feat: additional confirmation cycle and status for groups inquiries

tests/Controller/Admin/AccommodationBooking/ConfirmControllerTest.php

@@ -0,0 +1,160 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller\Admin\AccommodationBooking;
+
+use App\Controller\Admin\AccommodationBooking\ConfirmController;
+use App\Entity\Groups\AccommodationBooking;
+use App\Enum\Groups\AccommodationBookingStatus;
+use App\Service\AccommodationBookingService;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+
+/**
+ * Covers the guards around the confirm action — the confirmation itself is tested in
+ * AccommodationBookingServiceTest.
+ */
+class ConfirmControllerTest extends TestCase
+{
+    public function testGetRendersTheConfirmationModal(): void
+    {
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::never())->method('confirmBooking');
+
+        $controller = new TestableConfirmController($bookingService, $this->createMock(LoggerInterface::class));
+
+        $response = $controller->index($this->receivedBooking(), Request::create('/admin/accommodation-booking/1/confirm'));
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertSame('admin/accommodation_booking/modal_confirm.html.twig', $controller->renderedView);
+    }
+
+    public function testPostConfirmsTheBookingAndRedirectsTheBrowser(): void
+    {
+        $booking = $this->receivedBooking();
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::once())->method('confirmBooking')->with($booking);
+
+        $controller = new TestableConfirmController($bookingService, $this->createMock(LoggerInterface::class));
+
+        $response = $controller->index($booking, Request::create('/admin/accommodation-booking/1/confirm', 'POST'));
+
+        self::assertTrue($response->headers->has('HX-Redirect'));
+    }
+
+    public function testPostWithAnInvalidTokenIsDenied(): void
+    {
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::never())->method('confirmBooking');
+
+        $controller = new TestableConfirmController($bookingService, $this->createMock(LoggerInterface::class), tokenValid: false);
+
+        $this->expectException(AccessDeniedException::class);
+
+        $controller->index($this->receivedBooking(), Request::create('/admin/accommodation-booking/1/confirm', 'POST'));
+    }
+
+    /**
+     * @dataProvider nonReceivedStatuses
+     */
+    public function testABookingThatIsNotAwaitingValidationCannotBeConfirmed(AccommodationBookingStatus $status): void
+    {
+        $booking = $this->receivedBooking();
+        $booking->setStatus($status);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::never())->method('confirmBooking');
+
+        $controller = new TestableConfirmController($bookingService, $this->createMock(LoggerInterface::class));
+
+        $response = $controller->index($booking, Request::create('/admin/accommodation-booking/1/confirm', 'POST'));
+
+        self::assertSame(Response::HTTP_FOUND, $response->getStatusCode());
+    }
+
+    /**
+     * @return iterable<string, array{AccommodationBookingStatus}>
+     */
+    public static function nonReceivedStatuses(): iterable
+    {
+        yield 'draft' => [AccommodationBookingStatus::Draft];
+        yield 'open' => [AccommodationBookingStatus::Open];
+        yield 'confirmed' => [AccommodationBookingStatus::Confirmed];
+        yield 'discarded' => [AccommodationBookingStatus::Discarded];
+    }
+
+    public function testABookingWithoutAnEmailAddressIsNotConfirmed(): void
+    {
+        $booking = $this->receivedBooking();
+        $booking->setEmail(null);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::never())->method('confirmBooking');
+
+        $controller = new TestableConfirmController($bookingService, $this->createMock(LoggerInterface::class));
+
+        $response = $controller->index($booking, Request::create('/admin/accommodation-booking/1/confirm', 'POST'));
+
+        self::assertSame(['error'], array_column($controller->flashes, 'type'));
+        self::assertStringContainsString('app_admin_accommodationbooking_edit', (string) $response->headers->get('HX-Redirect'));
+    }
+
+    private function receivedBooking(): AccommodationBooking
+    {
+        $booking = new AccommodationBooking();
+        $booking->setStatus(AccommodationBookingStatus::Received);
+        $booking->setGroupName('Schulklasse 7b');
+        $booking->setEmail('[email protected]');
+
+        return $booking;
+    }
+}
+
+final class TestableConfirmController extends ConfirmController
+{
+    public ?string $renderedView = null;
+
+    /** @var list<array{type: string, message: mixed}> */
+    public array $flashes = [];
+
+    public function __construct(
+        AccommodationBookingService $bookingService,
+        LoggerInterface $logger,
+        private readonly bool $tokenValid = true,
+    ) {
+        parent::__construct($bookingService, $logger);
+    }
+
+    protected function isCsrfTokenValid(string $id, #[\SensitiveParameter] ?string $token): bool
+    {
+        return $this->tokenValid;
+    }
+
+    /**
+     * @param array<string, mixed> $parameters
+     */
+    protected function render(string $view, array $parameters = [], ?Response $response = null): Response
+    {
+        $this->renderedView = $view;
+
+        return new Response();
+    }
+
+    protected function addFlash(string $type, mixed $message): void
+    {
+        $this->flashes[] = ['type' => $type, 'message' => $message];
+    }
+
+    /**
+     * @param array<string, mixed> $parameters
+     */
+    protected function generateUrl(string $route, array $parameters = [], int $referenceType = 1): string
+    {
+        return '/'.$route.'?'.http_build_query($parameters);
+    }
+}

