feat: local password hashes

tests/BusProNet/ApiClientPersonalDataRequestTest.php

@@ -0,0 +1,96 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\BusProNet;
+
+use App\BusProNet\ApiClient;
+use App\BusProNet\DataProcessor\BookingDataProcessor;
+use App\BusProNet\XmlParser\ApiResponseParser;
+use App\Service\RequestIdGenerator;
+use League\Flysystem\FilesystemOperator;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\Serializer\Encoder\XmlEncoder;
+use Symfony\Component\Serializer\Serializer;
+use Symfony\Component\Serializer\SerializerInterface;
+
+class ApiClientPersonalDataRequestTest extends TestCase
+{
+    public function testPersonalDataRequestUsesLoginFlagAndAddressIdentifiers(): void
+    {
+        $apiClient = $this->createApiClient();
+        $payload = $this->invokeBuildPersonalDataRequestData($apiClient, '[email protected]', 'Adressdaten', 123, 456);
+        $xml = $this->serializePayload($payload);
+
+        self::assertStringContainsString('<login>J</login>', $xml);
+        self::assertStringNotContainsString('<passwort>', $xml);
+        self::assertStringContainsString('<email>[email protected]</email>', $xml);
+        self::assertStringContainsString('<idadresse>123</idadresse>', $xml);
+        self::assertStringContainsString('<idadresseperson>456</idadresseperson>', $xml);
+    }
+
+    public function testPersonalDataRequestOmitsOptionalIdentifiersWhenNotProvided(): void
+    {
+        $apiClient = $this->createApiClient();
+        $payload = $this->invokeBuildPersonalDataRequestData($apiClient, '[email protected]', 'Adressdaten');
+        $xml = $this->serializePayload($payload);
+
+        self::assertStringContainsString('<login>J</login>', $xml);
+        self::assertStringNotContainsString('<passwort>', $xml);
+        self::assertStringContainsString('<email>[email protected]</email>', $xml);
+        self::assertStringNotContainsString('<idadresse>', $xml);
+        self::assertStringNotContainsString('<idadresseperson>', $xml);
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    private function invokeBuildPersonalDataRequestData(
+        ApiClient $apiClient,
+        string $email,
+        string $art,
+        ?int $addressId = null,
+        ?int $personId = null
+    ): array
+    {
+        $method = new \ReflectionMethod(ApiClient::class, 'buildCustomerDataRequestData');
+        $method->setAccessible(true);
+
+        /** @var array<string, mixed> $payload */
+        $payload = $method->invoke($apiClient, $email, $art, $addressId, $personId);
+
+        return $payload;
+    }
+
+    /**
+     * @param array<string, mixed> $payload
+     */
+    private function serializePayload(array $payload): string
+    {
+        return (new Serializer([], [new XmlEncoder()]))->serialize($payload, 'xml', [
+            XmlEncoder::ROOT_NODE_NAME => 'anfrage',
+            XmlEncoder::ENCODING => 'UTF-8',
+        ]);
+    }
+
+    private function createApiClient(): ApiClient
+    {
+        return new ApiClient(
+            $this->createMock(SerializerInterface::class),
+            $this->createMock(ApiResponseParser::class),
+            $this->createMock(FilesystemOperator::class),
+            $this->createMock(LoggerInterface::class),
+            $this->createMock(BookingDataProcessor::class),
+            new RequestStack(),
+            new RequestIdGenerator(),
+            [
+                'bpn_username' => 'test-user',
+                'bpn_password' => 'test-password',
+                'bpn_api_ip' => '127.0.0.1',
+                'bpn_api_ports' => [9000],
+            ],
+        );
+    }
+}

tests/Controller/Account/PersonalDataControllerTest.php

@@ -9,7 +9,6 @@ use App\BusProNet\Model\PersonalData;
 use App\Controller\Account\PersonalDataController;
 use App\Entity\User;
 use App\Model\NewsletterSubscriptionRequestResult;
-use App\Security\Crypt;
 use App\Service\BookingEditDataLoader;
 use App\Service\NewsletterManager;
 use App\Service\ProfileCompletenessChecker;
@@ -30,7 +29,7 @@ class PersonalDataControllerTest extends TestCase
         $controller->apiClient
             ->expects(self::once())
             ->method('getPersonalData')
-            ->with('[email protected]', 'secret')
+            ->with('[email protected]', null, null)
             ->willReturn($this->createPersonalData('Mia', 'Muster'));
 
