feat: admin-managed roles and hotel codes

src/Security/Role.php

@@ -0,0 +1,84 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Security;
+
+/**
+ * The roles this application knows about.
+ *
+ * Roles are stored as plain strings in the User::$roles JSON column and consumed as strings
+ * by #[IsGranted], the voters and security.yaml's role_hierarchy, so they are constants
+ * rather than an enum.
+ */
+final class Role
+{
+    public const ADMIN = 'ROLE_ADMIN';
+    public const MANAGER = 'ROLE_MANAGER';
+    public const TEAMER = 'ROLE_TEAMER';
+    public const CUSTOMER = 'ROLE_CUSTOMER';
+    public const HOUSE_MANAGER = 'ROLE_HOUSE_MANAGER';
+    public const GROUPS_ADMIN = 'ROLE_GROUPS_ADMIN';
+    public const GROUPS_MANAGER = 'ROLE_GROUPS_MANAGER';
+
+    /**
+     * The roles that are actually assigned to accounts. ROLE_USER is left out because every
+     * account has it implicitly (see User::getRoles()) and it is never stored.
+     *
+     * @var string[]
+     */
+    public const ALL = [
+        self::ADMIN,
+        self::MANAGER,
+        self::TEAMER,
+        self::CUSTOMER,
+        self::HOUSE_MANAGER,
+        self::GROUPS_ADMIN,
+        self::GROUPS_MANAGER,
+    ];
+
+    /**
+     * Roles that are never taken over from BusProNet. Many people can edit CRM selections in
+     * the BusPro backend, so these are granted by an administrator in /admin/user only.
+     *
+     * @var string[]
+     */
+    public const PRIVILEGED = [
+        self::ADMIN,
+        self::GROUPS_ADMIN,
+        self::GROUPS_MANAGER,
+    ];
+
+    /**
+     * Reduces the roles derived from BPN CRM attributes to the ones we accept from there.
+     *
+     * Falls back to ROLE_CUSTOMER the way CrmAttributesResponseParser does, so an account
+     * whose only selection was a privileged one does not end up without any role.
+     *
+     * @param string[] $roles
+     *
+     * @return string[]
+     */
+    public static function filterImportable(array $roles): array
+    {
+        $importable = array_values(array_unique(array_diff($roles, self::PRIVILEGED)));
+
+        return [] === $importable ? [self::CUSTOMER] : $importable;
+    }
+
+    /**
+     * @return array<string, string> role => label
+     */
+    public static function labels(): array
+    {
+        return [
+            self::ADMIN => 'Administration',
+            self::MANAGER => 'Manager:in',
+            self::TEAMER => 'Teamer:in',
+            self::CUSTOMER => 'Kund:in',
+            self::HOUSE_MANAGER => 'Hausleitung',
+            self::GROUPS_ADMIN => 'Preisrechner Admin',
+            self::GROUPS_MANAGER => 'Preisrechner',
+        ];
+    }
+}