wip: group inquiries and booking

2026-07-16 17:13:26 +02:00
1 parent 18a890e50e
commit e7bfb19ac9
@@ -79,7 +79,7 @@ class Step2ControllerTest extends TestCase
        $bookingService
            ->expects(self::once())
            ->method('computeInquiryStatus')
-            ->with(self::callback(static fn(AccommodationBookingDto $submittedDto): bool => 3 === $submittedDto->paxCount), [])
+            ->with(self::callback(static fn (AccommodationBookingDto $submittedDto): bool => 3 === $submittedDto->paxCount), [])
            ->willReturn(new InquiryStatus(true, ['Mindestaufenthalt: 5 Nächte (gebucht: 4)']));

        $controller = new TestableAccommodationStep2Controller(
@@ -6,17 +6,13 @@ namespace App\Tests\Controller\Accommodation;

 use App\Controller\Groups\Step3Controller;
 use App\Entity\Groups\Accommodation;
-use App\Entity\Groups\AccommodationBooking;
 use App\Entity\Groups\AdditionalService;
 use App\Entity\Groups\BoardService;
-use App\Form\AccommodationStep3ConfirmationType;
-use App\Form\AccommodationStep3Type;
 use App\Form\Model\AccommodationBookingDto;
 use App\Service\AccommodationBookingService;
 use App\Service\AccommodationSessionManager;
 use PHPUnit\Framework\TestCase;
 use Symfony\Component\Form\FormInterface;
-use Symfony\Component\Form\SubmitButton;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -42,13 +38,7 @@ class Step3ControllerTest extends TestCase
        $sessionManager = new AccommodationSessionManager();
        $sessionManager->save($request, $dto);

-        $form = $this->createMock(FormInterface::class);
-        $form
-            ->method('handleRequest')
-            ->willReturnSelf();
-        $form
-            ->method('isSubmitted')
-            ->willReturn(false);
+        $form = $this->createFormMock(submitted: false, valid: false);

        $accommodation = (new Accommodation())
            ->setName('Hotel')
@@ -84,7 +74,7 @@ class Step3ControllerTest extends TestCase
        self::assertSame([$additionalService], $controller->renderedParameters['ctx']->additionalServices);
    }

-    public function testClickingBuchenOpensConfirmationModalWithoutPersisting(): void
+    public function testValidSubmitRedirectsToStep4WithoutPersisting(): void
    {
        $dto = new AccommodationBookingDto();
        $dto->currentStep = 3;
@@ -98,20 +88,7 @@ class Step3ControllerTest extends TestCase
        $sessionManager = new AccommodationSessionManager();
        $sessionManager->save($request, $dto);

-        $submitBookingButton = $this->getMockBuilder(SubmitButton::class)
-            ->disableOriginalConstructor()
-            ->onlyMethods(['isClicked'])
-            ->getMock();
-        $submitBookingButton->method('isClicked')->willReturn(true);
-
-        $mainForm = $this->createMock(FormInterface::class);
-        $mainForm->method('handleRequest')->willReturnSelf();
-        $mainForm->method('isSubmitted')->willReturn(true);
-        $mainForm->method('isValid')->willReturn(true);
-        $mainForm->method('has')->with('submitBooking')->willReturn(true);
-        $mainForm->method('get')->with('submitBooking')->willReturn($submitBookingButton);
-
-        $confirmationForm = $this->createMock(FormInterface::class);
+        $form = $this->createFormMock(submitted: true, valid: true);

        $accommodation = (new Accommodation())
            ->setName('Hotel')
@@ -126,115 +103,65 @@ class Step3ControllerTest extends TestCase
            'groupedAdditionalServices' => [],
            'ungroupedAdditionalServices' => [],
        ]);
-        $bookingService->expects(self::never())->method('persist');
+        $bookingService->expects(self::never())->method('finalizeBooking');

-        $controller = new TestableAccommodationStep3Controller(
-            $bookingService,
-            $sessionManager,
-            [AccommodationStep3Type::class => $mainForm, AccommodationStep3ConfirmationType::class => $confirmationForm],
-        );
+        $controller = new TestableAccommodationStep3Controller($bookingService, $sessionManager, $form);
+
+        $response = $controller->index($request);
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/app_groups_booking_step_4', $response->getTargetUrl());
+        self::assertSame(4, $dto->currentStep);
+        self::assertSame($dto, $sessionManager->getDto($request));
+    }
+
+    public function testInvalidSubmitReRendersFormWithErrors(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 3;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-3', 'POST');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $form = $this->createFormMock(submitted: true, valid: false);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->method('loadAvailableServices')->willReturn([
+            'boardServices' => [],
+            'additionalServices' => [],
+            'groupedAdditionalServices' => [],
+            'ungroupedAdditionalServices' => [],
+        ]);
+
+        $controller = new TestableAccommodationStep3Controller($bookingService, $sessionManager, $form);

        $response = $controller->index($request);

        self::assertSame(200, $response->getStatusCode());
        self::assertSame('groups/booking/step_3.html.twig', $controller->renderedView);
-        self::assertSame($confirmationForm, $controller->renderedParameters['confirmationForm']);
-        self::assertFalse($dto->forceInquiry);
+        self::assertSame(3, $dto->currentStep);
        self::assertSame($dto, $sessionManager->getDto($request));
    }

