feat: reserve administrative roles for staff email addresses

tests/Security/RoleTest.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace App\Tests\Security;
 
 use App\Security\Role;
+use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\TestCase;
 
 /**
@@ -15,46 +16,46 @@ class RoleTest extends TestCase
 {
     public function testAdministrativeClaimOnlyProducesANomination(): void
     {
-        $roles = Role::sync([], [Role::ADMIN, Role::GROUPS_ADMIN, Role::TEAMER]);
+        $roles = Role::sync([], [Role::HOUSE_MANAGER, Role::GROUPS_ADMIN, Role::TEAMER, Role::EMPLOYEE]);
 
         self::assertSame(
-            [Role::TEAMER, Role::pending(Role::ADMIN), Role::pending(Role::GROUPS_ADMIN)],
+            [Role::TEAMER, Role::EMPLOYEE, Role::pending(Role::HOUSE_MANAGER), Role::pending(Role::GROUPS_ADMIN)],
             $roles,
         );
-        self::assertSame([Role::TEAMER], Role::effectiveOnly($roles));
+        self::assertSame([Role::TEAMER, Role::EMPLOYEE], Role::effectiveOnly($roles));
     }
 
     public function testCustomerExpertClaimOnlyProducesANomination(): void
     {
-        $roles = Role::sync([], [Role::CUSTOMER_EXPERT]);
+        $roles = Role::sync([], [Role::EMPLOYEE, Role::CUSTOMER_EXPERT]);
 
-        self::assertSame([Role::pending(Role::CUSTOMER_EXPERT), Role::CUSTOMER], $roles);
-        self::assertSame([Role::CUSTOMER], Role::effectiveOnly($roles));
+        self::assertSame([Role::EMPLOYEE, Role::pending(Role::CUSTOMER_EXPERT)], $roles);
+        self::assertSame([Role::EMPLOYEE], Role::effectiveOnly($roles));
         self::assertSame(
-            [Role::CUSTOMER_EXPERT => 'KO-Experte'],
+            [Role::CUSTOMER_EXPERT => 'KO-Expert:in'],
             Role::nominatedFrom($roles),
         );
     }
 
-    public function testApprovedCustomerExpertDisplacesTheCustomerFallback(): void
+    public function testCustomerExpertCanBeApprovedForStaff(): void
     {
-        $roles = Role::approve([Role::pending(Role::CUSTOMER_EXPERT), Role::CUSTOMER], Role::CUSTOMER_EXPERT);
+        $roles = Role::approve([Role::EMPLOYEE, Role::pending(Role::CUSTOMER_EXPERT)], Role::CUSTOMER_EXPERT);
 
-        self::assertSame([Role::CUSTOMER_EXPERT], $roles);
+        self::assertSame([Role::EMPLOYEE, Role::CUSTOMER_EXPERT], $roles);
     }
 
     public function testApprovedRoleSurvivesTheNextSyncAndIsNotMarkedAgain(): void
     {
-        $roles = Role::sync([Role::TEAMER, Role::GROUPS_ADMIN], [Role::GROUPS_ADMIN, Role::TEAMER]);
+        $roles = Role::sync([Role::TEAMER, Role::HOUSE_MANAGER], [Role::HOUSE_MANAGER, Role::TEAMER]);
 
-        self::assertSame([Role::TEAMER, Role::GROUPS_ADMIN], $roles);
+        self::assertSame([Role::TEAMER, Role::HOUSE_MANAGER], $roles);
     }
 
     public function testRoleTheCrmNoLongerClaimsIsRevoked(): void
     {
         // Both halves go: BusPro is the source of truth for the granted role as much as for
         // the nomination.
-        $roles = Role::sync([Role::TEAMER, Role::ADMIN, Role::pending(Role::MANAGER)], [Role::TEAMER]);
+        $roles = Role::sync([Role::TEAMER, Role::GROUPS_ADMIN, Role::pending(Role::HOUSE_MANAGER)], [Role::TEAMER]);
 
         self::assertSame([Role::TEAMER], $roles);
     }
@@ -69,8 +70,8 @@ class RoleTest extends TestCase
         // The nomination stays visible — it is what an approver acts on — but grants nothing,
         // so the account is a customer in the meantime.
         self::assertSame(
-            [Role::pending(Role::ADMIN), Role::CUSTOMER],
-            Role::sync([], [Role::ADMIN]),
+            [Role::pending(Role::HOUSE_MANAGER), Role::CUSTOMER],
+            Role::sync([], [Role::HOUSE_MANAGER]),
         );
         self::assertSame([Role::CUSTOMER], Role::sync([], []));
     }
@@ -90,10 +91,10 @@ class RoleTest extends TestCase
 
     public function testApprovalTurnsTheNominationIntoTheRole(): void
     {
-        $roles = Role::approve([Role::pending(Role::ADMIN), Role::CUSTOMER], Role::ADMIN);
+        $roles = Role::approve([Role::pending(Role::HOUSE_MANAGER), Role::CUSTOMER], Role::HOUSE_MANAGER);
 
