feat: admin-managed roles and hotel codes

tests/Security/RoleTest.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security;
+
+use App\Security\Role;
+use PHPUnit\Framework\TestCase;
+
+class RoleTest extends TestCase
+{
+    public function testPrivilegedRolesAreNeverImported(): void
+    {
+        $roles = Role::filterImportable([
+            Role::TEAMER,
+            Role::ADMIN,
+            Role::GROUPS_ADMIN,
+            Role::GROUPS_MANAGER,
+            Role::HOUSE_MANAGER,
+        ]);
+
+        self::assertSame([Role::TEAMER, Role::HOUSE_MANAGER], $roles);
+    }
+
+    public function testResultIsADedupedList(): void
+    {
+        // CrmAttributesResponseParser applies array_unique(), which preserves keys — a
+        // non-list would be persisted as a JSON object instead of an array.
+        $roles = Role::filterImportable([0 => Role::ADMIN, 2 => Role::TEAMER, 5 => Role::TEAMER]);
+
+        self::assertSame([Role::TEAMER], $roles);
+        self::assertSame(array_keys($roles), range(0, \count($roles) - 1));
+    }
+
+    public function testAccountWithOnlyPrivilegedRolesFallsBackToCustomer(): void
+    {
+        self::assertSame([Role::CUSTOMER], Role::filterImportable([Role::ADMIN]));
+        self::assertSame([Role::CUSTOMER], Role::filterImportable([]));
+    }
+
+    public function testEveryRoleHasALabel(): void
+    {
+        self::assertSame(Role::ALL, array_keys(Role::labels()));
+    }
+}