feat: MailJet list handling with DOI, webhook receiver and API endpoint

addresses #869cut134

tests/Command/BpnXmlSyncCommandTest.php

@@ -238,7 +238,7 @@ class BpnXmlSyncCommandTest extends TestCase
 
         $this->assertSame(Command::SUCCESS, $tester->getStatusCode());
         $this->assertStringContainsString('[contingents] Sync failed', $tester->getDisplay());
-        $this->assertStringContainsString('datasets: contingents', $tester->getDisplay());
+        $this->assertMatchesRegularExpression('/failed datasets:\s+contingents/', $tester->getDisplay());
     }
 
     public function testTravelTransferFailureDoesNotPreventContingentsSync(): void

tests/Controller/Account/PersonalDataControllerTest.php

@@ -0,0 +1,261 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller\Account;
+
+use App\BusProNet\ApiClient;
+use App\BusProNet\Model\PersonalData;
+use App\Controller\Account\PersonalDataController;
+use App\Entity\User;
+use App\Model\NewsletterSubscriptionRequestResult;
+use App\Security\Crypt;
+use App\Service\BookingEditDataLoader;
+use App\Service\NewsletterManager;
+use App\Service\ProfileCompletenessChecker;
+use Doctrine\ORM\EntityManagerInterface;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Form\FormInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+class PersonalDataControllerTest extends TestCase
+{
+    public function testIndexRendersNewsletterSubscribeCtaWhenNotSubscribed(): void
+    {
+        $controller = $this->createController();
+        $controller->apiClient
+            ->expects(self::once())
+            ->method('getPersonalData')
+            ->with('[email protected]', 'secret')
+            ->willReturn($this->createPersonalData('Mia', 'Muster'));
+
+        $controller->newsletterManager
+            ->expects(self::once())
+            ->method('hasConfirmedOptIn')
+            ->with('[email protected]')
+            ->willReturn(false);
+        $controller->newsletterManager
+            ->expects(self::once())
+            ->method('hasPendingConfirmation')
+            ->with('[email protected]')
+            ->willReturn(false);
+
+        $response = $controller->index(Request::create('/personal-data', 'GET'));
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame('account/personal_data.html.twig', $controller->renderedView);
+        self::assertSame(false, $controller->renderedParameters['newsletterSubscribed']);
+        self::assertSame(false, $controller->renderedParameters['newsletterPendingConfirmation']);
+    }
+
+    public function testIndexStillTracksPendingNewsletterConfirmationWhenSubscribed(): void
+    {
+        $controller = $this->createController();
+        $controller->apiClient
+            ->expects(self::once())
+            ->method('getPersonalData')
+            ->with('[email protected]', 'secret')
+            ->willReturn($this->createPersonalData('Mia', 'Muster'));
+
+        $controller->newsletterManager
+            ->expects(self::once())
+            ->method('hasConfirmedOptIn')
+            ->with('[email protected]')
+            ->willReturn(true);
+        $controller->newsletterManager
+            ->expects(self::once())
+            ->method('hasPendingConfirmation')
+            ->with('[email protected]')
+            ->willReturn(false);
+
+        $response = $controller->index(Request::create('/personal-data', 'GET'));
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame(true, $controller->renderedParameters['newsletterSubscribed']);
+        self::assertSame(false, $controller->renderedParameters['newsletterPendingConfirmation']);
+    }
+
+    public function testNewsletterActionReturnsHtmxRedirectAndFlash(): void
+    {
+        $controller = $this->createController();
+        $controller->apiClient
+            ->expects(self::once())
+            ->method('getPersonalData')
+            ->with('[email protected]', 'secret')
+            ->willReturn($this->createPersonalData('Mia', 'Muster'));
+
+        $controller->newsletterManager
+            ->expects(self::once())
+            ->method('hasPendingConfirmation')
+            ->with('[email protected]')
+            ->willReturn(false);
+        $controller->newsletterManager
+            ->expects(self::once())
+            ->method('requestDefaultListSubscription')
+            ->with('[email protected]', 'Mia', 'Muster')
+            ->willReturn(new NewsletterSubscriptionRequestResult(
+                '[email protected]',
+                [10321569],
+                NewsletterSubscriptionRequestResult::STATE_CONFIRMATION_REQUESTED,
+                true,
+                [
+                    10321569 => NewsletterSubscriptionRequestResult::LIST_STATE_PENDING,
+                ],
+            ));
+
+        $response = $controller->newsletter(Request::create('/personal-data/newsletter', 'POST', [], [], [], [
+            'HTTP_HX_REQUEST' => 'true',
+        ]));
+
+        self::assertInstanceOf(Response::class, $response);
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame('/personal-data', $response->headers->get('HX-Redirect'));
+        self::assertSame([
+            ['success', 'Bitte bestätige deine Newsletter-Anmeldung über den Link in der E-Mail.'],
+        ], $controller->flashes);
+    }
+
+    public function testNewsletterActionResendsPendingConfirmation(): void
+    {
+        $controller = $this->createController();
+        $controller->apiClient
+            ->expects(self::once())
+            ->method('getPersonalData')
+            ->with('[email protected]', 'secret')
+            ->willReturn($this->createPersonalData('Mia', 'Muster'));
+
+        $controller->newsletterManager
+            ->expects(self::once())
+            ->method('hasPendingConfirmation')
+            ->with('[email protected]')
+            ->willReturn(true);
+        $controller->newsletterManager
+            ->expects(self::once())
+            ->method('requestConfirmation')
+            ->with('[email protected]', 'Mia', 'Muster');
+        $controller->newsletterManager->expects(self::never())->method('requestDefaultListSubscription');
+
+        $response = $controller->newsletter(Request::create('/personal-data/newsletter', 'POST', [], [], [], [
+            'HTTP_HX_REQUEST' => 'true',
+        ]));
+
+        self::assertInstanceOf(Response::class, $response);
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame([
+            ['success', 'Wir haben dir eine neue Bestätigungs-E-Mail gesendet.'],
+        ], $controller->flashes);
+    }
+
+    private function createController(): TestablePersonalDataController
+    {
+        $user = new User('[email protected]');
+        $user->setPassword('secret');
+
+        $apiClient = $this->createMock(ApiClient::class);
+
+        $crypt = $this->createMock(Crypt::class);
+        $crypt
+            ->method('decrypt')
+            ->with('secret')
+            ->willReturn('secret');
+
+        $form = $this->createMock(FormInterface::class);
+        $form
+            ->method('handleRequest')
+            ->willReturnSelf();
+        $form
+            ->method('isSubmitted')
+            ->willReturn(false);
+
+        return new TestablePersonalDataController(
+            $apiClient,
+            $crypt,
+            $this->createMock(BookingEditDataLoader::class),
+            $this->createMock(ProfileCompletenessChecker::class),
+            $this->createMock(EntityManagerInterface::class),
+            $this->createMock(NewsletterManager::class),
+            $this->createMock(LoggerInterface::class),
+            $user,
+            $form,
+        );
+    }
+
+    private function createPersonalData(string $firstName, string $lastName): PersonalData
+    {
+        $personalData = new PersonalData();
+        $personalData->firstName = $firstName;
+        $personalData->name = $lastName;
+
+        return $personalData;
+    }
+}
+
+final class TestablePersonalDataController extends PersonalDataController
+{
+    /**
+     * @var array<int, array{0: string, 1: string}>
+     */
+    public array $flashes = [];
+
+    /**
+     * @var array<string, mixed>
+     */
+    public array $renderedParameters = [];
+
+    public string $renderedView = '';
+
+    public function __construct(
+        public readonly ApiClient $apiClient,
+        Crypt $crypt,
+        BookingEditDataLoader $dataLoader,
+        ProfileCompletenessChecker $completenessChecker,
+        EntityManagerInterface $entityManager,
+        public readonly NewsletterManager $newsletterManager,
+        LoggerInterface $logger,
+        private readonly User $user,
+        private readonly FormInterface $form,
+    ) {
+        parent::__construct(
+            $apiClient,
+            $crypt,
+            $dataLoader,
+            $completenessChecker,
+            $entityManager,
+            $newsletterManager,
+            $logger,
+        );
+    }
+
+    public function createForm(string $type, mixed $data = null, array $options = []): FormInterface
+    {
+        return $this->form;
+    }
+
+    protected function getUser(): UserInterface
+    {
+        return $this->user;
+    }
+
+    protected function addFlash(string $type, mixed $message): void
+    {
+        $this->flashes[] = [$type, (string) $message];
+    }
+
+    protected function render(string $view, array $parameters = [], Response $response = null): Response
+    {
+        $this->renderedView = $view;
+        $this->renderedParameters = $parameters;
+
+        return new Response('ok');
+    }
+
+    protected function generateUrl(string $route, array $parameters = [], int $referenceType = UrlGeneratorInterface::ABSOLUTE_PATH): string
+    {
+        return '/personal-data';
+    }
+}