tests/Controller/Admin/AccommodationBooking/EditControllerTest.php

@@ -32,11 +32,13 @@ class EditControllerTest extends TestCase
         $this->submitStatusChange(AccommodationBookingStatus::Draft, AccommodationBookingStatus::Open, $bookingService);
     }
 
-    public function testTransitionToAcceptedIssuesAccessLinkAndSendsCustomerEmail(): void
+    public function testTransitionToConfirmedSendsNothing(): void
     {
-        $bookingService = $this->assertNotified(AccommodationBookingStatus::Accepted);
+        // The binding confirmation only ever goes out through the explicit confirm action,
+        // never as a side effect of editing the status.
+        $bookingService = $this->assertNotNotified();
 
-        $this->submitStatusChange(AccommodationBookingStatus::Draft, AccommodationBookingStatus::Accepted, $bookingService);
+        $this->submitStatusChange(AccommodationBookingStatus::Received, AccommodationBookingStatus::Confirmed, $bookingService);
     }
 
     public function testTransitionToDiscardedSendsNothing(): void
@@ -50,7 +52,7 @@ class EditControllerTest extends TestCase
     {
         $bookingService = $this->assertNotNotified();
 
-        $this->submitStatusChange(AccommodationBookingStatus::Accepted, AccommodationBookingStatus::Accepted, $bookingService);
+        $this->submitStatusChange(AccommodationBookingStatus::Confirmed, AccommodationBookingStatus::Confirmed, $bookingService);
     }
 
     private function assertNotified(AccommodationBookingStatus $expected): AccommodationBookingService

tests/Controller/Api/AccommodationBookingControllerTest.php

@@ -56,7 +56,7 @@ class AccommodationBookingControllerTest extends TestCase
         $booking->setAccommodationDiscount(10);
         $booking->setBoardServiceDiscount(20);
         $booking->setAdditionalServicesDiscount(30);
-        $booking->setStatus(AccommodationBookingStatus::Accepted);
+        $booking->setStatus(AccommodationBookingStatus::Confirmed);
         $booking->setType(AccommodationBookingType::Booking);
         $booking->setAcceptedAt(new \DateTimeImmutable('2026-07-15T10:00:00+00:00'));
 
