feat: add employee-only supervisor role nominated by crm selection 1487

tests/BusProNet/XmlParser/CrmAttributesResponseParserTest.php

@@ -67,6 +67,24 @@ class CrmAttributesResponseParserTest extends TestCase
         self::assertNotContains('ROLE_TEAM_ADMIN', $roles);
     }
 
+    /**
+     * ROLE_SUPERVISOR is not consumed here either — it is exported through /api/userinfo for
+     * ephub.
+     */
+    public function testParseAssignsSupervisorRoleWhenSelected(): void
+    {
+        $roles = $this->parseRoles($this->selectionXml(1487, true));
+
+        self::assertContains('ROLE_SUPERVISOR', $roles);
+    }
+
+    public function testParseAssignsNoSupervisorRoleWhenNotSelected(): void
+    {
+        $roles = $this->parseRoles($this->selectionXml(1487, false));
+
+        self::assertNotContains('ROLE_SUPERVISOR', $roles);
+    }
+
     public function testParseAssignsNoCustomerExpertRoleWhenNotSelected(): void
     {
         $roles = $this->parseRoles($this->selectionXml(1483, false));

tests/Controller/Api/UserinfoControllerTest.php

@@ -102,6 +102,20 @@ class UserinfoControllerTest extends TestCase
         self::assertSame([Role::EMPLOYEE, Role::TEAM_ADMIN], $claims['roles']);
     }
 
+    /**
+     * Same for ephub, which reads ROLE_SUPERVISOR out of this claim.
+     */
+    public function testSupervisorIsExportedOnceApproved(): void
+    {
+        $claims = $this->claims(['ROLE_OAUTH2_ROLES'], [
+            Role::USER,
+            Role::EMPLOYEE,
+            Role::SUPERVISOR,
+        ]);
+
+        self::assertSame([Role::EMPLOYEE, Role::SUPERVISOR], $claims['roles']);
+    }
+
     public function testUpstreamFailureIsReportedRatherThanAnswered(): void
     {
         $accountClient = $this->createStub(AccountClient::class);

tests/Security/RoleTest.php

@@ -44,6 +44,15 @@ class RoleTest extends TestCase
         self::assertSame([Role::EMPLOYEE, Role::CUSTOMER_EXPERT], $roles);
     }
 
+    public function testSupervisorClaimOnlyProducesANomination(): void
+    {
+        $roles = Role::sync([], [Role::EMPLOYEE, Role::SUPERVISOR]);
+
+        self::assertSame([Role::EMPLOYEE, Role::pending(Role::SUPERVISOR)], $roles);
+        self::assertSame([Role::SUPERVISOR => 'Leitung'], Role::nominatedFrom($roles));
+        self::assertSame([Role::EMPLOYEE, Role::SUPERVISOR], Role::approve($roles, Role::SUPERVISOR));
+    }
+
     public function testApprovedRoleSurvivesTheNextSyncAndIsNotMarkedAgain(): void
     {
         $roles = Role::sync([Role::TEAMER, Role::HOUSE_MANAGER], [Role::HOUSE_MANAGER, Role::TEAMER]);