fix: handle access denied errors properly

tests/Security/BpnAuthenticatorTest.php

@@ -10,6 +10,7 @@ use App\BusProNet\Model\PersonalData;
 use App\Entity\User;
 use App\Security\BpnAuthenticator;
 use App\Security\Crypt;
+use App\Security\DefaultRouteResolver;
 use App\Security\Role;
 use App\Service\ProfileCompletenessChecker;
 use Doctrine\ORM\EntityManagerInterface;
@@ -143,6 +144,7 @@ class BpnAuthenticatorTest extends TestCase
             $crypt,
             $completenessChecker,
             $this->createMock(LoggerInterface::class),
+            $this->createMock(DefaultRouteResolver::class),
         );
     }
 

tests/Security/DefaultRouteResolverTest.php

@@ -0,0 +1,51 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security;
+
+use App\Security\DefaultRouteResolver;
+use App\Security\Voter\AdministrativeAccessVoter;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
+
+class DefaultRouteResolverTest extends TestCase
+{
+    public function testStaffLandsInTheAdminArea(): void
+    {
+        self::assertSame('app_admin_dashboard', $this->resolver(true)->resolveRoute());
+    }
+
+    public function testEverybodyElseLandsOnTheirAccount(): void
+    {
+        self::assertSame('app_account', $this->resolver(false)->resolveRoute());
+    }
+
+    public function testUrlIsGeneratedForTheResolvedRoute(): void
+    {
+        self::assertSame('/admin/dashboard', $this->resolver(true)->resolveUrl());
+    }
+
+    private function resolver(bool $hasAdministrativeAccess): DefaultRouteResolver
+    {
+        $authorizationChecker = $this->createMock(AuthorizationCheckerInterface::class);
+        $authorizationChecker
+            ->method('isGranted')
+            ->with(AdministrativeAccessVoter::ADMINISTRATIVE_ACCESS)
+            ->willReturn($hasAdministrativeAccess)
+        ;
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $urlGenerator
+            ->method('generate')
+            ->willReturnCallback(static fn (string $route): string => match ($route) {
+                'app_admin_dashboard' => '/admin/dashboard',
+                'app_account' => '/account',
+                default => self::fail(sprintf('Unexpected route "%s"', $route)),
+            })
+        ;
+
+        return new DefaultRouteResolver($authorizationChecker, $urlGenerator);
+    }
+}