tests/Controller/Api/NewsletterSubscriptionControllerTest.php

@@ -0,0 +1,175 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller\Api;
+
+use App\Controller\Api\NewsletterSubscriptionController;
+use App\Exception\NewsletterListNotAllowedException;
+use App\Exception\NewsletterProviderException;
+use App\Model\NewsletterSubscriptionRequest;
+use App\Model\NewsletterSubscriptionRequestResult;
+use App\Service\NewsletterManager;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+use Symfony\Component\HttpFoundation\Response;
+
+class NewsletterSubscriptionControllerTest extends TestCase
+{
+    public function testValidRequestReturnsAcceptedForNewConfirmation(): void
+    {
+        $manager = $this->createMock(NewsletterManager::class);
+        $manager
+            ->expects(self::once())
+            ->method('requestApiSubscription')
+            ->with('[email protected]', [10321569], [10321569, 12345678], 'Mia', 'Muster')
+            ->willReturn(new NewsletterSubscriptionRequestResult(
+                '[email protected]',
+                [10321569],
+                NewsletterSubscriptionRequestResult::STATE_CONFIRMATION_REQUESTED,
+                true,
+            ));
+        $manager
+            ->expects(self::once())
+            ->method('createListIdMapping')
+            ->with([10321569])
+            ->willReturn([
+                [
+                    'id' => 10321569,
+                    'label' => 'E&P Newsletter',
+                ],
+            ]);
+
+        $controller = new NewsletterSubscriptionController($manager, new NullLogger(), [
+            10321569 => 'E&P Newsletter',
+            12345678 => 'Partner Updates',
+        ]);
+
+        $response = $controller->subscribe($this->request('[email protected]', [10321569], 'Mia', 'Muster'));
+        $payload = json_decode((string) $response->getContent(), true, 512, JSON_THROW_ON_ERROR);
+
+        self::assertSame(Response::HTTP_ACCEPTED, $response->getStatusCode());
+        self::assertSame([
+            'success' => true,
+            'email' => '[email protected]',
+            'lists' => [
+                [
+                    'id' => 10321569,
+                    'label' => 'E&P Newsletter',
+                    'state' => NewsletterSubscriptionRequestResult::LIST_STATE_PENDING,
+                ],
+            ],
+            'state' => NewsletterSubscriptionRequestResult::STATE_CONFIRMATION_REQUESTED,
+            'confirmationRequested' => true,
+        ], $payload);
+    }
+
+    public function testSubscribedRequestReturnsListWiseStates(): void
+    {
+        $manager = $this->createMock(NewsletterManager::class);
+        $manager
+            ->expects(self::once())
+            ->method('requestApiSubscription')
+            ->with('[email protected]', [10321569, 12345678], [10321569, 12345678])
+            ->willReturn(new NewsletterSubscriptionRequestResult(
+                '[email protected]',
+                [10321569, 12345678],
+                NewsletterSubscriptionRequestResult::STATE_SUBSCRIBED,
+                false,
+                [
+                    10321569 => NewsletterSubscriptionRequestResult::LIST_STATE_ALREADY_REGISTERED,
+                    12345678 => NewsletterSubscriptionRequestResult::LIST_STATE_SUCCESS,
+                ],
+            ));
+        $manager
+            ->expects(self::once())
+            ->method('createListIdMapping')
+            ->with([10321569, 12345678])
+            ->willReturn([
+                [
+                    'id' => 10321569,
+                    'label' => 'E&P Newsletter',
+                ],
+                [
+                    'id' => 12345678,
+                    'label' => 'Partner Updates',
+                ],
+            ]);
+
+        $controller = new NewsletterSubscriptionController($manager, new NullLogger(), [
+            10321569 => 'E&P Newsletter',
+            12345678 => 'Partner Updates',
+        ]);
+
+        $response = $controller->subscribe($this->request('[email protected]', [10321569, 12345678]));
+        $payload = json_decode((string) $response->getContent(), true, 512, JSON_THROW_ON_ERROR);
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertSame([
+            [
+                'id' => 10321569,
+                'label' => 'E&P Newsletter',
+                'state' => NewsletterSubscriptionRequestResult::LIST_STATE_ALREADY_REGISTERED,
+            ],
+            [
+                'id' => 12345678,
+                'label' => 'Partner Updates',
+                'state' => NewsletterSubscriptionRequestResult::LIST_STATE_SUCCESS,
+            ],
+        ], $payload['lists']);
+    }
+
+    public function testNonAllowlistedListIdReturnsBadRequestBeforeSideEffects(): void
+    {
+        $manager = $this->createMock(NewsletterManager::class);
+        $manager
+            ->expects(self::once())
+            ->method('requestApiSubscription')
+            ->with('[email protected]', [12345678], [10321569])
+            ->willThrowException(new NewsletterListNotAllowedException([12345678], [12345678]));
+
+        $controller = new NewsletterSubscriptionController($manager, new NullLogger(), [
+            10321569 => 'E&P Newsletter',
+        ]);
+
+        $response = $controller->subscribe($this->request('[email protected]', [12345678]));
+        $payload = json_decode((string) $response->getContent(), true, 512, JSON_THROW_ON_ERROR);
+
+        self::assertSame(Response::HTTP_BAD_REQUEST, $response->getStatusCode());
+        self::assertSame([
+            'success' => false,
+            'message' => 'One or more Mailjet list IDs are not allowed.',
+            'listIds' => [12345678],
+            'unknownListIds' => [12345678],
+        ], $payload);
+    }
+
+    public function testProviderFailureReturnsServiceUnavailable(): void
+    {
+        $manager = $this->createMock(NewsletterManager::class);
+        $manager
+            ->expects(self::once())
+            ->method('requestApiSubscription')
+            ->with('[email protected]', [10321569], [10321569])
+            ->willThrowException(new NewsletterProviderException('Mailjet failed'));
+
+        $controller = new NewsletterSubscriptionController($manager, new NullLogger(), [
+            10321569 => 'E&P Newsletter',
+        ]);
+
+        $response = $controller->subscribe($this->request('[email protected]', [10321569]));
+
+        self::assertSame(Response::HTTP_SERVICE_UNAVAILABLE, $response->getStatusCode());
+    }
+
+    private function request(string $email, array $listIds, ?string $firstName = null, ?string $lastName = null): NewsletterSubscriptionRequest
+    {
+        $request = new NewsletterSubscriptionRequest();
+        $request->email = $email;
+        $request->listIds = $listIds;
+        $request->firstName = $firstName;
+        $request->lastName = $lastName;
+
+        return $request;
+    }
+}

