fix: handle access denied errors properly

tests/EventListener/AccessDeniedListenerTest.php

@@ -0,0 +1,130 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\EventListener;
+
+use App\Entity\User;
+use App\EventListener\AccessDeniedListener;
+use App\Htmx\HxRedirectResponse;
+use App\Security\DefaultRouteResolver;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Session\Session;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
+use Symfony\Component\HttpKernel\Event\ExceptionEvent;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+class AccessDeniedListenerTest extends TestCase
+{
+    public function testAuthenticatedUserIsRedirectedToTheirDefaultRoute(): void
+    {
+        $request = $this->request('/admin/user');
+        $event = $this->dispatch($request, new User('[email protected]'));
+
+        $response = $event->getResponse();
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/admin/dashboard', $response->getTargetUrl());
+        self::assertSame(['Zugriff verweigert'], $this->session($request)->getFlashBag()->get('error'));
+    }
+
+    public function testTargetPathIsClearedToAvoidBeingSentBackToTheDeniedPage(): void
+    {
+        $request = $this->request('/admin/user');
+        $this->session($request)->set('_security.main.target_path', '/admin/user');
+
+        $this->dispatch($request, new User('[email protected]'));
+
+        self::assertFalse($this->session($request)->has('_security.main.target_path'));
+    }
+
+    public function testHtmxRequestsGetAFullPageRedirect(): void
+    {
+        $request = $this->request('/admin/user', ['HTTP_HX-Request' => 'true']);
+        $event = $this->dispatch($request, new User('[email protected]'));
+
+        $response = $event->getResponse();
+        self::assertInstanceOf(HxRedirectResponse::class, $response);
+        self::assertSame('/admin/dashboard', $response->headers->get('HX-Redirect'));
+        // Without this the kernel replaces the 200 of an HxRedirectResponse with a 500
+        self::assertTrue($event->isAllowingCustomResponseCode());
+    }
+
+    public function testDenialOnTheDefaultRouteItselfDoesNotRedirect(): void
+    {
+        $request = $this->request('/admin/dashboard');
+        $event = $this->dispatch($request, new User('[email protected]'));
+
+        self::assertFalse($event->hasResponse());
+    }
+
+    public function testAnonymousUsersFallThroughToTheEntryPoint(): void
+    {
+        $request = $this->request('/admin/user');
+        $event = $this->dispatch($request, null);
+
+        self::assertFalse($event->hasResponse());
+        self::assertSame(['Bitte melde dich an.'], $this->session($request)->getFlashBag()->get('info'));
+    }
+
+    public function testOauth2RoutesAreLeftUntouched(): void
+    {
+        $request = $this->request('/authorize');
+        $request->attributes->set('_route', 'oauth2_authorize');
+
+        $event = $this->dispatch($request, new User('[email protected]'));
+
+        self::assertFalse($event->hasResponse());
+        self::assertSame([], $this->session($request)->getFlashBag()->all());
+    }
+
+    /**
+     * @param array<string, string> $server
+     */
+    private function request(string $uri, array $server = []): Request
+    {
+        $request = Request::create($uri, server: $server);
+        $request->setSession(new Session(new MockArraySessionStorage()));
+
+        return $request;
+    }
+
+    private function session(Request $request): Session
+    {
+        /** @var Session $session */
+        $session = $request->getSession();
+
+        return $session;
+    }
+
+    private function dispatch(Request $request, ?UserInterface $user): ExceptionEvent
+    {
+        $security = $this->createMock(Security::class);
+        $security->method('getUser')->willReturn($user);
+
+        $resolver = $this->createMock(DefaultRouteResolver::class);
+        $resolver->method('resolveUrl')->willReturn('/admin/dashboard');
+
+        $listener = new AccessDeniedListener(
+            $security,
+            $this->createMock(LoggerInterface::class),
+            $resolver,
+        );
+
+        $event = new ExceptionEvent(
+            $this->createMock(HttpKernelInterface::class),
+            $request,
+            HttpKernelInterface::MAIN_REQUEST,
+            new AccessDeniedException(),
+        );
+
+        $listener->onKernelException($event);
+
+        return $event;
+    }
+}

tests/Security/BpnAuthenticatorTest.php

@@ -10,6 +10,7 @@ use App\BusProNet\Model\PersonalData;
 use App\Entity\User;
 use App\Security\BpnAuthenticator;
 use App\Security\Crypt;
+use App\Security\DefaultRouteResolver;
 use App\Security\Role;
 use App\Service\ProfileCompletenessChecker;
 use Doctrine\ORM\EntityManagerInterface;
@@ -143,6 +144,7 @@ class BpnAuthenticatorTest extends TestCase
             $crypt,
             $completenessChecker,
             $this->createMock(LoggerInterface::class),
+            $this->createMock(DefaultRouteResolver::class),
         );
     }
 

tests/Security/DefaultRouteResolverTest.php

@@ -0,0 +1,51 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security;
+
+use App\Security\DefaultRouteResolver;
+use App\Security\Voter\AdministrativeAccessVoter;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
+
+class DefaultRouteResolverTest extends TestCase
+{
+    public function testStaffLandsInTheAdminArea(): void
+    {
+        self::assertSame('app_admin_dashboard', $this->resolver(true)->resolveRoute());
+    }
+
+    public function testEverybodyElseLandsOnTheirAccount(): void
+    {
+        self::assertSame('app_account', $this->resolver(false)->resolveRoute());
+    }
+
+    public function testUrlIsGeneratedForTheResolvedRoute(): void
+    {
+        self::assertSame('/admin/dashboard', $this->resolver(true)->resolveUrl());
+    }
+
+    private function resolver(bool $hasAdministrativeAccess): DefaultRouteResolver
+    {
+        $authorizationChecker = $this->createMock(AuthorizationCheckerInterface::class);
+        $authorizationChecker
+            ->method('isGranted')
+            ->with(AdministrativeAccessVoter::ADMINISTRATIVE_ACCESS)
+            ->willReturn($hasAdministrativeAccess)
+        ;
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $urlGenerator
+            ->method('generate')
+            ->willReturnCallback(static fn (string $route): string => match ($route) {
+                'app_admin_dashboard' => '/admin/dashboard',
+                'app_account' => '/account',
+                default => self::fail(sprintf('Unexpected route "%s"', $route)),
+            })
+        ;
+
+        return new DefaultRouteResolver($authorizationChecker, $urlGenerator);
+    }
+}