         // The customer fallback goes with it: the account now holds an effective role.
-        self::assertSame([Role::ADMIN], $roles);
+        self::assertSame([Role::HOUSE_MANAGER], $roles);
     }
 
     public function testApprovingARoleWithoutANominationIsRefused(): void
@@ -105,11 +106,11 @@ class RoleTest extends TestCase
 
     public function testEffectiveRolesExcludeNominationsAndTheImplicitRoleUser(): void
     {
-        $roles = [Role::USER, Role::TEAMER, Role::pending(Role::ADMIN)];
+        $roles = [Role::USER, Role::TEAMER, Role::pending(Role::HOUSE_MANAGER)];
 
         self::assertSame([Role::TEAMER], Role::effectiveOnly($roles));
-        self::assertSame([Role::pending(Role::ADMIN)], Role::pendingOnly($roles));
-        self::assertSame([Role::ADMIN => 'Administration'], Role::nominatedFrom($roles));
+        self::assertSame([Role::pending(Role::HOUSE_MANAGER)], Role::pendingOnly($roles));
+        self::assertSame([Role::HOUSE_MANAGER => 'Hausleitung'], Role::nominatedFrom($roles));
     }
 
     public function testEmployeeIsGrantedOutrightAndDisplacesTheCustomerFallback(): void
@@ -133,6 +134,61 @@ class RoleTest extends TestCase
         );
     }
 
+    /**
+     * @return iterable<string, array{string}>
+     */
+    public static function employeeOnlyRoles(): iterable
+    {
+        foreach (Role::EMPLOYEE_ONLY as $role) {
+            yield $role => [$role];
+        }
+    }
+
+    #[DataProvider('employeeOnlyRoles')]
+    public function testEmployeeOnlyClaimWithoutEmployeeIsNotNominated(string $role): void
+    {
+        self::assertSame([Role::TEAMER], Role::sync([], [Role::TEAMER, $role]));
+    }
+
+    #[DataProvider('employeeOnlyRoles')]
+    public function testEmployeeOnlyRoleIsRevokedWithoutEmployee(string $role): void
+    {
+        // The CRM still claims it, but the account is no longer staff: the claim counts as not
+        // made, and a role approved back when it was staff goes with it.
+        self::assertSame(
+            [Role::TEAMER],
+            Role::sync([Role::TEAMER, Role::EMPLOYEE, $role], [Role::TEAMER, $role]),
+        );
+    }
+
+    #[DataProvider('employeeOnlyRoles')]
+    public function testEmployeeOnlyRoleSurvivesTheNextSyncForStaff(string $role): void
+    {
+        self::assertSame(
+            [Role::EMPLOYEE, $role],
+            Role::sync([Role::EMPLOYEE, $role], [Role::EMPLOYEE, $role]),
+        );
+    }
+
+    public function testHouseManagerDoesNotNeedEmployee(): void
+    {
+        // A Hausleitung signs in with the hotel's own address.
+        self::assertSame([Role::pending(Role::HOUSE_MANAGER), Role::CUSTOMER], Role::sync([], [Role::HOUSE_MANAGER]));
+        self::assertSame([Role::HOUSE_MANAGER], Role::sync([Role::HOUSE_MANAGER], [Role::HOUSE_MANAGER]));
+    }
+
+    public function testStaleEmployeeOnlyNominationWithoutEmployeeCannotBeApproved(): void
+    {
+        // A marker from before the rule, still stored until the account's next login.
+        $roles = [Role::TEAMER, Role::pending(Role::ADMIN)];
+
+        self::assertSame([], Role::nominatedFrom($roles));
+
+        $this->expectException(\InvalidArgumentException::class);
+
+        Role::approve($roles, Role::ADMIN);
+    }
+
     public function testEmployeeAndTeamerCoexist(): void
     {
         self::assertSame(