tests/Controller/Webhook/MailjetNewsletterWebhookControllerTest.php

@@ -0,0 +1,87 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller\Webhook;
+
+use App\Controller\Webhook\MailjetNewsletterWebhookController;
+use App\Message\MailjetNewsletterEventMessage;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Messenger\Envelope;
+use Symfony\Component\Messenger\MessageBusInterface;
+
+class MailjetNewsletterWebhookControllerTest extends TestCase
+{
+    public function testDispatchesValidUnsubscribeEventsAndIgnoresUnsupportedEvents(): void
+    {
+        $dispatchedMessages = [];
+        $messageBus = $this->createMock(MessageBusInterface::class);
+        $messageBus
+            ->expects(self::once())
+            ->method('dispatch')
+            ->with(self::callback(static function (MailjetNewsletterEventMessage $message) use (&$dispatchedMessages): bool {
+                $dispatchedMessages[] = $message;
+
+                return true;
+            }))
+            ->willReturnCallback(static fn (object $message): Envelope => new Envelope($message));
+
+        $controller = new MailjetNewsletterWebhookController($messageBus, new NullLogger());
+        $response = $controller(Request::create(
+            '/webhooks/mailjet/newsletter',
+            'POST',
+            content: json_encode([
+                [
+                    'event' => MailjetNewsletterEventMessage::EVENT_UNSUBSCRIBE,
+                    'email' => ' [email protected] ',
+                    'mj_list_id' => '123',
+                    'time' => 1770000000,
+                ],
+                [
+                    'event' => 'open',
+                    'email' => '[email protected]',
+                    'mj_list_id' => '123',
+                ],
+            ], JSON_THROW_ON_ERROR),
+        ));
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertCount(1, $dispatchedMessages);
+        self::assertSame('[email protected]', $dispatchedMessages[0]->email);
+        self::assertSame(123, $dispatchedMessages[0]->mailjetListId);
+        self::assertSame(MailjetNewsletterEventMessage::EVENT_UNSUBSCRIBE, $dispatchedMessages[0]->event);
+        self::assertSame(1770000000, $dispatchedMessages[0]->eventAt?->getTimestamp());
+    }
+
+    public function testRejectsInvalidJson(): void
+    {
+        $messageBus = $this->createMock(MessageBusInterface::class);
+        $messageBus->expects(self::never())->method('dispatch');
+
+        $controller = new MailjetNewsletterWebhookController($messageBus, new NullLogger());
+        $response = $controller(Request::create('/webhooks/mailjet/newsletter', 'POST', content: '{'));
+
+        self::assertSame(400, $response->getStatusCode());
+    }
+
+    public function testAcceptsPayloadWithoutDispatchableEvents(): void
+    {
+        $messageBus = $this->createMock(MessageBusInterface::class);
+        $messageBus->expects(self::never())->method('dispatch');
+
+        $controller = new MailjetNewsletterWebhookController($messageBus, new NullLogger());
+        $response = $controller(Request::create(
+            '/webhooks/mailjet/newsletter',
+            'POST',
+            content: json_encode([
+                'event' => MailjetNewsletterEventMessage::EVENT_UNSUBSCRIBE,
+                'email' => 'not-an-email',
+                'mj_list_id' => '123',
+            ], JSON_THROW_ON_ERROR),
+        ));
+
+        self::assertSame(200, $response->getStatusCode());
+    }
+}

tests/Controller/Webhook/MailjetNewsletterWebhookSecurityTest.php

@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller\Webhook;
+
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+
+class MailjetNewsletterWebhookSecurityTest extends WebTestCase
+{
+    public function testWebhookRequiresBasicAuthentication(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+        ]);
+
+        $client->request(
+            'POST',
+            '/webhooks/mailjet/newsletter',
+            server: ['CONTENT_TYPE' => 'application/json'],
+            content: json_encode(['event' => 'open'], JSON_THROW_ON_ERROR),
+        );
+
+        self::assertResponseStatusCodeSame(401);
+    }
+
+    public function testWebhookAcceptsValidBasicAuthentication(): void
+    {
+        $client = self::createClient([], [
+            'HTTPS' => 'on',
+            'PHP_AUTH_USER' => 'mailjet',
+            'PHP_AUTH_PW' => 'secret',
+        ]);
+
+        $client->request(
+            'POST',
+            '/webhooks/mailjet/newsletter',
+            server: ['CONTENT_TYPE' => 'application/json'],
+            content: json_encode(['event' => 'open'], JSON_THROW_ON_ERROR),
+        );
+
+        self::assertResponseIsSuccessful();
+    }
+}

tests/Entity/NewsletterConsentTest.php

@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Entity;
+
+use App\Entity\NewsletterConsent;
+use PHPUnit\Framework\TestCase;
+
+class NewsletterConsentTest extends TestCase
+{
+    public function testConfirmationAndRevocationAreListScoped(): void
+    {
+        $consent = new NewsletterConsent(' [email protected] ', 123, ' Mia ', ' Muster ');
+
+        self::assertSame('[email protected]', $consent->getEmail());
+        self::assertSame(123, $consent->getMailjetListId());
+        self::assertSame('Mia', $consent->getFirstName());
+        self::assertSame('Muster', $consent->getLastName());
+        self::assertFalse($consent->isConfirmed());
+
+        $consent->markConfirmed(new \DateTimeImmutable('2026-04-29 10:00:00'), 'New', null);
+
+        self::assertTrue($consent->isConfirmed());
+        self::assertFalse($consent->isRevoked());
+        self::assertSame('New', $consent->getFirstName());
+        self::assertSame('Muster', $consent->getLastName());
+
+        $consent->markRevoked(new \DateTimeImmutable('2026-04-29 11:00:00'));
+
+        self::assertFalse($consent->isConfirmed());
+        self::assertTrue($consent->isRevoked());
+
+        $consent->markConfirmed(new \DateTimeImmutable('2026-04-29 12:00:00'));
+
+        self::assertTrue($consent->isConfirmed());
+        self::assertFalse($consent->isRevoked());
+    }
+
+    public function testRejectsInvalidMailjetListId(): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+        $this->expectExceptionMessage('Mailjet list ID must be a positive integer.');
+
+        new NewsletterConsent('[email protected]', 0);
+    }
+}

tests/Entity/NewsletterOptInRequestTest.php

@@ -0,0 +1,103 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Entity;
+
+use App\Entity\NewsletterOptInRequest;
+use PHPUnit\Framework\TestCase;
+
+class NewsletterOptInRequestTest extends TestCase
+{
+    public function testConstructorNormalizesNames(): void
+    {
+        $confirmation = new NewsletterOptInRequest(
+            '[email protected]',
+            str_repeat('a', 64),
+            new \DateTimeImmutable('+1 hour'),
+            [2, 1],
+            ' Mia ',
+            ' Muster ',
+        );
+
+        self::assertSame('Mia', $confirmation->getFirstName());
+        self::assertSame('Muster', $confirmation->getLastName());
+        self::assertSame([1, 2], $confirmation->getMailjetListIds());
+    }
+
+    public function testConstructorConvertsBlankNamesToNull(): void
+    {
+        $confirmation = new NewsletterOptInRequest(
+            '[email protected]',
+            str_repeat('a', 64),
+            new \DateTimeImmutable('+1 hour'),
+            [],
+            '   ',
+            '',
+        );
+
+        self::assertNull($confirmation->getFirstName());
+        self::assertNull($confirmation->getLastName());
+    }
+
+    public function testRefreshRequestPreservesMissingNamesAndUpdatesProvidedValues(): void
+    {
+        $confirmation = new NewsletterOptInRequest(
+            '[email protected]',
+            str_repeat('a', 64),
+            new \DateTimeImmutable('+1 hour'),
+            [1],
+            'Mia',
+            'Muster',
+        );
+
+        $confirmation->refreshRequest(
+            str_repeat('b', 64),
+            new \DateTimeImmutable('+2 hour'),
+            [2, 1],
+            null,
+            'Meyer',
+        );
+
+        self::assertSame('Mia', $confirmation->getFirstName());
+        self::assertSame('Meyer', $confirmation->getLastName());
+        self::assertSame([1, 2], $confirmation->getMailjetListIds());
+        self::assertFalse($confirmation->isConfirmed());
+    }
+
+    public function testMarkRevokedAndConfirmedLifecycleClearsRevocationState(): void
+    {
+        $confirmation = new NewsletterOptInRequest(
+            '[email protected]',
+            str_repeat('a', 64),
+            new \DateTimeImmutable('+1 hour'),
+            [1],
+            'Mia',
+            'Muster',
+        );
+
+        $confirmation->markRevoked(new \DateTimeImmutable('2026-04-28 12:00:00'));
+
+        self::assertTrue($confirmation->isRevoked());
+        self::assertNotNull($confirmation->getRevokedAt());
+
+        $confirmation->markConfirmed(new \DateTimeImmutable('2026-04-28 12:05:00'));
+
+        self::assertFalse($confirmation->isRevoked());
+        self::assertNull($confirmation->getRevokedAt());
+
+        $confirmation->markRevoked(new \DateTimeImmutable('2026-04-28 12:10:00'));
+        $confirmation->refreshRequest(
+            str_repeat('b', 64),
+            new \DateTimeImmutable('+2 hour'),
+            [2, 1],
+            'New',
+            null,
+        );
+
+        self::assertFalse($confirmation->isRevoked());
+        self::assertNull($confirmation->getRevokedAt());
+        self::assertSame('New', $confirmation->getFirstName());
+        self::assertSame('Muster', $confirmation->getLastName());
+    }
+}

