wip: group inquiries and booking

tests/Controller/Accommodation/Step2ControllerTest.php

@@ -79,7 +79,7 @@ class Step2ControllerTest extends TestCase
         $bookingService
             ->expects(self::once())
             ->method('computeInquiryStatus')
-            ->with(self::callback(static fn(AccommodationBookingDto $submittedDto): bool => 3 === $submittedDto->paxCount), [])
+            ->with(self::callback(static fn (AccommodationBookingDto $submittedDto): bool => 3 === $submittedDto->paxCount), [])
             ->willReturn(new InquiryStatus(true, ['Mindestaufenthalt: 5 Nächte (gebucht: 4)']));
 
         $controller = new TestableAccommodationStep2Controller(

tests/Controller/Api/AccommodationBookingControllerTest.php

@@ -51,7 +51,7 @@ class AccommodationBookingControllerTest extends TestCase
         $booking->setBoardServiceLabel('Halbpension');
         $booking->setBoardServicePrice(1500);
         $booking->addAdditionalServiceSnapshot('Bettwäsche', 500, 'flat', 3);
-        $booking->setDiscount(1000);
+        $booking->setDiscount(10);
         $booking->setIsInquiry(false);
         $booking->setAcceptedAt(new \DateTimeImmutable('2026-07-15T10:00:00+00:00'));
 
@@ -63,6 +63,7 @@ class AccommodationBookingControllerTest extends TestCase
             ->willReturn($booking);
 
         $breakdown = ['total' => 12345, 'currency' => 'EUR'];
+        $booking->setPriceSnapshot($breakdown, 11111, 'EUR', 1);
         $breakdownCalculator = $this->createMock(AccommodationBookingBreakdownCalculator::class);
         $breakdownCalculator
             ->expects(self::once())
@@ -116,7 +117,10 @@ class AccommodationBookingControllerTest extends TestCase
                     'type' => 'flat',
                 ],
             ],
-            'discount' => 1000,
+            'discount' => 10,
+            'totalPrice' => 11111,
+            'pricingCurrency' => 'EUR',
+            'pricingVersion' => 1,
             'priceBreakdown' => $breakdown,
         ], $payload);
 

tests/Controller/Groups/OfferControllerTest.php

@@ -57,18 +57,54 @@ class OfferControllerTest extends TestCase
         $bookingService = $this->createMock(AccommodationBookingService::class);
         $bookingService->expects(self::once())->method('acceptBooking')->with($booking);
 
-        $controller = new OfferController(
+        $controller = new TestableOfferController(
             $bookingRepository,
             $linkSigner,
             $this->createMock(AccommodationBookingBreakdownCalculator::class),
             $bookingService,
         );
 
-        $request = Request::create('/groups/booking/offer/'.$booking->getUuid().'?t=123&_hash=abc', 'POST');
+        $request = Request::create(
+            '/groups/booking/offer/'.$booking->getUuid().'?t=123&_hash=abc',
+            'POST',
+            ['_token' => 'valid-token'],
+        );
         $response = $controller->index($booking->getUuid(), $request);
 
         self::assertSame(Response::HTTP_FOUND, $response->getStatusCode());
         self::assertSame($request->getUri(), $response->headers->get('Location'));
+        self::assertSame('accept_accommodation_offer_'.$booking->getUuid(), $controller->csrfTokenId);
+        self::assertSame('valid-token', $controller->csrfToken);
+    }
+
+    public function testPostRejectsInvalidCsrfToken(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(true);
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isValidLinkRequest')->willReturn(true);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::never())->method('acceptBooking');
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $bookingService,
+        );
+        $controller->csrfValid = false;
+
+        $this->expectException(\Symfony\Component\Security\Core\Exception\AccessDeniedException::class);
+
+        $controller->index(
+            $booking->getUuid(),
+            Request::create('/groups/booking/offer/'.$booking->getUuid(), 'POST', ['_token' => 'invalid']),
+        );
     }
 
     public function testGetRendersConfirmationWithoutAcceptFormForBooking(): void
@@ -146,11 +182,22 @@ class OfferControllerTest extends TestCase
 
 final class TestableOfferController extends OfferController
 {
+    public bool $csrfValid = true;
+    public ?string $csrfTokenId = null;
+    public ?string $csrfToken = null;
     public ?string $renderedView = null;
 
     /** @var array<string, mixed> */
     public array $renderedParameters = [];
 
+    protected function isCsrfTokenValid(string $id, ?string $token): bool
+    {
+        $this->csrfTokenId = $id;
+        $this->csrfToken = $token;
+
+        return $this->csrfValid;
+    }
+
     protected function render(string $view, array $parameters = [], ?Response $response = null): Response
     {
         $this->renderedView = $view;