EP/myep
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: reserve administrative roles for staff email addresses

Browse Source
This commit is contained in:
fromme
2026-09-17 18:13:52 +02:00
parent 725e32daab
commit 540cd8eeb7
11 changed files with 230 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Security/BpnAuthenticatorTest.php
+43 -15
View File
@@ -43,7 +43,7 @@ class BpnAuthenticatorTest extends TestCase
{
$persisted = null;
$authenticator = $this->authenticator(
$this->crmAttributes([Role::ADMIN, Role::TEAMER], ['SSL', 'SSL']),
$this->crmAttributes([Role::HOUSE_MANAGER, Role::TEAMER], ['SSL', 'SSL']),
null,
$persisted,
);
@@ -51,7 +51,7 @@ class BpnAuthenticatorTest extends TestCase
$user = $this->loadUser($authenticator);
self::assertSame($persisted, $user);
self::assertSame(['ROLE_USER', Role::TEAMER, Role::pending(Role::ADMIN)], $user->getRoles());
self::assertSame(['ROLE_USER', Role::TEAMER, Role::pending(Role::HOUSE_MANAGER)], $user->getRoles());
self::assertSame(['SSL'], $user->getHotelCodes());
}
@@ -61,7 +61,7 @@ class BpnAuthenticatorTest extends TestCase
$persisted = null;
$authenticator = $this->authenticator(
$this->crmAttributes([Role::TEAMER, Role::GROUPS_ADMIN], []),
$this->crmAttributes([Role::TEAMER, Role::HOUSE_MANAGER], []),
$existing,
$persisted,
);
@@ -70,7 +70,7 @@ class BpnAuthenticatorTest extends TestCase
self::assertSame($existing, $persisted, 'a login must not create a second account');
self::assertSame(
['ROLE_USER', Role::TEAMER, Role::pending(Role::GROUPS_ADMIN)],
['ROLE_USER', Role::TEAMER, Role::pending(Role::HOUSE_MANAGER)],
$user->getRoles(),
);
self::assertNotNull($user->getLastLoginAt(), 'the rest of the profile is still synced');
@@ -78,24 +78,24 @@ class BpnAuthenticatorTest extends TestCase
public function testApprovedRoleSurvivesTheNextLogin(): void
{
$existing = (new User('[email protected]'))->setRoles([Role::TEAMER, Role::GROUPS_MANAGER]);
$existing = (new User('[email protected]'))->setRoles([Role::TEAMER, Role::HOUSE_MANAGER]);
$persisted = null;
$authenticator = $this->authenticator(
$this->crmAttributes([Role::TEAMER, Role::GROUPS_MANAGER], []),
$this->crmAttributes([Role::TEAMER, Role::HOUSE_MANAGER], []),
$existing,
$persisted,
);
self::assertSame(
['ROLE_USER', Role::TEAMER, Role::GROUPS_MANAGER],
['ROLE_USER', Role::TEAMER, Role::HOUSE_MANAGER],
$this->loadUser($authenticator)->getRoles(),
);
}
public function testRoleRevokedInBusProIsWithdrawnOnLogin(): void
{
$existing = (new User('[email protected]'))->setRoles([Role::TEAMER, Role::GROUPS_MANAGER]);
$existing = (new User('[email protected]'))->setRoles([Role::TEAMER, Role::HOUSE_MANAGER]);
$persisted = null;
$authenticator = $this->authenticator($this->crmAttributes([], []), $existing, $persisted);
@@ -140,7 +140,7 @@ class BpnAuthenticatorTest extends TestCase
public function testDegradedCrmResponseLeavesAnExistingAccountUntouched(): void
{
$existing = (new User('[email protected]'))
->setRoles([Role::TEAMER, Role::GROUPS_MANAGER])
->setRoles([Role::TEAMER, Role::HOUSE_MANAGER])
->setHotelCodes(['DKS'])
;
@@ -155,7 +155,7 @@ class BpnAuthenticatorTest extends TestCase
$user = $this->loadUser($authenticator);
self::assertSame(['ROLE_USER', Role::TEAMER, Role::GROUPS_MANAGER], $user->getRoles());
self::assertSame(['ROLE_USER', Role::TEAMER, Role::HOUSE_MANAGER], $user->getRoles());
self::assertSame(['DKS'], $user->getHotelCodes());
}
@@ -240,12 +240,40 @@ class BpnAuthenticatorTest extends TestCase
self::assertSame(['ROLE_USER', Role::CUSTOMER], $user->getRoles());
}
public function testEmployeeOnlyClaimFromAnotherDomainIsIgnored(): void
{
$persisted = null;
$authenticator = $this->authenticator($this->crmAttributes([Role::ADMIN, Role::TEAMER], []), null, $persisted);
$user = $this->loadUser($authenticator, '[email protected]');
// Not even a nomination, so there is nothing for an administrator to be told about.
self::assertSame(['ROLE_USER', Role::TEAMER], $user->getRoles());
self::assertSame([], $this->dispatched);
}
public function testEmployeeOnlyRoleIsRevokedWhenTheAddressIsNotStaff(): void
{
$existing = (new User('[email protected]'))->setRoles([Role::TEAMER, Role::ADMIN, Role::HOUSE_MANAGER]);
$persisted = null;
$authenticator = $this->authenticator(
$this->crmAttributes([Role::TEAMER, Role::ADMIN, Role::HOUSE_MANAGER], []),
$existing,
$persisted,
);
$user = $this->loadUser($authenticator, '[email protected]');
// Only the EMPLOYEE_ONLY role goes; a Hausleitung does not need a staff address.
self::assertSame(['ROLE_USER', Role::TEAMER, Role::HOUSE_MANAGER], $user->getRoles());
}
public function testANewNominationIsAnnouncedOnce(): void
{
$persisted = null;
$authenticator = $this->authenticator($this->crmAttributes([Role::ADMIN], []), null, $persisted);
$user = $this->loadUser($authenticator);
$user = $this->loadUser($authenticator, '[email protected]');
self::assertCount(1, $this->dispatched);
$message = $this->dispatched[0];
@@ -257,11 +285,11 @@ class BpnAuthenticatorTest extends TestCase
public function testAStandingNominationIsNotAnnouncedAgain(): void
{
$existing = (new User('[email protected]'))->setRoles([Role::pending(Role::ADMIN)]);
$existing = (new User('[email protected]'))->setRoles([Role::EMPLOYEE, Role::pending(Role::ADMIN)]);
$persisted = null;
$authenticator = $this->authenticator($this->crmAttributes([Role::ADMIN], []), $existing, $persisted);
$this->loadUser($authenticator);
$this->loadUser($authenticator, '[email protected]');
// The nomination has not changed, so there is nothing new to tell an administrator about.
self::assertSame([], $this->dispatched);
@@ -269,11 +297,11 @@ class BpnAuthenticatorTest extends TestCase
public function testAnApprovedRoleIsNotAnnouncedAsANomination(): void
{
$existing = (new User('[email protected]'))->setRoles([Role::ADMIN]);
$existing = (new User('[email protected]'))->setRoles([Role::EMPLOYEE, Role::ADMIN]);
$persisted = null;
$authenticator = $this->authenticator($this->crmAttributes([Role::ADMIN], []), $existing, $persisted);
$this->loadUser($authenticator);
$this->loadUser($authenticator, '[email protected]');
self::assertSame([], $this->dispatched);
}