tests/MessageHandler/MailjetNewsletterEventHandlerTest.php

@@ -0,0 +1,144 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\MessageHandler;
+
+use App\Entity\NewsletterConsent;
+use App\Message\MailjetNewsletterEventMessage;
+use App\MessageHandler\MailjetNewsletterEventHandler;
+use App\Repository\NewsletterConsentRepository;
+use Doctrine\ORM\EntityManagerInterface;
+use PHPUnit\Framework\TestCase;
+
+class MailjetNewsletterEventHandlerTest extends TestCase
+{
+    public function testUnsubscribeRevokesExistingConsent(): void
+    {
+        $consent = new NewsletterConsent('[email protected]', 123);
+        $consent->markConfirmed(new \DateTimeImmutable('2026-04-29T10:00:00+00:00'));
+
+        $repository = $this->createMock(NewsletterConsentRepository::class);
+        $repository
+            ->expects(self::once())
+            ->method('findOneByEmailAndListId')
+            ->with('[email protected]', 123)
+            ->willReturn($consent);
+
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager->expects(self::never())->method('persist');
+        $entityManager->expects(self::once())->method('flush');
+
+        $handler = new MailjetNewsletterEventHandler($repository, $entityManager);
+        $handler(new MailjetNewsletterEventMessage(
+            email: '[email protected]',
+            mailjetListId: 123,
+            event: MailjetNewsletterEventMessage::EVENT_UNSUBSCRIBE,
+            eventAt: new \DateTimeImmutable('2026-04-29T11:00:00+00:00'),
+        ));
+
+        self::assertTrue($consent->isRevoked());
+        self::assertSame('2026-04-29T11:00:00+00:00', $consent->getRevokedAt()?->format(DATE_ATOM));
+    }
+
+    public function testUnsubscribeCreatesRevokedTombstoneForUnknownConsent(): void
+    {
+        $persistedConsent = null;
+        $repository = $this->createMock(NewsletterConsentRepository::class);
+        $repository
+            ->expects(self::once())
+            ->method('findOneByEmailAndListId')
+            ->with('[email protected]', 123)
+            ->willReturn(null);
+
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager
+            ->expects(self::once())
+            ->method('persist')
+            ->with(self::callback(static function (NewsletterConsent $consent) use (&$persistedConsent): bool {
+                $persistedConsent = $consent;
+
+                return true;
+            }));
+        $entityManager->expects(self::once())->method('flush');
+
+        $handler = new MailjetNewsletterEventHandler($repository, $entityManager);
+        $handler(new MailjetNewsletterEventMessage(
+            email: '[email protected]',
+            mailjetListId: 123,
+            event: MailjetNewsletterEventMessage::EVENT_UNSUBSCRIBE,
+            eventAt: new \DateTimeImmutable('2026-04-29T11:00:00+00:00'),
+        ));
+
+        self::assertInstanceOf(NewsletterConsent::class, $persistedConsent);
+        self::assertSame('[email protected]', $persistedConsent->getEmail());
+        self::assertSame(123, $persistedConsent->getMailjetListId());
+        self::assertTrue($persistedConsent->isRevoked());
+    }
+
+    public function testDuplicateOlderUnsubscribeDoesNotRewriteConsent(): void
+    {
+        $consent = new NewsletterConsent('[email protected]', 123);
+        $consent->markRevoked(new \DateTimeImmutable('2026-04-29T11:00:00+00:00'));
+
+        $repository = $this->createMock(NewsletterConsentRepository::class);
+        $repository->method('findOneByEmailAndListId')->willReturn($consent);
+
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager->expects(self::never())->method('flush');
+
+        $handler = new MailjetNewsletterEventHandler($repository, $entityManager);
+        $handler(new MailjetNewsletterEventMessage(
+            email: '[email protected]',
+            mailjetListId: 123,
+            event: MailjetNewsletterEventMessage::EVENT_UNSUBSCRIBE,
+            eventAt: new \DateTimeImmutable('2026-04-29T10:00:00+00:00'),
+        ));
+
+        self::assertSame('2026-04-29T11:00:00+00:00', $consent->getRevokedAt()?->format(DATE_ATOM));
+    }
+
+    public function testOlderUnsubscribeDoesNotRevokeNewerConfirmation(): void
+    {
+        $consent = new NewsletterConsent('[email protected]', 123);
+        $consent->markConfirmed(new \DateTimeImmutable('2026-04-29T11:00:00+00:00'));
+
+        $repository = $this->createMock(NewsletterConsentRepository::class);
+        $repository->method('findOneByEmailAndListId')->willReturn($consent);
+
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager->expects(self::never())->method('flush');
+
+        $handler = new MailjetNewsletterEventHandler($repository, $entityManager);
+        $handler(new MailjetNewsletterEventMessage(
+            email: '[email protected]',
+            mailjetListId: 123,
+            event: MailjetNewsletterEventMessage::EVENT_UNSUBSCRIBE,
+            eventAt: new \DateTimeImmutable('2026-04-29T10:00:00+00:00'),
+        ));
+
+        self::assertTrue($consent->isConfirmed());
+        self::assertNull($consent->getRevokedAt());
+    }
+
+    public function testDuplicateUnsubscribeWithoutTimestampDoesNotRewriteConsent(): void
+    {
+        $consent = new NewsletterConsent('[email protected]', 123);
+        $consent->markRevoked(new \DateTimeImmutable('2026-04-29T11:00:00+00:00'));
+
+        $repository = $this->createMock(NewsletterConsentRepository::class);
+        $repository->method('findOneByEmailAndListId')->willReturn($consent);
+
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager->expects(self::never())->method('flush');
+
+        $handler = new MailjetNewsletterEventHandler($repository, $entityManager);
+        $handler(new MailjetNewsletterEventMessage(
+            email: '[email protected]',
+            mailjetListId: 123,
+            event: MailjetNewsletterEventMessage::EVENT_UNSUBSCRIBE,
+        ));
+
+        self::assertSame('2026-04-29T11:00:00+00:00', $consent->getRevokedAt()?->format(DATE_ATOM));
+    }
+}

