feat: admin dashboard widgets

src/Dashboard/Widget/PendingRoleApprovalsWidgetProvider.php

@@ -0,0 +1,84 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Dashboard\Widget;
+
+use App\Dashboard\Contract\DashboardWidgetProviderInterface;
+use App\Entity\User;
+use App\Form\Model\Filter\AbstractListFilterDto;
+use App\Model\DashboardWidget;
+use App\Model\DashboardWidgetEntry;
+use App\Repository\UserRepository;
+use App\Security\Role;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+
+/**
+ * The accounts waiting on an administrator to act.
+ *
+ * A nomination grants nothing until it is approved, and nothing else in the application
+ * announces that one is waiting — without this widget an administrator only finds out by
+ * opening the user list.
+ */
+class PendingRoleApprovalsWidgetProvider implements DashboardWidgetProviderInterface
+{
+    private const LIMIT = 5;
+
+    public function __construct(
+        private readonly UserRepository $userRepository,
+        private readonly UrlGeneratorInterface $urlGenerator,
+    ) {
+    }
+
+    public function getRequiredRole(): string
+    {
+        return Role::ADMIN;
+    }
+
+    public function getPriority(): int
+    {
+        return 90;
+    }
+
+    public function build(): ?DashboardWidget
+    {
+        return new DashboardWidget(
+            'Offene Rollenfreigaben',
+            array_map(fn (User $user): DashboardWidgetEntry => new DashboardWidgetEntry(
+                $this->label($user),
+                $this->approvalUrl($user),
+                'user',
+            ), $this->userRepository->findWithPendingRoles(self::LIMIT)),
+            'Keine offenen Rollenfreigaben.',
+            $this->urlGenerator->generate('app_admin_user'),
+            'Alle Benutzer',
+        );
+    }
+
+    private function label(User $user): string
+    {
+        $nominated = Role::nominatedFrom($user->getRoles());
+
+        if ([] === $nominated) {
+            return $user->getDisplayName();
+        }
+
+        return sprintf('%s: %s', $user->getDisplayName(), implode(', ', $nominated));
+    }
+
+    /**
+     * The user list, filtered down to this account.
+     *
+     * Approving happens in a modal that app_admin_user_permissions renders as a bare fragment,
+     * so it cannot be linked to directly. The filtered list is one click away from it and shows
+     * the nomination badge on the way. The query string is flat because the list filter forms
+     * declare no block prefix.
+     */
+    private function approvalUrl(User $user): string
+    {
+        return $this->urlGenerator->generate('app_admin_user', [
+            AbstractListFilterDto::MARKER => 1,
+            'q' => $user->getEmail(),
+        ]);
+    }
+}