-    public function testConfirmPersistsBookingOnValidConfirmationForm(): void
+    private function createFormMock(bool $submitted, bool $valid): FormInterface
    {
-        $dto = new AccommodationBookingDto();
-        $dto->currentStep = 3;
-        $dto->accommodationId = 1;
-        $dto->isInquiry = false;
+        $form = $this->createMock(FormInterface::class);
+        $form->method('handleRequest')->willReturnSelf();
+        $form->method('isSubmitted')->willReturn($submitted);
+        $form->method('isValid')->willReturn($valid);

-        $session = new Session(new MockArraySessionStorage());
-        $request = Request::create('/groups/booking/step-3/confirm', 'POST');
-        $request->setSession($session);
-        $request->headers->set('HX-Request', 'true');
-
-        $sessionManager = new AccommodationSessionManager();
-        $sessionManager->save($request, $dto);
-
-        $confirmationForm = $this->createMock(FormInterface::class);
-        $confirmationForm->method('handleRequest')->willReturnSelf();
-        $confirmationForm->method('isSubmitted')->willReturn(true);
-        $confirmationForm->method('isValid')->willReturn(true);
-
-        $accommodation = (new Accommodation())
-            ->setName('Hotel')
-            ->setCalendarCode('HOTEL')
-            ->setMaxAdolescentAge(17);
-
-        $booking = (new AccommodationBooking())->setIsInquiry(false);
-
-        $bookingService = $this->createMock(AccommodationBookingService::class);
-        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
-        $bookingService->method('loadAvailableServices')->willReturn([
-            'boardServices' => [],
-            'additionalServices' => [],
-            'groupedAdditionalServices' => [],
-            'ungroupedAdditionalServices' => [],
-        ]);
-        $bookingService->method('loadPrices')->willReturn([]);
-        $bookingService->expects(self::once())->method('persist')->willReturn($booking);
-        $bookingService->expects(self::once())->method('sendNotificationEmail');
-
-        $controller = new TestableAccommodationStep3Controller(
-            $bookingService,
-            $sessionManager,
-            [AccommodationStep3ConfirmationType::class => $confirmationForm],
-        );
-
-        $response = $controller->confirm($request);
-
-        self::assertSame(200, $response->getStatusCode());
-        self::assertTrue($response->headers->has('HX-Redirect'));
-        self::assertNull($sessionManager->getDto($request));
-    }
-
-    public function testConfirmRerendersModalWhenTermsNotAccepted(): void
-    {
-        $dto = new AccommodationBookingDto();
-        $dto->currentStep = 3;
-        $dto->accommodationId = 1;
-        $dto->isInquiry = false;
-
-        $session = new Session(new MockArraySessionStorage());
-        $request = Request::create('/groups/booking/step-3/confirm', 'POST');
-        $request->setSession($session);
-
-        $sessionManager = new AccommodationSessionManager();
-        $sessionManager->save($request, $dto);
-
-        $confirmationForm = $this->createMock(FormInterface::class);
-        $confirmationForm->method('handleRequest')->willReturnSelf();
-        $confirmationForm->method('isSubmitted')->willReturn(true);
-        $confirmationForm->method('isValid')->willReturn(false);
-
-        $accommodation = (new Accommodation())
-            ->setName('Hotel')
-            ->setCalendarCode('HOTEL')
-            ->setMaxAdolescentAge(17);
-
-        $bookingService = $this->createMock(AccommodationBookingService::class);
-        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
-        $bookingService->expects(self::never())->method('persist');
-
-        $controller = new TestableAccommodationStep3Controller(
-            $bookingService,
-            $sessionManager,
-            [AccommodationStep3ConfirmationType::class => $confirmationForm],
-        );
-
-        $response = $controller->confirm($request);
-
-        self::assertSame(200, $response->getStatusCode());
-        self::assertFalse($response->headers->has('HX-Redirect'));
-        self::assertSame('groups/booking/_step3_confirmation_modal.html.twig', $controller->renderedView);
-        self::assertNotNull($sessionManager->getDto($request));
+        return $form;
    }
 }

@@ -247,13 +174,10 @@ final class TestableAccommodationStep3Controller extends Step3Controller

    public string $renderedView = '';

-    /**
-     * @param FormInterface<mixed>|array<class-string, FormInterface<mixed>> $form
-     */
    public function __construct(
        AccommodationBookingService $bookingService,
        AccommodationSessionManager $sessionManager,
-        private readonly FormInterface|array $form,
+        private readonly FormInterface $form,
    ) {
        parent::__construct($bookingService, $sessionManager);
    }
@@ -263,10 +187,6 @@ final class TestableAccommodationStep3Controller extends Step3Controller
     */
    protected function createForm(string $type, mixed $data = null, array $options = []): FormInterface
    {
-        if (is_array($this->form)) {
-            return $this->form[$type];
-        }
-
        return $this->form;
    }

@@ -51,7 +51,9 @@ class AccommodationBookingControllerTest extends TestCase
        $booking->setBoardServiceLabel('Halbpension');
        $booking->setBoardServicePrice(1500);
        $booking->addAdditionalServiceSnapshot('Bettwäsche', 500, 'flat', 3);
-        $booking->setDiscount(1000);
+        $booking->setAccommodationDiscount(10);
+        $booking->setBoardServiceDiscount(20);
+        $booking->setAdditionalServicesDiscount(30);
        $booking->setIsInquiry(false);
        $booking->setAcceptedAt(new \DateTimeImmutable('2026-07-15T10:00:00+00:00'));

@@ -63,6 +65,7 @@ class AccommodationBookingControllerTest extends TestCase
            ->willReturn($booking);