tests/Model/NewsletterSubscriptionRequestTest.php

@@ -0,0 +1,87 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Model;
+
+use App\Model\NewsletterSubscriptionRequest;
+use Symfony\Component\Validator\Constraint;
+use Symfony\Component\Validator\ConstraintValidatorFactory;
+use Symfony\Component\Validator\ConstraintValidatorInterface;
+use Symfony\Component\Validator\Constraints\Email;
+use Symfony\Component\Validator\Constraints\EmailValidator;
+use Symfony\Component\Validator\Validation;
+use Symfony\Component\Validator\Validator\ValidatorInterface;
+
+class NewsletterSubscriptionRequestTest extends \PHPUnit\Framework\TestCase
+{
+    public function testValidRequestPassesValidation(): void
+    {
+        $request = new NewsletterSubscriptionRequest();
+        $request->email = '[email protected]';
+        $request->listIds = [10321569, 12345678];
+        $request->firstName = 'Mia';
+        $request->lastName = 'Muster';
+
+        $violations = $this->validator()->validate($request);
+
+        self::assertCount(0, $violations);
+    }
+
+    public function testTooLongNamesFailValidation(): void
+    {
+        $request = new NewsletterSubscriptionRequest();
+        $request->email = '[email protected]';
+        $request->listIds = [10321569];
+        $request->firstName = str_repeat('A', 256);
+        $request->lastName = str_repeat('B', 256);
+
+        $violations = $this->validator()->validate($request);
+
+        self::assertGreaterThanOrEqual(2, $violations->count());
+    }
+
+    /**
+     * @dataProvider invalidRequests
+     *
+     * @param list<mixed> $listIds
+     */
+    public function testInvalidRequestFailsValidation(?string $email, array $listIds): void
+    {
+        $request = new NewsletterSubscriptionRequest();
+        $request->email = $email;
+        $request->listIds = $listIds;
+
+        $violations = $this->validator()->validate($request);
+
+        self::assertGreaterThan(0, $violations->count());
+    }
+
+    /**
+     * @return iterable<string, array{0: ?string, 1: list<mixed>}>
+     */
+    public function invalidRequests(): iterable
+    {
+        yield 'invalid email' => ['not-an-email', [10321569]];
+        yield 'empty list ids' => ['[email protected]', []];
+        yield 'string list id' => ['[email protected]', ['10321569']];
+        yield 'negative list id' => ['[email protected]', [-1]];
+    }
+
+    private function validator(): ValidatorInterface
+    {
+        return Validation::createValidatorBuilder()
+            ->enableAttributeMapping()
+            ->setConstraintValidatorFactory(new class extends ConstraintValidatorFactory {
+                public function getInstance(Constraint $constraint): ConstraintValidatorInterface
+                {
+                    if (true === ($constraint instanceof Email)) {
+                        return new EmailValidator(Email::VALIDATION_MODE_HTML5);
+                    }
+
+                    return parent::getInstance($constraint);
+                }
+            })
+            ->getValidator();
+    }
+}

tests/Service/MailjetApiClientTest.php

@@ -0,0 +1,197 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Service;
+
+use App\Service\MailjetApiClient;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+use Symfony\Component\HttpClient\MockHttpClient;
+use Symfony\Component\HttpClient\Response\MockResponse;
+
+class MailjetApiClientTest extends TestCase
+{
+    public function testChecksSubscriptionAgainstSuppliedListId(): void
+    {
+        $requests = [];
+        $client = new MockHttpClient(function (string $method, string $url, array $options) use (&$requests): MockResponse {
+            $requests[] = [$method, $url, $options];
+
+            if (true === str_contains($url, '/Contact?')) {
+                return new MockResponse(json_encode([
+                    'Data' => [
+                        ['ID' => 99],
+                    ],
+                ], JSON_THROW_ON_ERROR));
+            }
+
+            return new MockResponse(json_encode([
+                'Data' => [
+                    [
+                        'ContactID' => 99,
+                        'IsActive' => true,
+                        'IsUnsubscribed' => false,
+                    ],
+                ],
+            ], JSON_THROW_ON_ERROR));
+        });
+
+        $mailjet = new MailjetApiClient($client, new NullLogger(), 'key', 'secret', 'https://mailjet.test', '111');
+
+        $subscribed = $mailjet->isSubscribed(' [email protected] ', 123);
+
+        self::assertTrue($subscribed);
+        self::assertSame('123', (string) $requests[1][2]['query']['ContactsList']);
+    }
+
+    public function testUpsertContactCreatesContactAndUpdatesProperties(): void
+    {
+        $requests = [];
+        $client = new MockHttpClient(function (string $method, string $url, array $options) use (&$requests): MockResponse {
+            $requests[] = [$method, $url, $options];
+
+            if (true === str_contains($url, '/Contact?')) {
+                return new MockResponse(json_encode([
+                    'Data' => [],
+                ], JSON_THROW_ON_ERROR));
+            }
+
+            if (true === str_contains($url, '/Contact')) {
+                return new MockResponse(json_encode([
+                    'Data' => [
+                        ['ID' => 99],
+                    ],
+                ], JSON_THROW_ON_ERROR));
+            }
+
+            return new MockResponse(json_encode([
+                'Data' => [],
+            ], JSON_THROW_ON_ERROR));
+        });
+
+        $mailjet = new MailjetApiClient(
+            $client,
+            new NullLogger(),
+            'key',
+            'secret',
+            'https://mailjet.test',
+            '111',
+            [
+                'firstName' => 'vorname',
+                'lastName' => 'nachname',
+            ],
+        );
+
+        $mailjet->upsertContact(' [email protected] ', ' Mia ', ' Muster ');
+
+        self::assertCount(3, $requests);
+        self::assertSame('GET', $requests[0][0]);
+        self::assertSame('https://mailjet.test/[email protected]&Limit=1', $requests[0][1]);
+        self::assertSame('[email protected]', (string) $requests[0][2]['query']['Email']);
+        self::assertSame('POST', $requests[1][0]);
+        self::assertSame('https://mailjet.test/Contact', $requests[1][1]);
+        self::assertSame([
+            'Email' => '[email protected]',
+        ], json_decode((string) $requests[1][2]['body'], true, 512, JSON_THROW_ON_ERROR));
+        self::assertSame('POST', $requests[2][0]);
+        self::assertSame('https://mailjet.test/contactdata', $requests[2][1]);
+        self::assertSame([
+            'ContactID' => 99,
+            'Data' => [
+                [
+                    'Name' => 'vorname',
+                    'Value' => 'Mia',
+                ],
+                [
+                    'Name' => 'nachname',
+                    'Value' => 'Muster',
+                ],
+            ],
+        ], json_decode((string) $requests[2][2]['body'], true, 512, JSON_THROW_ON_ERROR));
+    }
+
+    public function testUpsertContactTruncatesLongNamesBeforeSending(): void
+    {
+        $requests = [];
+        $client = new MockHttpClient(function (string $method, string $url, array $options) use (&$requests): MockResponse {
+            $requests[] = [$method, $url, $options];
+
+            if (true === str_contains($url, '/Contact?')) {
+                return new MockResponse(json_encode([
+                    'Data' => [
+                        ['ID' => 99],
+                    ],
+                ], JSON_THROW_ON_ERROR));
+            }
+
+            if (true === str_contains($url, '/Contact')) {
+                return new MockResponse(json_encode([
+                    'Data' => [],
+                ], JSON_THROW_ON_ERROR));
+            }
+
+            return new MockResponse(json_encode(['Data' => []], JSON_THROW_ON_ERROR));
+        });
+
+        $mailjet = new MailjetApiClient(
+            $client,
+            new NullLogger(),
+            'key',
+            'secret',
+            'https://mailjet.test',
+            '111',
+            [
+                'firstName' => 'vorname',
+                'lastName' => 'nachname',
+            ],
+        );
+
+        $mailjet->upsertContact('[email protected]', str_repeat('A', 300), str_repeat('B', 300));
+
+        $payload = json_decode((string) $requests[1][2]['body'], true, 512, JSON_THROW_ON_ERROR);
+
+        self::assertSame(255, strlen($payload['Data'][0]['Value']));
+        self::assertSame(255, strlen($payload['Data'][1]['Value']));
+        self::assertSame(str_repeat('A', 255), $payload['Data'][0]['Value']);
+        self::assertSame(str_repeat('B', 255), $payload['Data'][1]['Value']);
+    }
+
+    public function testUpsertContactDoesNothingWithoutNames(): void
+    {
+        $requests = [];
+        $client = new MockHttpClient(function (string $method, string $url, array $options) use (&$requests): MockResponse {
+            $requests[] = [$method, $url, $options];
+
+            return new MockResponse(json_encode(['Data' => []], JSON_THROW_ON_ERROR));
+        });
+
+        $mailjet = new MailjetApiClient($client, new NullLogger(), 'key', 'secret', 'https://mailjet.test', '111');
+
+        $mailjet->upsertContact(' [email protected] ');
+
+        self::assertSame([], $requests);
+    }
+
+    public function testEnsureSubscribedUsesSuppliedListId(): void
+    {
+        $requests = [];
+        $client = new MockHttpClient(function (string $method, string $url, array $options) use (&$requests): MockResponse {
+            $requests[] = [$method, $url, $options];
+
+            return new MockResponse(json_encode(['Data' => []], JSON_THROW_ON_ERROR));
+        });
+
+        $mailjet = new MailjetApiClient($client, new NullLogger(), 'key', 'secret', 'https://mailjet.test', '111');
+
+        $mailjet->ensureSubscribed(' [email protected] ', 456);
+
+        self::assertCount(1, $requests);
+        self::assertSame('POST', $requests[0][0]);
+        self::assertSame('https://mailjet.test/Contactslist/456/managecontact', $requests[0][1]);
+        self::assertSame([
+            'Email' => '[email protected]',
+            'Action' => 'addforce',
+        ], json_decode((string) $requests[0][2]['body'], true, 512, JSON_THROW_ON_ERROR));
+    }
+}