@@ -87,7 +87,7 @@ class AccommodationBookingControllerTest extends TestCase
         self::assertSame(Response::HTTP_OK, $response->getStatusCode());
         self::assertSame([
             'uuid' => $booking->getUuid(),
-            'status' => 'accepted',
+            'status' => 'confirmed',
             'type' => 'booking',
             'dateFrom' => '2026-07-20',
             'dateTo' => '2026-07-25',
@@ -97,6 +97,7 @@ class AccommodationBookingControllerTest extends TestCase
             'childrenCount' => 1,
             'groupName' => 'Schulklasse 7b',
             'acceptedAt' => '2026-07-15T10:00:00+00:00',
+            'confirmedAt' => null,
             'personalData' => [
                 'salutation' => 'Frau',
                 'firstName' => 'Mia',
@@ -218,7 +219,7 @@ class AccommodationBookingControllerTest extends TestCase
             ->method('acceptBooking')
             ->with($booking)
             ->willReturnCallback(static function (AccommodationBooking $b): void {
-                $b->setStatus(AccommodationBookingStatus::Accepted);
+                $b->setStatus(AccommodationBookingStatus::Received);
                 $b->setAcceptedAt(new \DateTimeImmutable());
             });
 
@@ -228,9 +229,9 @@ class AccommodationBookingControllerTest extends TestCase
         $payload = json_decode((string) $response->getContent(), true, 512, JSON_THROW_ON_ERROR);
 
         self::assertSame(Response::HTTP_OK, $response->getStatusCode());
-        self::assertSame('accepted', $payload['status']);
+        self::assertSame('received', $payload['status']);
         self::assertSame('inquiry', $payload['type']);
-        self::assertSame(AccommodationBookingStatus::Accepted, $booking->getStatus());
+        self::assertSame(AccommodationBookingStatus::Received, $booking->getStatus());
         self::assertNotNull($booking->getAcceptedAt());
         self::assertSame($booking->getAcceptedAt()->format(\DATE_ATOM), $payload['acceptedAt']);
     }
@@ -246,7 +247,7 @@ class AccommodationBookingControllerTest extends TestCase
         $booking->setFirstName('Tom');
         $booking->setLastName('Beispiel');
         $booking->setEmail('[email protected]');
-        $booking->setStatus(AccommodationBookingStatus::Accepted);
+        $booking->setStatus(AccommodationBookingStatus::Received);
         $booking->setAcceptedAt($acceptedAt);
 
         $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
@@ -267,7 +268,7 @@ class AccommodationBookingControllerTest extends TestCase
         $payload = json_decode((string) $response->getContent(), true, 512, JSON_THROW_ON_ERROR);
 
         self::assertSame(Response::HTTP_OK, $response->getStatusCode());
-        self::assertSame('accepted', $payload['status']);
+        self::assertSame('received', $payload['status']);
         self::assertSame($acceptedAt, $booking->getAcceptedAt());
         self::assertSame($acceptedAt->format(\DATE_ATOM), $payload['acceptedAt']);
     }

tests/Controller/Groups/OfferControllerTest.php

@@ -274,7 +274,7 @@ class OfferControllerTest extends TestCase
 
         self::assertInstanceOf(RedirectResponse::class, $response);
         self::assertSame('/app_groups_booking_offer_view?uuid='.$booking->getUuid(), $response->getTargetUrl());
-        self::assertSame([['type' => 'success', 'message' => 'Deine Buchung ist bestätigt.']], $controller->flashes);
+        self::assertSame([['type' => 'success', 'message' => 'Deine Buchung ist bei uns eingegangen. Sobald sie geprüft ist, erhältst du eine Bestätigung per E-Mail.']], $controller->flashes);
     }
 
     public function testConfirmPostValidViaHtmxReturnsHxRedirect(): void
@@ -350,7 +350,7 @@ class OfferControllerTest extends TestCase
     public function testConfirmRedirectsWhenAlreadyAccepted(): void
     {
         $booking = new AccommodationBooking();
-        $booking->setStatus(AccommodationBookingStatus::Accepted);
+        $booking->setStatus(AccommodationBookingStatus::Received);
 