         $controller->newsletterManager
@@ -58,7 +57,7 @@ class PersonalDataControllerTest extends TestCase
         $controller->apiClient
             ->expects(self::once())
             ->method('getPersonalData')
-            ->with('[email protected]', 'secret')
+            ->with('[email protected]', null, null)
             ->willReturn($this->createPersonalData('Mia', 'Muster'));
 
         $controller->newsletterManager
@@ -85,7 +84,7 @@ class PersonalDataControllerTest extends TestCase
         $controller->apiClient
             ->expects(self::once())
             ->method('getPersonalData')
-            ->with('[email protected]', 'secret')
+            ->with('[email protected]', null, null)
             ->willReturn($this->createPersonalData('Mia', 'Muster'));
 
         $controller->newsletterManager
@@ -125,7 +124,7 @@ class PersonalDataControllerTest extends TestCase
         $controller->apiClient
             ->expects(self::once())
             ->method('getPersonalData')
-            ->with('[email protected]', 'secret')
+            ->with('[email protected]', null, null)
             ->willReturn($this->createPersonalData('Mia', 'Muster'));
 
         $controller->newsletterManager
@@ -157,12 +156,6 @@ class PersonalDataControllerTest extends TestCase
 
         $apiClient = $this->createMock(ApiClient::class);
 
-        $crypt = $this->createMock(Crypt::class);
-        $crypt
-            ->method('decrypt')
-            ->with('secret')
-            ->willReturn('secret');
-
         $form = $this->createMock(FormInterface::class);
         $form
             ->method('handleRequest')
@@ -173,7 +166,6 @@ class PersonalDataControllerTest extends TestCase
 
         return new TestablePersonalDataController(
             $apiClient,
-            $crypt,
             $this->createMock(BookingEditDataLoader::class),
             $this->createMock(ProfileCompletenessChecker::class),
             $this->createMock(EntityManagerInterface::class),
@@ -210,7 +202,6 @@ final class TestablePersonalDataController extends PersonalDataController
 
     public function __construct(
         public readonly ApiClient $apiClient,
-        Crypt $crypt,
         BookingEditDataLoader $dataLoader,
         ProfileCompletenessChecker $completenessChecker,
         EntityManagerInterface $entityManager,
@@ -221,7 +212,6 @@ final class TestablePersonalDataController extends PersonalDataController
     ) {
         parent::__construct(
             $apiClient,
-            $crypt,
             $dataLoader,
             $completenessChecker,
             $entityManager,

