wip: group inquiries and booking

tests/Controller/Groups/OfferControllerTest.php

@@ -57,18 +57,54 @@ class OfferControllerTest extends TestCase
         $bookingService = $this->createMock(AccommodationBookingService::class);
         $bookingService->expects(self::once())->method('acceptBooking')->with($booking);
 
-        $controller = new OfferController(
+        $controller = new TestableOfferController(
             $bookingRepository,
             $linkSigner,
             $this->createMock(AccommodationBookingBreakdownCalculator::class),
             $bookingService,
         );
 
-        $request = Request::create('/groups/booking/offer/'.$booking->getUuid().'?t=123&_hash=abc', 'POST');
+        $request = Request::create(
+            '/groups/booking/offer/'.$booking->getUuid().'?t=123&_hash=abc',
+            'POST',
+            ['_token' => 'valid-token'],
+        );
         $response = $controller->index($booking->getUuid(), $request);
 
         self::assertSame(Response::HTTP_FOUND, $response->getStatusCode());
         self::assertSame($request->getUri(), $response->headers->get('Location'));
+        self::assertSame('accept_accommodation_offer_'.$booking->getUuid(), $controller->csrfTokenId);
+        self::assertSame('valid-token', $controller->csrfToken);
+    }
+
+    public function testPostRejectsInvalidCsrfToken(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(true);
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isValidLinkRequest')->willReturn(true);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::never())->method('acceptBooking');
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $bookingService,
+        );
+        $controller->csrfValid = false;
+
+        $this->expectException(\Symfony\Component\Security\Core\Exception\AccessDeniedException::class);
+
+        $controller->index(
+            $booking->getUuid(),
+            Request::create('/groups/booking/offer/'.$booking->getUuid(), 'POST', ['_token' => 'invalid']),
+        );
     }
 
     public function testGetRendersConfirmationWithoutAcceptFormForBooking(): void
@@ -146,11 +182,22 @@ class OfferControllerTest extends TestCase
 
 final class TestableOfferController extends OfferController
 {
+    public bool $csrfValid = true;
+    public ?string $csrfTokenId = null;
+    public ?string $csrfToken = null;
     public ?string $renderedView = null;
 
     /** @var array<string, mixed> */
     public array $renderedParameters = [];
 
+    protected function isCsrfTokenValid(string $id, ?string $token): bool
+    {
+        $this->csrfTokenId = $id;
+        $this->csrfToken = $token;
+
+        return $this->csrfValid;
+    }
+
     protected function render(string $view, array $parameters = [], ?Response $response = null): Response
     {
         $this->renderedView = $view;