         $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
         $bookingRepository->method('findOneBy')->willReturn($booking);
@@ -474,7 +474,7 @@ final class TestableOfferController extends OfferController
         $this->renderedParameters = $parameters;
 
         if ('groups/booking/offer.html.twig' === $view) {
-            $content = $parameters['booking']->isAccepted() ? '<html>confirmed</html>' : '<html>offer</html>';
+            $content = null !== $parameters['booking']->getAcceptedAt() ? '<html>confirmed</html>' : '<html>offer</html>';
         } else {
             $content = '<html>unavailable</html>';
         }

tests/Form/Admin/Groups/AccommodationBookingTypeTest.php

@@ -48,7 +48,8 @@ class AccommodationBookingTypeTest extends TestCase
     public static function customerFacingStatuses(): iterable
     {
         yield 'open' => [AccommodationBookingStatus::Open];
-        yield 'accepted' => [AccommodationBookingStatus::Accepted];
+        yield 'received' => [AccommodationBookingStatus::Received];
+        yield 'confirmed' => [AccommodationBookingStatus::Confirmed];
     }
 
     /**

tests/Form/Model/Filter/AccommodationBookingFilterDtoTest.php

@@ -17,7 +17,7 @@ class AccommodationBookingFilterDtoTest extends TestCase
         $filter = AccommodationBookingFilterDto::defaults(true, new User('[email protected]'));
 
         self::assertSame(
-            [AccommodationBookingStatus::Draft, AccommodationBookingStatus::Open],
+            [AccommodationBookingStatus::Draft, AccommodationBookingStatus::Open, AccommodationBookingStatus::Received],
             $filter->status,
             'accepted and discarded bookings need no further work, so they stay out of the way',
         );
@@ -82,7 +82,7 @@ class AccommodationBookingFilterDtoTest extends TestCase
         $filter = new AccommodationBookingFilterDto();
         $filter->q = 'meier';
         $filter->dateFrom = new \DateTimeImmutable('2026-08-01');
-        $filter->status = [AccommodationBookingStatus::Open, AccommodationBookingStatus::Accepted];
+        $filter->status = [AccommodationBookingStatus::Open, AccommodationBookingStatus::Confirmed];
         $filter->type = [AccommodationBookingType::Booking];
 
         self::assertSame(4, $filter->activeCount());

tests/Service/AccommodationBookingServiceTest.php

@@ -169,7 +169,7 @@ class AccommodationBookingServiceTest extends TestCase
     {
         $booking = new AccommodationBooking();
         $booking->setEmail('[email protected]');
-        $booking->setStatus(AccommodationBookingStatus::Accepted);
+        $booking->setStatus(AccommodationBookingStatus::Confirmed);
         $booking->setAccessLinkIssuedAt(new \DateTimeImmutable());
 
         $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
@@ -265,7 +265,7 @@ class AccommodationBookingServiceTest extends TestCase
         self::assertNotSame($previousIssuedAt, $booking->getAccessLinkIssuedAt());
     }
 
-    public function testAcceptBookingAcceptsOpenInquiryAndSendsNotifications(): void
+    public function testAcceptBookingMovesOpenInquiryToReceivedAndNotifiesTheOfficeOnly(): void
     {
         $entityManager = $this->createMock(EntityManagerInterface::class);
         $entityManager->expects(self::once())->method('flush');
@@ -274,22 +274,23 @@ class AccommodationBookingServiceTest extends TestCase
         $booking->setStatus(AccommodationBookingStatus::Open);
         $booking->setEmail('[email protected]');
 
+        // The customer hears nothing until the office has validated the booking.
         $mailer = $this->createMock(Mailer::class);
         $mailer
-            ->expects(self::exactly(2))
+            ->expects(self::once())
             ->method('createAndSendEmail')
             ->with(
                 self::anything(),
-                self::callback(static fn (array $options) => in_array($options['to'], ['[email protected]', '[email protected]'], true)
+                self::callback(static fn (array $options) => '[email protected]' === $options['to']
                     && '[email protected]' === $options['from']
-                    && in_array($options['template'], ['email/offer_accepted.html.twig', 'email/offer_accepted_customer.html.twig'], true)),
+                    && 'email/offer_accepted.html.twig' === $options['template']),
             );
 
         $service = $this->createServiceWithAccommodation(entityManager: $entityManager, mailer: $mailer);
 
         $service->acceptBooking($booking);
 
