonalDataWithPassword');
+        $apiClient
+            ->expects(self::never())
+            ->method('getCrmAttributesWithPassword');
+
+        $passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
+        $passwordHasher
+            ->expects(self::once())
+            ->method('hashPassword')
+            ->with(self::isInstanceOf(User::class), 'secret-password')
+            ->willReturn('hashed-secret');
+
+        $persistedUser = null;
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager
+            ->expects(self::once())
+            ->method('persist')
+            ->with(self::callback(static function (User $user) use (&$persistedUser): bool {
+                $persistedUser = $user;
+
+                return true;
+            }));
+        $entityManager
+            ->expects(self::once())
+            ->method('flush');
+
+        self::getContainer()->set(UserRepository::class, $userRepository);
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(ApiClient::class, $apiClient);
+        self::getContainer()->set(UserPasswordHasherInterface::class, $passwordHasher);
+        self::getContainer()->set(EntityManagerInterface::class, $entityManager);
+
+        $crawler = $client->request('GET', '/registration');
+        $form = $crawler->selectButton('Jetzt registrieren')->form([
+            'registration[firstName]' => 'Customer',
+            'registration[name]' => 'Example',
+            'registration[plainPassword][first]' => 'secret-password',
+            'registration[plainPassword][second]' => 'secret-password',
+            'registration[personalData][gender]' => 'M',
+            'registration[personalData][dateOfBirth][day]' => '1',
+            'registration[personalData][dateOfBirth][month]' => '1',
+            'registration[personalData][dateOfBirth][year]' => '1990',
+            'registration[personalData][street]' => 'Main Street 1',
+            'registration[personalData][postCode]' => '12345',
+            'registration[personalData][city]' => 'Berlin',
+            'registration[personalData][country]' => 'DE',
+            'registration[personalData][nationality]' => 'DE',
+            'registration[personalData][email]' => '[email protected]',
+            'registration[personalData][mobile]' => '0123456789',
+        ]);
+        $client->submit($form);
+
+        self::assertResponseRedirects('/');
+        self::assertInstanceOf(User::class, $persistedUser);
+        self::assertSame('[email protected]', $persistedUser->getEmail());
+        self::assertSame('hashed-secret', $persistedUser->getPassword());
+        self::assertSame(123, $persistedUser->getAddressId());
+        self::assertSame(456, $persistedUser->getPersonId());
+        self::assertSame(['ROLE_USER'], $persistedUser->getRoles());
+        self::assertSame([], $persistedUser->getHotelCodes());
+        self::assertTrue($persistedUser->isProfileComplete());
+    }
+
+    public function testRegistrationApiFailureRendersFormInsteadOfResetPassword(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $userRepository = $this->createMock(UserRepository::class);
+        $userRepository
+            ->expects(self::once())
+            ->method('findOneByNormalizedEmail')
+            ->with('[email protected]')
+            ->willReturn(null);
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter
+            ->expects(self::once())
+            ->method('isRegistrationAllowed')
+            ->with('[email protected]', self::isInstanceOf(Request::class))
+            ->willReturn(true);
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $this->configureBaseData($apiClient);
+        $apiClient
+            ->expects(self::once())
+            ->method('register')
+            ->willThrowException(new ApiClientException('Registrierung momentan nicht möglich.'));
+        $apiClient
+            ->expects(self::never())
+            ->method('getCrmAttributesWithPassword');
+        $apiClient
+            ->expects(self::never())
+            ->method('getPersonalDataWithPassword');
+
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager
+            ->expects(self::never())
+            ->method('persist');
+        $entityManager
+            ->expects(self::never())
+            ->method('flush');
+
+        self::getContainer()->set(UserRepository::class, $userRepository);
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(ApiClient::class, $apiClient);
+        self::getContainer()->set(EntityManagerInterface::class, $entityManager);
+
+        $crawler = $client->request('GET', '/registration');
+        $form = $crawler->selectButton('Jetzt registrieren')->form([
+            'registration[firstName]' => 'Customer',
+            'registration[name]' => 'Example',
+            'registration[plainPassword][first]' => 'secret-password',
+            'registration[plainPassword][second]' => 'secret-password',
+            'registration[personalData][gender]' => 'M',
+            'registration[personalData][dateOfBirth][day]' => '1',
+            'registration[personalData][dateOfBirth][month]' => '1',
+            'registration[personalData][dateOfBirth][year]' => '1990',
+            'registration[personalData][street]' => 'Main Street 1',
+            'registration[personalData][postCode]' => '12345',
+            'registration[personalData][city]' => 'Berlin',
+            'registration[personalData][country]' => 'DE',
+            'registration[personalData][nationality]' => 'DE',
+            'registration[personalData][email]' => '[email protected]',
+            'registration[personalData][mobile]' => '0123456789',
+        ]);
+        $client->submit($form);
+
+        self::assertResponseStatusCodeSame(502);
+        self::assertStringContainsString('Registrierung momentan nicht möglich.', $client->getResponse()->getContent());
+    }
+
+    private function configureBaseData(ApiClient $apiClient): void
+    {
+        $country = new Country();
+        $country->token = 'DE';
+        $country->name = 'Germany';
+        $country->nationality = 'DE';
+
+        $apiClient
+            ->method('getBaseData')
+            ->willReturn(new BaseData(['DE' => $country]));
+    }
+}

tests/Controller/ResetPasswordControllerTest.php

@@ -6,6 +6,7 @@ namespace App\Tests\Controller;
 
 use App\Entity\User;
 use App\Service\PasswordResetManager;
+use App\Service\PublicFormRateLimiter;
 use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
 use Symfony\Component\HttpFoundation\Request;
 
@@ -65,6 +66,44 @@ class ResetPasswordControllerTest extends WebTestCase
         self::assertStringContainsString('Du erhältst in Kürze eine E-Mail mit einem Link zum Zurücksetzen deines Passworts', $client->getResponse()->getContent());
     }
 
+    public function testPasswordResetRequestReturns429WhenThrottled(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+        $client->disableReboot();
+
+        $email = sprintf('throttle-%[email protected]', bin2hex(random_bytes(4)));
+
+        $manager = $this->createMock(PasswordResetManager::class);
+        $manager
+            ->expects(self::exactly(5))
+            ->method('requestPasswordReset')
+            ->with($email)
+            ->willReturn(true);
+        self::getContainer()->set(PasswordResetManager::class, $manager);
+
+        for ($i = 0; $i < 5; ++$i) {
+            $crawler = $client->request('GET', '/reset-password');
+            $form = $crawler->selectButton('Passwort-Reset-Link anfordern')->form([
+                'form[email]' => $email,
+            ]);
+            $client->submit($form);
+
+            self::assertResponseRedirects('/');
+            $client->followRedirect();
+        }
+
+        $crawler = $client->request('GET', '/reset-password');
+        $form = $crawler->selectButton('Passwort-Reset-Link anfordern')->form([
+            'form[email]' => $email,
+        ]);
+        $client->submit($form);
+
+        self::assertResponseStatusCodeSame(429);
+        self::assertStringContainsString(PublicFormRateLimiter::THROTTLED_MESSAGE, $client->getResponse()->getContent());
+    }
+
     public function testPasswordResetConfirmationDisplaysFormAndUpdatesPassword(): void
     {
         $client = self::createClient([], [