        $breakdown = ['total' => 12345, 'currency' => 'EUR'];
+        $booking->setPriceSnapshot($breakdown, 11111, 'EUR', 1);
        $breakdownCalculator = $this->createMock(AccommodationBookingBreakdownCalculator::class);
        $breakdownCalculator
            ->expects(self::once())
@@ -116,7 +119,12 @@ class AccommodationBookingControllerTest extends TestCase
                    'type' => 'flat',
                ],
            ],
-            'discount' => 1000,
+            'accommodationDiscount' => 10,
+            'boardServiceDiscount' => 20,
+            'additionalServicesDiscount' => 30,
+            'totalPrice' => 11111,
+            'pricingCurrency' => 'EUR',
+            'pricingVersion' => 1,
            'priceBreakdown' => $breakdown,
        ], $payload);

@@ -5,109 +5,32 @@ declare(strict_types=1);
 namespace App\Tests\Controller\Groups;

 use App\Controller\Groups\OfferController;
+use App\Entity\Groups\Accommodation;
 use App\Entity\Groups\AccommodationBooking;
 use App\Repository\Groups\AccommodationBookingRepository;
 use App\Service\AccommodationBookingBreakdownCalculator;
 use App\Service\AccommodationBookingLinkSigner;
 use App\Service\AccommodationBookingService;
 use PHPUnit\Framework\TestCase;
+use Symfony\Component\Form\FormInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\Session\Session;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;

 class OfferControllerTest extends TestCase
 {
-    public function testGetRendersOfferWithAcceptFormForInquiry(): void
+    public function testAccessAuthorizesSessionAndRedirectsToView(): void
    {
        $booking = new AccommodationBooking();
-        $booking->setIsInquiry(true);

        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
        $bookingRepository->method('findOneBy')->with(['uuid' => $booking->getUuid()])->willReturn($booking);

        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
        $linkSigner->method('isValidLinkRequest')->willReturn(true);
-
-        $breakdownCalculator = $this->createMock(AccommodationBookingBreakdownCalculator::class);
-        $breakdownCalculator->method('compute')->with($booking)->willReturn(['total' => 1000]);
-
-        $bookingService = $this->createMock(AccommodationBookingService::class);
-        $bookingService->expects(self::never())->method('acceptBooking');
-
-        $controller = new TestableOfferController($bookingRepository, $linkSigner, $breakdownCalculator, $bookingService);
-
-        $response = $controller->index($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid()));
-
-        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
-        self::assertSame('<html>offer</html>', $response->getContent());
-        self::assertSame('groups/booking/offer.html.twig', $controller->renderedView);
-        self::assertSame(['booking' => $booking, 'priceBreakdown' => ['total' => 1000]], $controller->renderedParameters);
-    }
-
-    public function testPostAcceptsInquiryAndRedirectsToSameUrl(): void
-    {
-        $booking = new AccommodationBooking();
-        $booking->setIsInquiry(true);
-
-        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
-        $bookingRepository->method('findOneBy')->willReturn($booking);
-
-        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
-        $linkSigner->method('isValidLinkRequest')->willReturn(true);
-
-        $bookingService = $this->createMock(AccommodationBookingService::class);
-        $bookingService->expects(self::once())->method('acceptBooking')->with($booking);
-
-        $controller = new OfferController(
-            $bookingRepository,
-            $linkSigner,
-            $this->createMock(AccommodationBookingBreakdownCalculator::class),
-            $bookingService,
-        );
-
-        $request = Request::create('/groups/booking/offer/'.$booking->getUuid().'?t=123&_hash=abc', 'POST');
-        $response = $controller->index($booking->getUuid(), $request);
-
-        self::assertSame(Response::HTTP_FOUND, $response->getStatusCode());
-        self::assertSame($request->getUri(), $response->headers->get('Location'));
-    }
-
-    public function testGetRendersConfirmationWithoutAcceptFormForBooking(): void
-    {
-        $booking = new AccommodationBooking();
-        $booking->setIsInquiry(false);
-
-        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
-        $bookingRepository->method('findOneBy')->willReturn($booking);
-
-        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
-        $linkSigner->method('isValidLinkRequest')->willReturn(true);
-
-        $bookingService = $this->createMock(AccommodationBookingService::class);
-        $bookingService->expects(self::never())->method('acceptBooking');
-
-        $controller = new TestableOfferController(
-            $bookingRepository,
-            $linkSigner,
-            $this->createMock(AccommodationBookingBreakdownCalculator::class),
-            $bookingService,
-        );
-
-        // A POST on an already-accepted booking should not trigger acceptBooking again — falls through to render.
-        $response = $controller->index($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid(), 'POST'));
-
-        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
-        self::assertSame('groups/booking/offer.html.twig', $controller->renderedView);
-    }
-
-    public function testInvalidLinkReturnsUnavailableResponse(): void
-    {
-        $booking = new AccommodationBooking();
-
-        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
-        $bookingRepository->method('findOneBy')->willReturn($booking);
-
-        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
-        $linkSigner->method('isValidLinkRequest')->willReturn(false);
+        $linkSigner->expects(self::once())->method('authorizeSession')->with(self::anything(), $booking);

        $controller = new TestableOfferController(
            $bookingRepository,
@@ -116,13 +39,37 @@ class OfferControllerTest extends TestCase
            $this->createMock(AccommodationBookingService::class),
        );

-        $response = $controller->index($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid()));
+        $response = $controller->access($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid()));
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/app_groups_booking_offer_view?uuid='.$booking->getUuid(), $response->getTargetUrl());
+    }
+
+    public function testAccessRendersUnavailableForInvalidLink(): void
+    {
+        $booking = new AccommodationBooking();
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isValidLinkRequest')->willReturn(false);
+        $linkSigner->expects(self::never())->method('authorizeSession');
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $this->createMock(AccommodationBookingService::class),
+        );
+
+        $response = $controller->access($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid()));

