wip: group inquiries and booking

src/Controller/Groups/OfferController.php

@@ -4,6 +4,10 @@ declare(strict_types=1);
 
 namespace App\Controller\Groups;
 
+use App\Entity\Groups\AccommodationBooking;
+use App\Form\OfferAcceptConfirmationType;
+use App\Htmx\HxTrait;
+use App\Model\AccommodationBookingContext;
 use App\Repository\Groups\AccommodationBookingRepository;
 use App\Service\AccommodationBookingBreakdownCalculator;
 use App\Service\AccommodationBookingLinkSigner;
@@ -12,10 +16,13 @@ use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\Session\FlashBagAwareSessionInterface;
 use Symfony\Component\Routing\Attribute\Route;
 
 class OfferController extends AbstractController
 {
+    use HxTrait;
+
     public function __construct(
         private readonly AccommodationBookingRepository $bookingRepository,
         private readonly AccommodationBookingLinkSigner $linkSigner,
@@ -24,8 +31,13 @@ class OfferController extends AbstractController
     ) {
     }
 
-    #[Route(path: '/groups/booking/offer/{uuid}', name: 'app_groups_booking_offer', methods: ['GET', 'POST'])]
-    public function index(string $uuid, Request $request): Response
+    /**
+     * Signed-link entry point: validates the `t`/`_hash` query params once,
+     * authorizes the session for this booking, and redirects to the plain
+     * (session-gated) offer page — nothing downstream needs the signature again.
+     */
+    #[Route(path: '/groups/booking/offer/{uuid}', name: 'app_groups_booking_offer', methods: ['GET'])]
+    public function access(string $uuid, Request $request): Response
     {
         $booking = $this->bookingRepository->findOneBy(['uuid' => $uuid]);
 
@@ -33,19 +45,81 @@ class OfferController extends AbstractController
             return $this->render('groups/booking/offer_unavailable.html.twig');
         }
 
-        if ($request->isMethod(Request::METHOD_POST) && $booking->isInquiry()) {
-            if (!$this->isCsrfTokenValid('accept_accommodation_offer_'.$booking->getUuid(), $request->request->getString('_token'))) {
-                throw $this->createAccessDeniedException('Invalid CSRF token.');
-            }
+        $this->linkSigner->authorizeSession($request, $booking);
 
-            $this->bookingService->acceptBooking($booking);
+        return new RedirectResponse($this->generateUrl('app_groups_booking_offer_view', ['uuid' => $uuid]));
+    }
 
-            return new RedirectResponse($request->getUri());
+    #[Route(path: '/groups/booking/offer/{uuid}/view', name: 'app_groups_booking_offer_view', methods: ['GET'])]
+    public function view(string $uuid, Request $request): Response
+    {
+        $booking = $this->bookingRepository->findOneBy(['uuid' => $uuid]);
+
+        if (null === $booking || false === $this->linkSigner->isSessionAuthorized($request, $booking)) {
+            return $this->render('groups/booking/offer_unavailable.html.twig');
         }
 
+        $accommodation = $booking->getAccommodation() ?? throw $this->createNotFoundException('Booking has no accommodation.');
+        $priceBreakdown = $this->breakdownCalculator->compute($booking);
+
+        $ctx = new AccommodationBookingContext(
+            accommodation: $accommodation,
+            hotelCmsData: $this->bookingService->loadHotelCmsData($accommodation),
+            priceBreakdown: $priceBreakdown,
+        );
+
+        $session = $request->getSession();
+        $justAccepted = $session instanceof FlashBagAwareSessionInterface
+            && [] !== $session->getFlashBag()->get('accommodation_offer_accepted');
+
         return $this->render('groups/booking/offer.html.twig', [
             'booking' => $booking,
-            'priceBreakdown' => $this->breakdownCalculator->compute($booking),
+            'priceBreakdown' => $priceBreakdown,
+            'ctx' => $ctx,
+            'justAccepted' => $justAccepted,
         ]);
     }
+
+    #[Route(path: '/groups/booking/offer/{uuid}/confirm', name: 'app_groups_booking_offer_confirm', methods: ['GET', 'POST'])]
+    public function confirm(string $uuid, Request $request): Response
+    {
+        $booking = $this->bookingRepository->findOneBy(['uuid' => $uuid]);
+
+        if (null === $booking || false === $this->linkSigner->isSessionAuthorized($request, $booking)) {
+            return $this->redirectToOfferPage($request, $uuid);
+        }
+
+        if (!$booking->isInquiry()) {
+            return $this->redirectToOfferPage($request, $uuid);
+        }
+
+        $confirmationForm = $this->createForm(OfferAcceptConfirmationType::class, null, [
+            'terms_url' => $this->getParameter('terms_and_conditions_url'),
+        ]);
+        $confirmationForm->handleRequest($request);
+
+        if ($confirmationForm->isSubmitted() && $confirmationForm->isValid()) {
+            $this->bookingService->acceptBooking($booking);
+            $this->addFlash('accommodation_offer_accepted', true);
+
+            return $this->redirectToOfferPage($request, $uuid);
+        }
+
+        return $this->render('groups/booking/_offer_accept_confirmation_modal.html.twig', [
+            'booking' => $booking,
+            'confirmationForm' => $confirmationForm,
+        ]);
+    }
+
+    /**
+     * Sends the browser to a full reload of the (non-modal) offer page — this is
+     * triggered from an htmx-loaded modal, so a plain render/redirect here would
+     * get appended as an inert HTML fragment instead of actually navigating.
+     */
+    private function redirectToOfferPage(Request $request, string $uuid): Response
+    {
+        $url = $this->generateUrl('app_groups_booking_offer_view', ['uuid' => $uuid]);
+
+        return $this->htmxRedirect($request, $url);
+    }
 }