-        self::assertSame(AccommodationBookingStatus::Accepted, $booking->getStatus());
+        self::assertSame(AccommodationBookingStatus::Received, $booking->getStatus());
         self::assertSame(AccommodationBookingType::Inquiry, $booking->getType(), 'an accepted offer stays an Anfrage');
         self::assertNotNull($booking->getAcceptedAt());
     }
@@ -339,7 +340,7 @@ class AccommodationBookingServiceTest extends TestCase
     public function testAcceptBookingDoesNotStoreRemarksWhenOfferIsNotOpen(): void
     {
         $booking = new AccommodationBooking();
-        $booking->setStatus(AccommodationBookingStatus::Accepted);
+        $booking->setStatus(AccommodationBookingStatus::Received);
         $booking->setRemarks('vom Telefonat');
 
         $service = $this->createServiceWithAccommodation(mailer: $this->createMock(Mailer::class));
@@ -349,32 +350,105 @@ class AccommodationBookingServiceTest extends TestCase
         self::assertSame('vom Telefonat', $booking->getRemarks());
     }
 
-    public function testAcceptBookingSkipsTheCustomerEmailWhenNoAddressIsStored(): void
+    public function testConfirmBookingConfirmsReceivedBookingAndNotifiesTheCustomer(): void
     {
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+
         $booking = new AccommodationBooking();
-        $booking->setStatus(AccommodationBookingStatus::Open);
+        $booking->setStatus(AccommodationBookingStatus::Received);
+        $booking->setEmail('[email protected]');
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('sign')->with($booking)->willReturn('https://example.com/offer/signed-link');
 
-        // Only the office notification goes out — the customer copy has no recipient.
         $mailer = $this->createMock(Mailer::class);
         $mailer
             ->expects(self::once())
             ->method('createAndSendEmail')
             ->with(
-                self::anything(),
-                self::callback(static fn (array $options) => 'office@example.com' === $options['to']),
+                self::callback(static fn (array $context) => 'https://example.com/offer/signed-link' === $context['accessLink']),
+                self::callback(static fn (array $options) => 'customer@example.com' === $options['to']
+                    && 'Deine Buchung ist bestätigt' === $options['subject']
+                    && 'email/booking_confirmed_customer.html.twig' === $options['template']),
             );
 
+        $service = $this->createServiceWithAccommodation(entityManager: $entityManager, mailer: $mailer, linkSigner: $linkSigner);
+
+        $service->confirmBooking($booking);
+
+        self::assertSame(AccommodationBookingStatus::Confirmed, $booking->getStatus());
+        self::assertNotNull($booking->getConfirmedAt());
+        self::assertNotNull($booking->getAccessLinkIssuedAt(), 'the confirmation links to the booking view');
+    }
+
+    public function testConfirmBookingNoOpsForAnythingNotAwaitingValidation(): void
+    {
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager->expects(self::never())->method('flush');
+
+        $mailer = $this->createMock(Mailer::class);
+        $mailer->expects(self::never())->method('createAndSendEmail');
+
+        $service = $this->createServiceWithAccommodation(entityManager: $entityManager, mailer: $mailer);
+
+        foreach ([AccommodationBookingStatus::Draft, AccommodationBookingStatus::Open, AccommodationBookingStatus::Confirmed, AccommodationBookingStatus::Discarded] as $status) {
+            $booking = new AccommodationBooking();
+            $booking->setStatus($status);
+            $booking->setEmail('[email protected]');
+
+            $service->confirmBooking($booking);
+
+            self::assertSame($status, $booking->getStatus());
+            self::assertNull($booking->getConfirmedAt());
+        }
+    }
+
+    public function testBookingEmailsCarryThePriceBreakdown(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setEmail('[email protected]');
+        $booking->setStatus(AccommodationBookingStatus::Open);
+
+        $breakdown = ['total' => 10000, 'currency' => 'EUR'];
+        $booking->setPriceSnapshot($breakdown, 9000, 'CHF', 1);
+        $breakdownCalculator = $this->createMock(AccommodationBookingBreakdownCalculator::class);
+        $breakdownCalculator->method('compute')->with($booking)->willReturn($breakdown);
+
+        $mailer = $this->createMock(Mailer::class);
+        $mailer
+            ->expects(self::once())
+            ->method('createAndSendEmail')
+            ->with(
+                // The stored pricing currency wins over the one frozen in the breakdown.
+                self::callback(static fn (array $context) => $breakdown === $context['priceBreakdown']
+                    && 'CHF' === $context['currency']),
+                self::anything(),
+            );
+
+        $service = $this->createServiceWithAccommodation(mailer: $mailer, breakdownCalculator: $breakdownCalculator);
+
+        $service->sendCustomerConfirmationEmail($booking);
+    }
+
+    public function testConfirmBookingSkipsTheCustomerEmailWhenNoAddressIsStored(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setStatus(AccommodationBookingStatus::Received);
+
+        $mailer = $this->createMock(Mailer::class);
+        $mailer->expects(self::never())->method('createAndSendEmail');
+
         $logger = $this->createMock(LoggerInterface::class);
         $logger
             ->expects(self::once())
             ->method('warning')
-            ->with('Failed to send offer accepted customer email', self::anything());
+            ->with('Failed to send booking confirmed customer email', self::anything());
 