        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
        self::assertSame('groups/booking/offer_unavailable.html.twig', $controller->renderedView);
    }

-    public function testUnknownUuidReturnsUnavailableResponse(): void
+    public function testAccessRendersUnavailableForUnknownUuid(): void
    {
        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
        $bookingRepository->method('findOneBy')->willReturn(null);
@@ -137,11 +84,300 @@ class OfferControllerTest extends TestCase
            $this->createMock(AccommodationBookingService::class),
        );

-        $response = $controller->index('unknown-uuid', Request::create('/groups/booking/offer/unknown-uuid'));
+        $response = $controller->access('unknown-uuid', Request::create('/groups/booking/offer/unknown-uuid'));

        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
        self::assertSame('groups/booking/offer_unavailable.html.twig', $controller->renderedView);
    }
+
+    public function testViewRendersOfferWhenSessionAuthorized(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(true);
+        $booking->setAccommodation(new Accommodation());
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->with(['uuid' => $booking->getUuid()])->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $breakdownCalculator = $this->createMock(AccommodationBookingBreakdownCalculator::class);
+        $breakdownCalculator->method('compute')->with($booking)->willReturn(['total' => 1000]);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::never())->method('acceptBooking');
+        $bookingService->method('loadHotelCmsData')->willReturn(null);
+
+        $controller = new TestableOfferController($bookingRepository, $linkSigner, $breakdownCalculator, $bookingService);
+
+        $request = Request::create('/groups/booking/offer/'.$booking->getUuid().'/view');
+        $request->setSession(new Session(new MockArraySessionStorage()));
+        $response = $controller->view($booking->getUuid(), $request);
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertSame('<html>offer</html>', $response->getContent());
+        self::assertSame('groups/booking/offer.html.twig', $controller->renderedView);
+        self::assertFalse($controller->renderedParameters['justAccepted']);
+        self::assertSame($booking, $controller->renderedParameters['booking']);
+        self::assertSame(['total' => 1000], $controller->renderedParameters['priceBreakdown']);
+        self::assertSame($booking->getAccommodation(), $controller->renderedParameters['ctx']->accommodation);
+    }
+
+    public function testViewRendersUnavailableWhenSessionNotAuthorized(): void
+    {
+        $booking = new AccommodationBooking();
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(false);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $this->createMock(AccommodationBookingService::class),
+        );
+
+        $response = $controller->view($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid().'/view'));
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertSame('groups/booking/offer_unavailable.html.twig', $controller->renderedView);
+    }
+
+    public function testViewMarksJustAcceptedWhenFlashIsPresent(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(false);
+        $booking->setAccommodation(new Accommodation());
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $breakdownCalculator = $this->createMock(AccommodationBookingBreakdownCalculator::class);
+        $breakdownCalculator->method('compute')->willReturn(['total' => 1000]);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $breakdownCalculator,
+            $this->createMock(AccommodationBookingService::class),
+        );
+
+        $session = new Session(new MockArraySessionStorage());
+        $session->getFlashBag()->add('accommodation_offer_accepted', true);
+
+        $request = Request::create('/groups/booking/offer/'.$booking->getUuid().'/view');
+        $request->setSession($session);
+        $response = $controller->view($booking->getUuid(), $request);
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertTrue($controller->renderedParameters['justAccepted']);
+    }
+
+    public function testConfirmGetRendersModalWithFreshForm(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(true);
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->with(['uuid' => $booking->getUuid()])->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(false);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $this->createMock(AccommodationBookingService::class),
+            $confirmationForm,
+        );
+
+        $response = $controller->confirm($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid().'/confirm'));
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertSame('groups/booking/_offer_accept_confirmation_modal.html.twig', $controller->renderedView);
+        self::assertSame($booking, $controller->renderedParameters['booking']);
+        self::assertSame($confirmationForm, $controller->renderedParameters['confirmationForm']);
+    }
+
+    public function testConfirmPostValidAcceptsBookingAndRedirects(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(true);
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::once())->method('acceptBooking')->with($booking);
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(true);
+        $confirmationForm->method('isValid')->willReturn(true);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $bookingService,
+            $confirmationForm,
+        );
+
+        $request = Request::create('/groups/booking/offer/'.$booking->getUuid().'/confirm', 'POST');
+        $response = $controller->confirm($booking->getUuid(), $request);
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/app_groups_booking_offer_view?uuid='.$booking->getUuid(), $response->getTargetUrl());
+    }
+
+    public function testConfirmPostValidViaHtmxReturnsHxRedirect(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(true);
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::once())->method('acceptBooking')->with($booking);
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(true);
+        $confirmationForm->method('isValid')->willReturn(true);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $bookingService,
+            $confirmationForm,
+        );
+
+        $request = Request::create('/groups/booking/offer/'.$booking->getUuid().'/confirm', 'POST');
+        $request->headers->set('HX-Request', 'true');
+        $response = $controller->confirm($booking->getUuid(), $request);
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertTrue($response->headers->has('HX-Redirect'));
+    }
+
+    public function testConfirmPostInvalidReRendersModalWithoutAccepting(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(true);
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->expects(self::never())->method('acceptBooking');
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(true);
+        $confirmationForm->method('isValid')->willReturn(false);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $bookingService,
+            $confirmationForm,
+        );
+
+        $response = $controller->confirm($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid().'/confirm', 'POST'));
+
+        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
+        self::assertFalse($response->headers->has('HX-Redirect'));
+        self::assertSame('groups/booking/_offer_accept_confirmation_modal.html.twig', $controller->renderedView);
+    }
+
+    public function testConfirmRedirectsWhenAlreadyAccepted(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setIsInquiry(false);
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(true);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $this->createMock(AccommodationBookingService::class),
+        );
+
+        $response = $controller->confirm($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid().'/confirm'));
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+    }
+
+    public function testConfirmRedirectsWhenSessionNotAuthorized(): void
+    {
+        $booking = new AccommodationBooking();
+
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn($booking);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->method('isSessionAuthorized')->willReturn(false);
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $this->createMock(AccommodationBookingService::class),
+        );
+
+        $response = $controller->confirm($booking->getUuid(), Request::create('/groups/booking/offer/'.$booking->getUuid().'/confirm'));
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+    }
+
+    public function testConfirmRedirectsForUnknownUuid(): void
+    {
+        $bookingRepository = $this->createMock(AccommodationBookingRepository::class);
+        $bookingRepository->method('findOneBy')->willReturn(null);
+
+        $linkSigner = $this->createMock(AccommodationBookingLinkSigner::class);
+        $linkSigner->expects(self::never())->method('isSessionAuthorized');
+
+        $controller = new TestableOfferController(
+            $bookingRepository,
+            $linkSigner,
+            $this->createMock(AccommodationBookingBreakdownCalculator::class),
+            $this->createMock(AccommodationBookingService::class),
+        );
+
+        $response = $controller->confirm('unknown-uuid', Request::create('/groups/booking/offer/unknown-uuid/confirm'));
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+    }
 }