tests/Service/NewsletterManagerTest.php

@@ -0,0 +1,443 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Service;
+
+use App\Email\Mailer;
+use App\Entity\NewsletterConsent;
+use App\Entity\NewsletterOptInRequest;
+use App\Exception\NewsletterListNotAllowedException;
+use App\Model\NewsletterConfirmationResult;
+use App\Model\NewsletterSubscriptionRequestResult;
+use App\Repository\NewsletterConsentRepository;
+use App\Repository\NewsletterOptInRequestRepository;
+use App\Service\MailjetApiClient;
+use App\Service\NewsletterManager;
+use Doctrine\ORM\EntityManagerInterface;
+use PHPUnit\Framework\MockObject\MockObject;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\NullLogger;
+
+class NewsletterManagerTest extends TestCase
+{
+    public function testApiRequestCreatesPendingConfirmationForNewEmailWithNormalizedLists(): void
+    {
+        $repository = $this->createMock(NewsletterOptInRequestRepository::class);
+        $consents = $this->createMock(NewsletterConsentRepository::class);
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $mailjet = $this->createMock(MailjetApiClient::class);
+        $mailer = $this->createMock(Mailer::class);
+
+        $mailjet
+            ->expects(self::exactly(2))
+            ->method('isSubscribed')
+            ->withConsecutive(['[email protected]', 1], ['[email protected]', 2])
+            ->willReturn(false);
+        $consents->expects(self::once())->method('findActiveByEmail')->with('[email protected]')->willReturn(null);
+        $repository->expects(self::once())->method('deleteExpiredPendingByEmail')->with('[email protected]')->willReturn(0);
+        $repository->expects(self::once())->method('findPendingByEmail')->with('[email protected]')->willReturn(null);
+
+        $entityManager
+            ->expects(self::once())
+            ->method('persist')
+            ->with(self::callback(static function (NewsletterOptInRequest $confirmation): bool {
+                self::assertSame('[email protected]', $confirmation->getEmail());
+                self::assertSame([1, 2], $confirmation->getMailjetListIds());
+                self::assertSame('Mia', $confirmation->getFirstName());
+                self::assertSame('Muster', $confirmation->getLastName());
+
+                return true;
+            }));
+        $entityManager->expects(self::once())->method('flush');
+        $mailer
+            ->expects(self::once())
+            ->method('createAndSendEmail')
+            ->with(
+                self::callback(static function (array $context): bool {
+                    self::assertArrayHasKey('token', $context);
+                    self::assertSame([
+                        ['id' => 1, 'label' => 'List One'],
+                        ['id' => 2, 'label' => 'List Two'],
+                    ], $context['newsletterLists']);
+
+                    return true;
+                }),
+                self::anything(),
+            );
+
+        $result = $this->createManager($repository, $consents, $entityManager, $mailjet, $mailer)
+            ->requestApiSubscription(' [email protected] ', [2, 1, 2], [1, 2], ' Mia ', ' Muster ');
+
+        self::assertSame('[email protected]', $result->email);
+        self::assertSame([1, 2], $result->listIds);
+        self::assertSame(NewsletterSubscriptionRequestResult::STATE_CONFIRMATION_REQUESTED, $result->state);
+        self::assertTrue($result->confirmationRequested);
+        self::assertSame([
+            1 => NewsletterSubscriptionRequestResult::LIST_STATE_PENDING,
+            2 => NewsletterSubscriptionRequestResult::LIST_STATE_PENDING,
+        ], $result->listStates);
+    }
+
+    public function testApiRequestDoesNotResendForPendingConfirmationWithSameListSet(): void
+    {
+        $pending = new NewsletterOptInRequest('[email protected]', str_repeat('a', 64), new \DateTimeImmutable('+1 hour'), [1, 2]);
+        $repository = $this->createMock(NewsletterOptInRequestRepository::class);
+        $consents = $this->createMock(NewsletterConsentRepository::class);
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $mailjet = $this->createMock(MailjetApiClient::class);
+        $mailer = $this->createMock(Mailer::class);
+
+        $mailjet->method('isSubscribed')->willReturn(false);
+        $consents->expects(self::once())->method('findActiveByEmail')->with('[email protected]')->willReturn(null);
+        $repository->method('deleteExpiredPendingByEmail')->willReturn(0);
+        $repository->expects(self::once())->method('findPendingByEmail')->with('[email protected]')->willReturn($pending);
+
+        $entityManager->expects(self::never())->method('persist');
+        $entityManager->expects(self::never())->method('flush');
+        $mailer->expects(self::never())->method('createAndSendEmail');
+
+        $result = $this->createManager($repository, $consents, $entityManager, $mailjet, $mailer)
+            ->requestApiSubscription('[email protected]', [2, 1]);
+
+        self::assertSame(NewsletterSubscriptionRequestResult::STATE_PENDING_CONFIRMATION, $result->state);
+        self::assertFalse($result->confirmationRequested);
+        self::assertSame([
+            1 => NewsletterSubscriptionRequestResult::LIST_STATE_PENDING,
+            2 => NewsletterSubscriptionRequestResult::LIST_STATE_PENDING,
+        ], $result->listStates);
+    }
+
+    public function testApiRequestRefreshesPendingConfirmationWithLatestListSetAndNames(): void
+    {
+        $pending = new NewsletterOptInRequest('[email protected]', str_repeat('a', 64), new \DateTimeImmutable('+1 hour'), [1], 'Old', 'Name');
+        $repository = $this->createMock(NewsletterOptInRequestRepository::class);
+        $consents = $this->createMock(NewsletterConsentRepository::class);
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $mailjet = $this->createMock(MailjetApiClient::class);
+        $mailer = $this->createMock(Mailer::class);
+
+        $mailjet->method('isSubscribed')->willReturn(false);
+        $consents->expects(self::once())->method('findActiveByEmail')->with('[email protected]')->willReturn(null);
+        $repository->method('deleteExpiredPendingByEmail')->willReturn(0);
+        $repository->expects(self::exactly(2))->method('findPendingByEmail')->with('[email protected]')->willReturn($pending);
+
+        $entityManager->expects(self::never())->method('persist');
+        $entityManager->expects(self::once())->method('flush');
+        $mailer->expects(self::once())->method('createAndSendEmail');
+
+        $result = $this->createManager($repository, $consents, $entityManager, $mailjet, $mailer)
+            ->requestApiSubscription('[email protected]', [3, 2], null, 'New', 'Person');
+
+        self::assertSame(NewsletterSubscriptionRequestResult::STATE_CONFIRMATION_REQUESTED, $result->state);
+        self::assertTrue($result->confirmationRequested);
+        self::assertSame([2, 3], $pending->getMailjetListIds());
+        self::assertSame('New', $pending->getFirstName());
+        self::assertSame('Person', $pending->getLastName());
+    }
+
+    public function testApiRequestRecordsConsentWhenAllListsAreAlreadySubscribed(): void
+    {
+        $repository = $this->createMock(NewsletterOptInRequestRepository::class);
+        $consents = $this->createMock(NewsletterConsentRepository::class);
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $mailjet = $this->createMock(MailjetApiClient::class);
+        $mailer = $this->createMock(Mailer::class);
+
+        $mailjet->method('isSubscribed')->willReturn(true);
