feat: derive ROLE_EMPLOYEE from the account's email domain

2026-09-13 12:49:51 +02:00
parent 443a3ed248
commit fab89dead6
7 changed files with 221 additions and 8 deletions
@@ -0,0 +1,56 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security;
+
+use App\Security\EmployeeDomainMatcher;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * The domain is matched exactly, never as a suffix: a suffix match would hand ROLE_EMPLOYEE to
+ * anybody able to register a domain ending in the configured one.
+ */
+class EmployeeDomainMatcherTest extends TestCase
+{
+    #[DataProvider('addresses')]
+    public function testRecognisesAnEmployeeAddress(?string $email, bool $expected): void
+    {
+        $matcher = new EmployeeDomainMatcher(['ep-reisen.de']);
+
+        self::assertSame($expected, $matcher->isEmployee($email));
+    }
+
+    /**
+     * @return iterable<string, array{0: ?string, 1: bool}>
+     */
+    public static function addresses(): iterable
+    {
+        yield 'the configured domain' => ['[email protected]', true];
+        yield 'mixed case is still the same domain' => ['[email protected]', true];
+        yield 'plus addressing does not touch the domain' => ['[email protected]', true];
+        yield 'an at sign in the local part' => ['"odd@name"@ep-reisen.de', true];
+
+        yield 'another domain' => ['[email protected]', false];
+        yield 'a subdomain is not the domain' => ['[email protected]', false];
+        yield 'a domain merely ending in it' => ['[email protected]', false];
+        yield 'the domain as a prefix' => ['[email protected]', false];
+        yield 'no at sign at all' => ['ep-reisen.de', false];
+        yield 'empty' => ['', false];
+        yield 'null' => [null, false];
+    }
+
+    public function testWithoutConfiguredDomainsNobodyIsAnEmployee(): void
+    {
+        self::assertFalse((new EmployeeDomainMatcher([]))->isEmployee('[email protected]'));
+    }
+
+    public function testConfiguredDomainsAreNormalised(): void
+    {
+        $matcher = new EmployeeDomainMatcher([' EP-Reisen.DE ', '@example.org']);
+
+        self::assertTrue($matcher->isEmployee('[email protected]'));
+        self::assertTrue($matcher->isEmployee('[email protected]'));
+    }
+}