 final class TestableOfferController extends OfferController
@@ -151,6 +387,39 @@ final class TestableOfferController extends OfferController
    /** @var array<string, mixed> */
    public array $renderedParameters = [];

+    public function __construct(
+        AccommodationBookingRepository $bookingRepository,
+        AccommodationBookingLinkSigner $linkSigner,
+        AccommodationBookingBreakdownCalculator $breakdownCalculator,
+        AccommodationBookingService $bookingService,
+        private readonly ?FormInterface $confirmationForm = null,
+    ) {
+        parent::__construct($bookingRepository, $linkSigner, $breakdownCalculator, $bookingService);
+    }
+
+    protected function createForm(string $type, mixed $data = null, array $options = []): FormInterface
+    {
+        return $this->confirmationForm ?? throw new \LogicException('No confirmation form mock configured for this test.');
+    }
+
+    protected function getParameter(string $name): array|bool|string|int|float|\UnitEnum|null
+    {
+        return 'https://example.test/agb/';
+    }
+
+    protected function addFlash(string $type, mixed $message): void
+    {
+        // no-op: avoids requiring a full service container in these unit tests
+    }
+
+    /**
+     * @param array<string, mixed> $parameters
+     */
+    protected function generateUrl(string $route, array $parameters = [], int $referenceType = 1): string
+    {
+        return '/'.$route.'?'.http_build_query($parameters);
+    }
+
    protected function render(string $view, array $parameters = [], ?Response $response = null): Response
    {
        $this->renderedView = $view;
@@ -0,0 +1,402 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller\Groups;
+
+use App\Controller\Groups\Step4Controller;
+use App\Entity\Groups\Accommodation;
+use App\Entity\Groups\AccommodationBooking;
+use App\Form\Model\AccommodationBookingDto;
+use App\Service\AccommodationBookingService;
+use App\Service\AccommodationSessionManager;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Form\FormInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\Session\Session;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
+
+class Step4ControllerTest extends TestCase
+{
+    public function testIndexRendersRecapWhenStepFourReached(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+        $dto->isInquiry = false;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4', 'GET');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->method('loadAvailableServices')->willReturn([
+            'boardServices' => [],
+            'additionalServices' => [],
+            'groupedAdditionalServices' => [],
+            'ungroupedAdditionalServices' => [],
+        ]);
+
+        $controller = new TestableStep4Controller($bookingService, $sessionManager, $this->createMock(FormInterface::class));
+
+        $response = $controller->index($request);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame('groups/booking/step_4.html.twig', $controller->renderedView);
+        self::assertSame($dto, $controller->renderedParameters['dto']);
+    }
+
+    public function testIndexRedirectsToStep3WhenNotYetReached(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 3;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4', 'GET');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $controller = new TestableStep4Controller(
+            $this->createMock(AccommodationBookingService::class),
+            $sessionManager,
+            $this->createMock(FormInterface::class),
+        );
+
+        $response = $controller->index($request);
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/app_groups_booking_step_3', $response->getTargetUrl());
+    }
+
+    public function testIndexPostWithValidCsrfPersistsAsInquiryAndRedirects(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4', 'POST');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $booking = (new AccommodationBooking())->setIsInquiry(true);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->method('loadAvailableServices')->willReturn([
+            'boardServices' => [],
+            'additionalServices' => [],
+            'groupedAdditionalServices' => [],
+            'ungroupedAdditionalServices' => [],
+        ]);
+        $bookingService->method('loadPrices')->willReturn([]);
+        $bookingService->expects(self::once())->method('finalizeBooking')->willReturn($booking);
+
+        $inquiryForm = $this->createMock(FormInterface::class);
+        $inquiryForm->method('handleRequest')->willReturnSelf();
+        $inquiryForm->method('isSubmitted')->willReturn(true);
+        $inquiryForm->method('isValid')->willReturn(true);
+
+        $controller = new TestableStep4Controller($bookingService, $sessionManager, $inquiryForm);
+
+        $response = $controller->index($request);
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/app_groups_booking_success', $response->getTargetUrl());
+        self::assertTrue($dto->forceInquiry);
+        self::assertNull($sessionManager->getDto($request));
+    }
+
+    public function testIndexPostWithInvalidFormThrowsAccessDenied(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4', 'POST');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->method('loadAvailableServices')->willReturn([
+            'boardServices' => [],
+            'additionalServices' => [],
+            'groupedAdditionalServices' => [],
+            'ungroupedAdditionalServices' => [],