+        $mailjet->expects(self::once())->method('upsertContact')->with('[email protected]', 'Mia', 'Muster');
+        $consents->method('findActiveByEmail')->with('[email protected]')->willReturn(null);
+        $consents->method('findOneByEmailAndListId')->willReturn(null);
+        $repository->expects(self::once())->method('deletePendingByEmail')->with('[email protected]')->willReturn(0);
+        $entityManager->expects(self::exactly(2))->method('persist')->with(self::isInstanceOf(NewsletterConsent::class));
+        $entityManager->expects(self::once())->method('flush');
+        $mailer->expects(self::never())->method('createAndSendEmail');
+
+        $result = $this->createManager($repository, $consents, $entityManager, $mailjet, $mailer)
+            ->requestApiSubscription('[email protected]', [2, 1], null, 'Mia', 'Muster');
+
+        self::assertSame(NewsletterSubscriptionRequestResult::STATE_SUBSCRIBED, $result->state);
+        self::assertFalse($result->confirmationRequested);
+        self::assertSame([
+            1 => NewsletterSubscriptionRequestResult::LIST_STATE_ALREADY_REGISTERED,
+            2 => NewsletterSubscriptionRequestResult::LIST_STATE_ALREADY_REGISTERED,
+        ], $result->listStates);
+    }
+
+    public function testApiRequestRejectsUnknownListIdsBeforeSideEffects(): void
+    {
+        $repository = $this->createMock(NewsletterOptInRequestRepository::class);
+        $consents = $this->createMock(NewsletterConsentRepository::class);
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $mailjet = $this->createMock(MailjetApiClient::class);
+        $mailer = $this->createMock(Mailer::class);
+
+        $mailjet->expects(self::never())->method('isSubscribed');
+        $mailjet->expects(self::never())->method('ensureSubscribed');
+        $consents->expects(self::never())->method('findActiveByEmail');
+        $repository->expects(self::never())->method('findPendingByEmail');
+        $entityManager->expects(self::never())->method('persist');
+        $entityManager->expects(self::never())->method('flush');
+
+        try {
+            $this->createManager($repository, $consents, $entityManager, $mailjet, $mailer)
+                ->requestApiSubscription('[email protected]', [2, 3], [1, 2]);
+            self::fail('Expected unknown Mailjet list IDs to be rejected.');
+        } catch (NewsletterListNotAllowedException $exception) {
+            self::assertSame('One or more Mailjet list IDs are not allowed.', $exception->getMessage());
+            self::assertSame([2, 3], $exception->getListIds());
+            self::assertSame([3], $exception->getUnknownListIds());
+        }
+    }
+
+    public function testApiRequestDirectlySubscribesMissingListWhenEmailIsSubscribedToKnownList(): void
+    {
+        $repository = $this->createMock(NewsletterOptInRequestRepository::class);
+        $consents = $this->createMock(NewsletterConsentRepository::class);
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $mailjet = $this->createMock(MailjetApiClient::class);
+        $mailer = $this->createMock(Mailer::class);
+
+        $mailjet
+            ->expects(self::exactly(2))
+            ->method('isSubscribed')
+            ->withConsecutive(['[email protected]', 2], ['[email protected]', 1])
+            ->willReturnOnConsecutiveCalls(false, true);
+        $mailjet->expects(self::once())->method('upsertContact')->with('[email protected]', 'Mia', 'Muster');
+        $mailjet->expects(self::once())->method('ensureSubscribed')->with('[email protected]', 2);
+        $consents->method('findActiveByEmail')->with('[email protected]')->willReturn(null);
+        $consents->method('findOneByEmailAndListId')->willReturn(null);
+        $repository->expects(self::once())->method('deletePendingByEmail')->with('[email protected]')->willReturn(0);
+        $repository->expects(self::never())->method('findPendingByEmail');
+        $entityManager->expects(self::once())->method('persist')->with(self::isInstanceOf(NewsletterConsent::class));
+        $entityManager->expects(self::once())->method('flush');
+        $mailer->expects(self::never())->method('createAndSendEmail');
+
+        $result = $this->createManager($repository, $consents, $entityManager, $mailjet, $mailer)
+            ->requestApiSubscription('[email protected]', [2], [1, 2], 'Mia', 'Muster');
+
+        self::assertSame(NewsletterSubscriptionRequestResult::STATE_SUBSCRIBED, $result->state);
+        self::assertFalse($result->confirmationRequested);
+        self::assertSame([
+            2 => NewsletterSubscriptionRequestResult::LIST_STATE_SUCCESS,
+        ], $result->listStates);
+    }
+
+    public function testApiRequestDirectlySubscribesMissingListWhenEmailHasLocalConsent(): void
+    {
+        $existingConsent = new NewsletterConsent('[email protected]', 1, 'Old', 'Name');
+        $existingConsent->markConfirmed();
+        $repository = $this->createMock(NewsletterOptInRequestRepository::class);
+        $consents = $this->createMock(NewsletterConsentRepository::class);
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $mailjet = $this->createMock(MailjetApiClient::class);
+        $mailer = $this->createMock(Mailer::class);
+
+        $mailjet->method('isSubscribed')->with('[email protected]', 2)->willReturn(false);
+        $mailjet->expects(self::once())->method('upsertContact')->with('[email protected]', 'Mia', 'Muster');
+        $mailjet->expects(self::once())->method('ensureSubscribed')->with('[email protected]', 2);
+        $consents->method('findActiveByEmail')->with('[email protected]')->willReturn($existingConsent);
+        $consents->method('findOneByEmailAndListId')->with('[email protected]', 2)->willReturn(null);
+        $repository->expects(self::once())->method('deletePendingByEmail')->with('[email protected]')->willReturn(0);
+        $entityManager->expects(self::once())->method('persist')->with(self::isInstanceOf(NewsletterConsent::class));
+        $entityManager->expects(self::once())->method('flush');
+
+        $result = $this->createManager($repository, $consents, $entityManager, $mailjet, $mailer)
+            ->requestApiSubscription('[email protected]', [2], [1, 2], 'Mia', 'Muster');
+
+        self::assertSame(NewsletterSubscriptionRequestResult::STATE_SUBSCRIBED, $result->state);
+        self::assertFalse($result->confirmationRequested);
+    }
+
+    public function testDefaultRequestCreatesDefaultListPendingConfirmation(): void
+    {
+        $repository = $this->createMock(NewsletterOptInRequestRepository::class);
+        $consents = $this->createMock(NewsletterConsentRepository::class);
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $mailjet = $this->createMock(MailjetApiClient::class);
+        $mailer = $this->createMock(Mailer::class);
+
+        $repository->method('deleteExpiredPendingByEmail')->willReturn(0);
+        $repository->method('findPendingByEmail')->with('[email protected]')->willReturn(null);
+        $entityManager
+            ->expects(self::once())
+            ->method('persist')
+            ->with(self::callback(static function (NewsletterOptInRequest $confirmation): bool {
+                self::assertSame('[email protected]', $confirmation->getEmail());
+                self::assertSame([10321569], $confirmation->getMailjetListIds());
+
+                return true;
+            }));
+        $entityManager->expects(self::once())->method('flush');
+        $mailer->expects(self::once())->method('createAndSendEmail');
+