         $service = $this->createServiceWithAccommodation(mailer: $mailer, logger: $logger);
 
-        $service->acceptBooking($booking);
+        $service->confirmBooking($booking);
 
-        self::assertSame(AccommodationBookingStatus::Accepted, $booking->getStatus(), 'the acceptance itself must not fail');
+        self::assertSame(AccommodationBookingStatus::Confirmed, $booking->getStatus(), 'the confirmation itself must not fail');
     }
 
     public function testAcceptBookingIsIdempotentAndSendsNoNotifications(): void
@@ -388,7 +462,7 @@ class AccommodationBookingServiceTest extends TestCase
         $service = $this->createServiceWithAccommodation(entityManager: $entityManager, mailer: $mailer);
 
         $booking = new AccommodationBooking();
-        $booking->setStatus(AccommodationBookingStatus::Accepted);
+        $booking->setStatus(AccommodationBookingStatus::Received);
 
         $service->acceptBooking($booking);
 
@@ -418,7 +492,7 @@ class AccommodationBookingServiceTest extends TestCase
     public function testSendOfferAcceptedNotificationEmailLogsAndSwallowsMailerFailures(): void
     {
         $booking = new AccommodationBooking();
-        $booking->setStatus(AccommodationBookingStatus::Accepted);
+        $booking->setStatus(AccommodationBookingStatus::Received);
 
         $mailer = $this->createMock(Mailer::class);
         $mailer->method('createAndSendEmail')->willThrowException(new \RuntimeException('SMTP down'));
@@ -431,11 +505,11 @@ class AccommodationBookingServiceTest extends TestCase
         $service->sendOfferAcceptedNotificationEmail($booking);
     }
 
-    public function testSendOfferAcceptedCustomerEmailLogsAndSwallowsMailerFailures(): void
+    public function testSendBookingConfirmedCustomerEmailLogsAndSwallowsMailerFailures(): void
     {
         $booking = new AccommodationBooking();
         $booking->setEmail('[email protected]');
-        $booking->setStatus(AccommodationBookingStatus::Accepted);
+        $booking->setStatus(AccommodationBookingStatus::Confirmed);
 
         $mailer = $this->createMock(Mailer::class);
         $mailer->method('createAndSendEmail')->willThrowException(new \RuntimeException('SMTP down'));
@@ -445,7 +519,7 @@ class AccommodationBookingServiceTest extends TestCase
 
         $service = $this->createServiceWithAccommodation(mailer: $mailer, logger: $logger);
 
-        $service->sendOfferAcceptedCustomerEmail($booking);
+        $service->sendBookingConfirmedCustomerEmail($booking);
     }
 
     public function testRefreshPriceSnapshotStoresDiscountedFinalTotal(): void