+        ]);
+        $bookingService->expects(self::never())->method('finalizeBooking');
+
+        $inquiryForm = $this->createMock(FormInterface::class);
+        $inquiryForm->method('handleRequest')->willReturnSelf();
+        $inquiryForm->method('isSubmitted')->willReturn(true);
+        $inquiryForm->method('isValid')->willReturn(false);
+
+        $controller = new TestableStep4Controller($bookingService, $sessionManager, $inquiryForm);
+
+        $this->expectException(\Symfony\Component\Security\Core\Exception\AccessDeniedException::class);
+
+        $controller->index($request);
+    }
+
+    public function testConfirmInquiryGetRendersModal(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4/confirm-inquiry', 'GET');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $controller = new TestableStep4Controller(
+            $this->createMock(AccommodationBookingService::class),
+            $sessionManager,
+            $this->createMock(FormInterface::class),
+        );
+
+        $response = $controller->confirmInquiry($request);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame('groups/booking/_step4_inquiry_confirmation_modal.html.twig', $controller->renderedView);
+    }
+
+    public function testConfirmInquiryRedirectsToStep3WhenNotYetReached(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 3;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4/confirm-inquiry', 'GET');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $controller = new TestableStep4Controller(
+            $this->createMock(AccommodationBookingService::class),
+            $sessionManager,
+            $this->createMock(FormInterface::class),
+        );
+
+        $response = $controller->confirmInquiry($request);
+
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/app_groups_booking_step_3', $response->getTargetUrl());
+    }
+
+    public function testConfirmGetRendersModalWithFreshForm(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4/confirm', 'GET');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->expects(self::never())->method('finalizeBooking');
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(false);
+
+        $controller = new TestableStep4Controller($bookingService, $sessionManager, $confirmationForm);
+
+        $response = $controller->confirm($request);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertSame('groups/booking/_step4_booking_confirmation_modal.html.twig', $controller->renderedView);
+        self::assertSame($confirmationForm, $controller->renderedParameters['confirmationForm']);
+        self::assertSame($dto, $sessionManager->getDto($request));
+    }
+
+    public function testConfirmPostValidPersistsAndRedirects(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4/confirm', 'POST');
+        $request->setSession($session);
+        $request->headers->set('HX-Request', 'true');
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $booking = (new AccommodationBooking())->setIsInquiry(false);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->method('loadAvailableServices')->willReturn([
+            'boardServices' => [],
+            'additionalServices' => [],
+            'groupedAdditionalServices' => [],
+            'ungroupedAdditionalServices' => [],
+        ]);
+        $bookingService->method('loadPrices')->willReturn([]);
+        $bookingService->expects(self::once())->method('finalizeBooking')->willReturn($booking);
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(true);
+        $confirmationForm->method('isValid')->willReturn(true);
+
+        $controller = new TestableStep4Controller($bookingService, $sessionManager, $confirmationForm);
+
+        $response = $controller->confirm($request);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertTrue($response->headers->has('HX-Redirect'));
+        self::assertNull($sessionManager->getDto($request));
+    }
+
+    public function testConfirmPostInvalidReRendersModalWithoutPersisting(): void
+    {
+        $dto = new AccommodationBookingDto();
+        $dto->currentStep = 4;
+        $dto->accommodationId = 1;
+
+        $session = new Session(new MockArraySessionStorage());
+        $request = Request::create('/groups/booking/step-4/confirm', 'POST');
+        $request->setSession($session);
+
+        $sessionManager = new AccommodationSessionManager();
+        $sessionManager->save($request, $dto);
+
+        $accommodation = (new Accommodation())
+            ->setName('Hotel')
+            ->setCalendarCode('HOTEL')
+            ->setMaxAdolescentAge(17);
+
+        $bookingService = $this->createMock(AccommodationBookingService::class);
+        $bookingService->method('loadAccommodation')->with(1)->willReturn($accommodation);
+        $bookingService->expects(self::never())->method('finalizeBooking');
+
+        $confirmationForm = $this->createMock(FormInterface::class);
+        $confirmationForm->method('handleRequest')->willReturnSelf();
+        $confirmationForm->method('isSubmitted')->willReturn(true);
+        $confirmationForm->method('isValid')->willReturn(false);
+
+        $controller = new TestableStep4Controller($bookingService, $sessionManager, $confirmationForm);
+
+        $response = $controller->confirm($request);
+
+        self::assertSame(200, $response->getStatusCode());
+        self::assertFalse($response->headers->has('HX-Redirect'));
+        self::assertSame('groups/booking/_step4_booking_confirmation_modal.html.twig', $controller->renderedView);
