wip: guest account registration (self-service and booking create flow)

2026-06-23 16:27:09 +02:00
1 parent e4430ac5c5
commit d74888f64b
@@ -0,0 +1,151 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller\Account;
+
+use App\Service\BookingGuestAccountManager;
+use App\Service\PublicFormRateLimiter;
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+use Symfony\Component\HttpFoundation\Request;
+
+class PortalAccessRequestControllerTest extends WebTestCase
+{
+    public function testPortalAccessRequestRedirectsToLoginAfterSendingActivationMail(): void
+    {
+        $client = self::createClient([], ['HTTPS' => 'on']);
+        $client->disableReboot();
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter
+            ->expects(self::once())
+            ->method('isPortalAccessAllowed')
+            ->with('[email protected]', self::isInstanceOf(Request::class))
+            ->willReturn(true);
+
+        $guestAccountManager = $this->createMock(BookingGuestAccountManager::class);
+        $guestAccountManager
+            ->expects(self::once())
+            ->method('requestPortalAccess')
+            ->with('[email protected]', 123)
+            ->willReturn(BookingGuestAccountManager::PORTAL_ACCESS_SENT);
+
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(BookingGuestAccountManager::class, $guestAccountManager);
+
+        $crawler = $client->request('GET', '/');
+        $token = $crawler->filter('input[name="_token"]')->attr('value');
+        $client->request('POST', '/portal-access/request', [
+            'email' => '[email protected]',
+            'bookingNumber' => '123',
+            '_token' => $token,
+        ]);
+
+        self::assertResponseRedirects('/');
+        $client->followRedirect();
+
+        self::assertStringContainsString('Wenn zu deiner Buchung ein Portalzugang möglich ist, haben wir dir eine E-Mail gesendet.', $client->getResponse()->getContent());
+    }
+
+    public function testPortalAccessRequestRejectsMismatchedBookingGenerically(): void
+    {
+        $client = self::createClient([], ['HTTPS' => 'on']);
+        $client->disableReboot();
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter
+            ->expects(self::once())
+            ->method('isPortalAccessAllowed')
+            ->with('[email protected]', self::isInstanceOf(Request::class))
+            ->willReturn(true);
+
+        $guestAccountManager = $this->createMock(BookingGuestAccountManager::class);
+        $guestAccountManager
+            ->expects(self::once())
+            ->method('requestPortalAccess')
+            ->with('[email protected]', 123)
+            ->willReturn(BookingGuestAccountManager::PORTAL_ACCESS_NOT_SENT);
+
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(BookingGuestAccountManager::class, $guestAccountManager);
+
+        $crawler = $client->request('GET', '/');
+        $token = $crawler->filter('input[name="_token"]')->attr('value');
+        $client->request('POST', '/portal-access/request', [
+            'email' => '[email protected]',
+            'bookingNumber' => '123',
+            '_token' => $token,
+        ]);
+
+        self::assertResponseRedirects('/');
+        $client->followRedirect();
+
+        self::assertStringContainsString('Wenn zu deiner Buchung ein Portalzugang möglich ist, haben wir dir eine E-Mail gesendet.', $client->getResponse()->getContent());
+    }
+
+    public function testPortalAccessRequestShowsLoginHintForAlreadyActiveAccount(): void
+    {
+        $client = self::createClient([], ['HTTPS' => 'on']);
+        $client->disableReboot();
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter
+            ->expects(self::once())
+            ->method('isPortalAccessAllowed')
+            ->with('[email protected]', self::isInstanceOf(Request::class))
+            ->willReturn(true);
+
+        $guestAccountManager = $this->createMock(BookingGuestAccountManager::class);
+        $guestAccountManager
+            ->expects(self::once())
+            ->method('requestPortalAccess')
+            ->with('[email protected]', 123)
+            ->willReturn(BookingGuestAccountManager::PORTAL_ACCESS_ALREADY_ACTIVE);
+
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(BookingGuestAccountManager::class, $guestAccountManager);
+
+        $crawler = $client->request('GET', '/');
+        $token = $crawler->filter('input[name="_token"]')->attr('value');
+        $client->request('POST', '/portal-access/request', [
+            'email' => '[email protected]',
+            'bookingNumber' => '123',
+            '_token' => $token,
+        ]);
+
+        self::assertResponseRedirects('/');
+        $client->followRedirect();
+
+        self::assertStringContainsString('Für diese E-Mail-Adresse besteht bereits ein aktiver Portalzugang.', $client->getResponse()->getContent());
+    }
+
+    public function testPortalAccessRequestReturns429WhenThrottled(): void
+    {
+        $client = self::createClient([], ['HTTPS' => 'on']);
+        $client->disableReboot();
+
+        $rateLimiter = $this->createMock(PublicFormRateLimiter::class);
+        $rateLimiter
+            ->expects(self::once())
+            ->method('isPortalAccessAllowed')
+            ->with('[email protected]', self::isInstanceOf(Request::class))
+            ->willReturn(false);
+
+        $guestAccountManager = $this->createMock(BookingGuestAccountManager::class);
+        $guestAccountManager->expects(self::never())->method('requestPortalAccess');
+
+        self::getContainer()->set(PublicFormRateLimiter::class, $rateLimiter);
+        self::getContainer()->set(BookingGuestAccountManager::class, $guestAccountManager);
+
+        $crawler = $client->request('GET', '/');
+        $token = $crawler->filter('input[name="_token"]')->attr('value');
+        $client->request('POST', '/portal-access/request', [
+            'email' => '[email protected]',
+            'bookingNumber' => '123',
+            '_token' => $token,
+        ]);
+
+        self::assertResponseStatusCodeSame(429);
+        self::assertStringContainsString(PublicFormRateLimiter::THROTTLED_MESSAGE, $client->getResponse()->getContent());
+    }
+}