+        $this->createManager($repository, $consents, $entityManager, $mailjet, $mailer)
+            ->requestConfirmation('[email protected]');
+    }
+
+    public function testRequestConfirmationTruncatesNamesBeforePersisting(): void
+    {
+        $repository = $this->createMock(NewsletterOptInRequestRepository::class);
+        $consents = $this->createMock(NewsletterConsentRepository::class);
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $mailjet = $this->createMock(MailjetApiClient::class);
+        $mailer = $this->createMock(Mailer::class);
+
+        $repository->method('deleteExpiredPendingByEmail')->willReturn(0);
+        $repository->method('findPendingByEmail')->with('[email protected]')->willReturn(null);
+        $entityManager
+            ->expects(self::once())
+            ->method('persist')
+            ->with(self::callback(static function (NewsletterOptInRequest $confirmation): bool {
+                self::assertSame(str_repeat('A', 255), $confirmation->getFirstName());
+                self::assertSame(str_repeat('B', 255), $confirmation->getLastName());
+
+                return true;
+            }));
+        $entityManager->expects(self::once())->method('flush');
+        $mailer->expects(self::once())->method('createAndSendEmail');
+
+        $this->createManager($repository, $consents, $entityManager, $mailjet, $mailer)
+            ->requestConfirmation('[email protected]', str_repeat('A', 300), str_repeat('B', 300));
+    }
+
+    public function testConfirmationSubscribesDefaultListAndStoresConsent(): void
+    {
+        $token = 'token';
+        $confirmation = new NewsletterOptInRequest(
+            '[email protected]',
+            hash('sha256', $token),
+            new \DateTimeImmutable('+1 hour'),
+            [],
+            'Mia',
+            'Muster',
+        );
+        $repository = $this->createMock(NewsletterOptInRequestRepository::class);
+        $consents = $this->createMock(NewsletterConsentRepository::class);
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $mailjet = $this->createMock(MailjetApiClient::class);
+        $mailer = $this->createMock(Mailer::class);
+
+        $repository->expects(self::once())->method('findByTokenHash')->with(hash('sha256', $token))->willReturn($confirmation);
+        $repository->expects(self::never())->method('deletePendingByEmail');
+        $consents->expects(self::once())->method('findOneByEmailAndListId')->with('[email protected]', 10321569)->willReturn(null);
+        $mailjet->expects(self::once())->method('upsertContact')->with('[email protected]', 'Mia', 'Muster');
+        $mailjet->expects(self::once())->method('ensureSubscribed')->with('[email protected]', 10321569);
+        $entityManager->expects(self::once())->method('persist')->with(self::isInstanceOf(NewsletterConsent::class));
+        $entityManager->expects(self::once())->method('remove')->with($confirmation);
+        $entityManager->expects(self::once())->method('flush');
+
+        $result = $this->createManager($repository, $consents, $entityManager, $mailjet, $mailer)
+            ->confirmToken($token);
+
+        self::assertSame(NewsletterConfirmationResult::STATUS_CONFIRMED, $result->status);
+        self::assertSame([10321569], $confirmation->getMailjetListIds());
+    }
+
+    public function testConfirmationSubscribesStoredListIdsAndStoresConsents(): void
+    {
+        $token = 'token';
+        $confirmation = new NewsletterOptInRequest(
+            '[email protected]',
+            hash('sha256', $token),
+            new \DateTimeImmutable('+1 hour'),
+            [2, 1],
+        );
+        $repository = $this->createMock(NewsletterOptInRequestRepository::class);
+        $consents = $this->createMock(NewsletterConsentRepository::class);
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $mailjet = $this->createMock(MailjetApiClient::class);
+        $mailer = $this->createMock(Mailer::class);
+
+        $repository->expects(self::once())->method('findByTokenHash')->with(hash('sha256', $token))->willReturn($confirmation);
+        $repository->expects(self::never())->method('deletePendingByEmail');
+        $consents->method('findOneByEmailAndListId')->willReturn(null);
+        $mailjet
+            ->expects(self::exactly(2))
+            ->method('ensureSubscribed')
+            ->withConsecutive(['[email protected]', 1], ['[email protected]', 2]);
+        $entityManager->expects(self::exactly(2))->method('persist')->with(self::isInstanceOf(NewsletterConsent::class));
+        $entityManager->expects(self::once())->method('remove')->with($confirmation);
+        $entityManager->expects(self::once())->method('flush');
+
+        $result = $this->createManager($repository, $consents, $entityManager, $mailjet, $mailer)
+            ->confirmToken($token);
+
+        self::assertSame(NewsletterConfirmationResult::STATUS_CONFIRMED, $result->status);
+    }
+
+    public function testConfirmationEntityNormalizesMailjetListIds(): void
+    {
+        $confirmation = new NewsletterOptInRequest(
+            '[email protected]',
+            str_repeat('a', 64),
+            new \DateTimeImmutable('+1 hour'),
+            [2, '1', 2],
+        );
+
+        self::assertSame([1, 2], $confirmation->getMailjetListIds());
+    }
+
+    /**
+     * @dataProvider invalidEntityMailjetListIdProvider
+     */
+    public function testConfirmationEntityRejectsInvalidMailjetListIds(mixed $mailjetListId): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+        $this->expectExceptionMessage('Mailjet list IDs must be positive integers.');
+
+        new NewsletterOptInRequest(
+            '[email protected]',
+            str_repeat('a', 64),
+            new \DateTimeImmutable('+1 hour'),
+            [$mailjetListId],
+        );
+    }
+
+    /**
+     * @return iterable<string, array{mixed}>
+     */
+    public static function invalidEntityMailjetListIdProvider(): iterable
+    {
+        yield 'zero' => [0];
+        yield 'negative integer' => [-1];
+        yield 'zero string' => ['0'];
+        yield 'decimal' => [1.5];
+        yield 'numeric prefix' => ['1abc'];
+        yield 'boolean' => [true];
+    }
+
+    /**
+     * @param MockObject&NewsletterOptInRequestRepository $repository
+     * @param MockObject&NewsletterConsentRepository           $consents
+     * @param MockObject&EntityManagerInterface                $entityManager
+     * @param MockObject&MailjetApiClient                      $mailjet
+     * @param MockObject&Mailer                                $mailer
+     * @param array<int, string>                               $mailjetLists
+     */
+    private function createManager(
+        NewsletterOptInRequestRepository $repository,
+        NewsletterConsentRepository $consents,
+        EntityManagerInterface $entityManager,
+        MailjetApiClient $mailjet,
+        Mailer $mailer,
+        array $mailjetLists = [
+            10321569 => 'E&P Newsletter',
+            1 => 'List One',
+            2 => 'List Two',
+            3 => 'List Three',
+        ],
+    ): NewsletterManager {
+        return new NewsletterManager(
+            optInRequestRepository: $repository,
+            consentRepository: $consents,
+            entityManager: $entityManager,
+            newsletterService: $mailjet,
+            mailer: $mailer,
+            logger: new NullLogger(),
+            newsletterConfirmationTtlHours: 24,
+            mailjetLists: $mailjetLists,
+            defaultMailjetListId: '10321569',
+        );
+    }
+}