+        self::assertNotNull($sessionManager->getDto($request));
+    }
+}
+
+final class TestableStep4Controller extends Step4Controller
+{
+    /**
+     * @var array<string, mixed>
+     */
+    public array $renderedParameters = [];
+
+    public string $renderedView = '';
+
+    public function __construct(
+        AccommodationBookingService $bookingService,
+        AccommodationSessionManager $sessionManager,
+        private readonly FormInterface $form,
+    ) {
+        parent::__construct($bookingService, $sessionManager);
+    }
+
+    /**
+     * @return FormInterface<mixed>
+     */
+    protected function createForm(string $type, mixed $data = null, array $options = []): FormInterface
+    {
+        return $this->form;
+    }
+
+    protected function getParameter(string $name): array|bool|string|int|float|\UnitEnum|null
+    {
+        return 'https://example.test/agb/';
+    }
+
+    /**
+     * @param array<string, mixed> $parameters
+     */
+    protected function redirectToRoute(string $route, array $parameters = [], int $status = 302): RedirectResponse
+    {
+        return new RedirectResponse('/'.$route, $status);
+    }
+
+    /**
+     * @param array<string, mixed> $parameters
+     */
+    protected function generateUrl(string $route, array $parameters = [], int $referenceType = 1): string
+    {
+        return '/'.$route;
+    }
+
+    protected function addFlash(string $type, mixed $message): void
+    {
+        // no-op: avoids requiring a full service container in these unit tests
+    }
+
+    /**
+     * @param array<string, mixed> $parameters
+     */
+    protected function render(string $view, array $parameters = [], ?Response $response = null): Response
+    {
+        $this->renderedView = $view;
+        $this->renderedParameters = $parameters;
+
+        return new Response('ok');
+    }
+}
@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Model;
+
+use App\Model\ContingentCalendarQuery;
+use App\Model\ContingentPricesQuery;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Validator\Validation;
+
+class ContingentQueryTest extends TestCase
+{
+    public function testCalendarQueryAcceptsValidRange(): void
+    {
+        $query = new ContingentCalendarQuery('HOTEL_1', '2026-01-01', '2026-12-31');
+
+        self::assertCount(0, $this->validator()->validate($query));
+        self::assertSame('2026-01-01', $query->dateFromDate()->format('Y-m-d'));
+    }
+
+    /**
+     * @dataProvider invalidCalendarQueries
+     */
+    public function testCalendarQueryRejectsInvalidInput(ContingentCalendarQuery $query): void
+    {
+        self::assertGreaterThan(0, $this->validator()->validate($query)->count());
+    }
+
+    public function invalidCalendarQueries(): iterable
+    {
+        yield 'normalized invalid date' => [new ContingentCalendarQuery('HOTEL', '2026-02-31', '2026-03-01')];
+        yield 'reversed range' => [new ContingentCalendarQuery('HOTEL', '2026-03-02', '2026-03-01')];
+        yield 'range over 366 days' => [new ContingentCalendarQuery('HOTEL', '2026-01-01', '2027-01-03')];
+        yield 'invalid hotel code' => [new ContingentCalendarQuery('HOTEL CODE', '2026-01-01', '2026-01-02')];
+    }
+
+    public function testPricesQueryRequiresFourDigitYear(): void
+    {
+        self::assertCount(0, $this->validator()->validate(new ContingentPricesQuery('HOTEL', 2026)));
+        self::assertGreaterThan(0, $this->validator()->validate(new ContingentPricesQuery('HOTEL', 26))->count());
+    }
+
+    private function validator(): \Symfony\Component\Validator\Validator\ValidatorInterface
+    {
+        return Validation::createValidatorBuilder()
+            ->enableAttributeMapping()
+            ->getValidator();
+    }
+}
@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Service;
+
+use App\Entity\Groups\AccommodationBooking;
+use App\Repository\Groups\AccommodationPriceRepository;
+use App\Service\AccommodationBookingBreakdownCalculator;
+use App\Service\GroupsPriceCalculator;
+use App\Service\PriceTimelineBuilder;
+use PHPUnit\Framework\TestCase;
+
+class AccommodationBookingBreakdownCalculatorTest extends TestCase
+{
+    public function testComputeReturnsStoredSnapshotWithoutLoadingCurrentPrices(): void
+    {
+        $snapshot = ['total' => 12345, 'currency' => 'EUR'];
+        $booking = new AccommodationBooking();
+        $booking->setPriceSnapshot($snapshot, 12345, 'EUR', 1);
+
+        $priceRepository = $this->createMock(AccommodationPriceRepository::class);
+        $priceRepository->expects(self::never())->method('findByHotelCodeAndDateRange');
+
+        $calculator = new AccommodationBookingBreakdownCalculator(
+            new GroupsPriceCalculator(new PriceTimelineBuilder(), [
+                'runningCostsEur' => 0,
+                'runningCostsChf' => 0,
+                'undersubscription30Eur' => 0,
+                'undersubscription30Chf' => 0,
+                'undersubscription40Eur' => 0,
+                'undersubscription40Chf' => 0,
+            ]),
+            $priceRepository,
+        );
+
+        self::assertSame($snapshot, $calculator->compute($booking));
+    }
+}
@@ -8,6 +8,8 @@ use App\Entity\Groups\AccommodationBooking;
 use App\Service\AccommodationBookingLinkSigner;
 use PHPUnit\Framework\TestCase;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Session\Session;
+use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;

 class AccommodationBookingLinkSignerTest extends TestCase
@@ -94,6 +96,77 @@ class AccommodationBookingLinkSignerTest extends TestCase
        self::assertSame('2026-04-01T00:00:00+00:00', $signer->expiresAt($booking)?->format(\DATE_ATOM));
    }

+    public function testSessionIsAuthorizedAfterAuthorizeSession(): void
+    {
+        $booking = $this->bookingWithAccessLink();
+        $signer = $this->createSigner();
+        $request = $this->requestWithSession();
+
+        self::assertFalse($signer->isSessionAuthorized($request, $booking));
+
+        $signer->authorizeSession($request, $booking);
+
+        self::assertTrue($signer->isSessionAuthorized($request, $booking));
+    }
+
+    public function testSessionAuthorizationIsPerBooking(): void
+    {
+        $booking = $this->bookingWithAccessLink();
+        $otherBooking = $this->bookingWithAccessLink();
+        $signer = $this->createSigner();
+        $request = $this->requestWithSession();
+
+        $signer->authorizeSession($request, $booking);
+
+        self::assertTrue($signer->isSessionAuthorized($request, $booking));
+        self::assertFalse($signer->isSessionAuthorized($request, $otherBooking));
+    }
+
+    public function testSessionAuthorizationIsRevokedWhenLinkIsRegenerated(): void
+    {
+        $booking = $this->bookingWithAccessLink();
+        $signer = $this->createSigner();
+        $request = $this->requestWithSession();
+
+        $signer->authorizeSession($request, $booking);
+        self::assertTrue($signer->isSessionAuthorized($request, $booking));
+
+        // Regenerating the access link overwrites accessLinkIssuedAt — the
+        // previously-authorized session no longer matches.
+        $booking->setAccessLinkIssuedAt(new \DateTimeImmutable('+1 minute'));
+
+        self::assertFalse($signer->isSessionAuthorized($request, $booking));
+    }
+
+    public function testSessionAuthorizationFailsPastTtlEvenIfSessionMatches(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setAccessLinkIssuedAt(new \DateTimeImmutable('-91 days'));
+        $signer = $this->createSigner();
+        $request = $this->requestWithSession();
+
+        $signer->authorizeSession($request, $booking);
+
+        self::assertFalse($signer->isSessionAuthorized($request, $booking));
+    }
+
+    public function testSessionAuthorizationFailsWithoutAccessLinkIssuedAt(): void
+    {
+        $booking = new AccommodationBooking();
+        $signer = $this->createSigner();
+        $request = $this->requestWithSession();
+
+        self::assertFalse($signer->isSessionAuthorized($request, $booking));
+    }
+
+    private function requestWithSession(): Request
+    {
+        $request = Request::create('https://example.com/');
+        $request->setSession(new Session(new MockArraySessionStorage()));
+
+        return $request;
+    }
+
    private function bookingWithAccessLink(): AccommodationBooking
    {
        $booking = new AccommodationBooking();
@@ -175,7 +175,7 @@ class AccommodationBookingServiceTest extends TestCase
        $service->sendCustomerConfirmationEmail($booking);
    }

-    public function testRegenerateAccessLinkAndNotifyCustomerAlwaysOverwritesAndSends(): void
+    public function testRegenerateAccessLinkOverwritesAccessLinkIssuedAt(): void
    {
        $booking = new AccommodationBooking();
        $booking->setEmail('[email protected]');
@@ -190,7 +190,7 @@ class AccommodationBookingServiceTest extends TestCase
        $breakdownCalculator->method('compute')->willReturn(null);

        $mailer = $this->createMock(Mailer::class);
-        $mailer->expects(self::once())->method('createAndSendEmail');
+        $mailer->expects(self::never())->method('createAndSendEmail');

        $service = $this->createServiceWithAccommodation(
            entityManager: $entityManager,
@@ -198,7 +198,7 @@ class AccommodationBookingServiceTest extends TestCase
            breakdownCalculator: $breakdownCalculator,
        );

-        $service->regenerateAccessLinkAndNotifyCustomer($booking);
+        $service->regenerateAccessLink($booking);

        self::assertNotSame($previousIssuedAt, $booking->getAccessLinkIssuedAt());
    }
@@ -234,6 +234,39 @@ class AccommodationBookingServiceTest extends TestCase
        self::assertNull($booking->getAcceptedAt());
    }

+    public function testRefreshPriceSnapshotStoresDiscountedFinalTotal(): void
+    {
+        $booking = new AccommodationBooking();
+        $booking->setAccommodationDiscount(10);
+        $booking->setBoardServiceDiscount(20);
+        $booking->setAdditionalServicesDiscount(50);
+
+        $breakdown = [
+            'total' => 12345,
+            'currency' => 'CHF',
+            'basePrice' => 8000,
+            'additionalPersonsPrice' => 2000,
+            'boardPrice' => 1000,
+            'servicesPrice' => 500,
+        ];
+
+        $breakdownCalculator = $this->createMock(AccommodationBookingBreakdownCalculator::class);
+        $breakdownCalculator
+            ->expects(self::once())
+            ->method('computeCurrent')
+            ->with($booking)
+            ->willReturn($breakdown);
+
+        $service = $this->createServiceWithAccommodation(breakdownCalculator: $breakdownCalculator);
+        $service->refreshPriceSnapshot($booking);
+
+        // accommodation: (8000+2000)*10% = 1000, board: 1000*20% = 200, services: 500*50% = 250
+        self::assertSame($breakdown, $booking->getPriceBreakdown());
+        self::assertSame(12345 - 1000 - 200 - 250, $booking->getTotalPrice());
+        self::assertSame('CHF', $booking->getPricingCurrency());
+        self::assertSame(1, $booking->getPricingVersion());
+    }
+
    /**
     * @param AccommodationPrice[] $prices
     */