tests/Security/BpnAuthenticatorTest.php

@@ -0,0 +1,222 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Security;
+
+use App\BusProNet\ApiClient;
+use App\BusProNet\Model\CrmAttributes;
+use App\BusProNet\Model\PersonalData;
+use App\Entity\User;
+use App\Security\BpnAuthenticator;
+use App\Security\Crypt;
+use Doctrine\ORM\EntityManagerInterface;
+use Doctrine\ORM\EntityRepository;
+use PHPUnit\Framework\TestCase;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
+use App\Service\ProfileCompletenessChecker;
+
+class BpnAuthenticatorTest extends TestCase
+{
+    public function testAuthenticateAcceptsLocalPasswordHashWithoutLegacyDecryption(): void
+    {
+        $user = new User('[email protected]');
+        $user->setPassword(password_hash('secret', PASSWORD_BCRYPT));
+
+        $passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
+        $passwordHasher
+            ->expects(self::once())
+            ->method('isPasswordValid')
+            ->with($user, 'secret')
+            ->willReturn(true);
+
+        $authenticator = $this->createAuthenticator(
+            user: $user,
+            passwordHasher: $passwordHasher,
+        );
+
+        $passport = $authenticator->authenticate($this->createRequest('[email protected]', 'secret'));
+
+        self::assertInstanceOf(SelfValidatingPassport::class, $passport);
+    }
+
+    public function testAuthenticateMigratesLegacyPasswordToLocalHashOnSuccess(): void
+    {
+        $user = new User('[email protected]');
+        $user->setPassword(base64_encode('legacy-ciphertext'));
+
+        $crypt = $this->createMock(Crypt::class);
+        $crypt
+            ->expects(self::once())
+            ->method('decrypt')
+            ->with('legacy-ciphertext')
+            ->willReturn(md5('secret'));
+
+        $passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
+        $passwordHasher
+            ->expects(self::never())
+            ->method('isPasswordValid');
+        $passwordHasher
+            ->expects(self::once())
+            ->method('hashPassword')
+            ->with($user, 'secret')
+            ->willReturn('local-hash');
+
+        $authenticator = $this->createAuthenticator(
+            user: $user,
+            crypt: $crypt,
+            passwordHasher: $passwordHasher,
+        );
+
+        $passport = $authenticator->authenticate($this->createRequest('[email protected]', 'secret'));
+
+        self::assertInstanceOf(SelfValidatingPassport::class, $passport);
+        self::assertSame('local-hash', $user->getPassword());
+    }
+
+    public function testAuthenticateBootstrapsMissingUserFromBpn(): void
+    {
+        $email = '[email protected]';
+        $password = 'secret';
+
+        $personalData = new PersonalData();
+        $personalData->addressId = 123;
+        $personalData->personId = 456;
+        $personalData->firstName = 'Mia';
+        $personalData->name = 'Muster';
+        $personalData->gender = 'W';
+        $personalData->nationality = 'DE';
+        $personalData->dateOfBirth = new \DateTimeImmutable('1990-05-15');
+        $personalData->communication->email = $email;
+        $personalData->communication->mobile = '+49123456789';
+        $personalData->address->street = 'Main Street 1';
+        $personalData->address->postCode = '10115';
+        $personalData->address->city = 'Berlin';
+        $personalData->address->country = 'DE';
+
+        $crmAttributes = new CrmAttributes();
+        $crmAttributes->roles = ['ROLE_CUSTOMER'];
+        $crmAttributes->hotelCodes = ['AAA'];
+
+        $apiClient = $this->createMock(ApiClient::class);
+        $apiClient->expects(self::once())
+            ->method('getPersonalDataWithPassword')
+            ->with($email, $password)
+            ->willReturn($personalData);
+        $apiClient->expects(self::once())
+            ->method('getCrmAttributesWithPassword')
+            ->with($email, $password)
+            ->willReturn($crmAttributes);
+
+        $passwordHasher = $this->createMock(UserPasswordHasherInterface::class);
+        $passwordHasher
+            ->expects(self::once())
+            ->method('hashPassword')
+            ->with(self::isInstanceOf(User::class), $password)
+            ->willReturn('local-hash');
+
+        $completenessChecker = $this->createMock(ProfileCompletenessChecker::class);
+        $completenessChecker
+            ->expects(self::once())
+            ->method('isComplete')
+            ->with($personalData)
+            ->willReturn(true);
+
+        $persistedUser = null;
+        $repository = $this->createMock(EntityRepository::class);
+        $repository
+            ->expects(self::once())
+            ->method('findOneBy')
+            ->with(['email' => $email])
+            ->willReturn(null);
+
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager
+            ->method('getRepository')
+            ->willReturn($repository);
+        $entityManager
+            ->expects(self::once())
+            ->method('persist')
+            ->with(self::callback(static function (User $user) use (&$persistedUser): bool {
+                $persistedUser = $user;
+
+                return true;
+            }));
+        $entityManager
+            ->expects(self::once())
+            ->method('flush');
+
+        $authenticator = new BpnAuthenticator(
+            $this->createMock(UrlGeneratorInterface::class),
+            $apiClient,
+            $entityManager,
+            $this->createMock(Crypt::class),
+            $completenessChecker,
+            $passwordHasher,
+            $this->createMock(LoggerInterface::class),
+        );
+
+        $passport = $authenticator->authenticate($this->createRequest($email, $password));
+
+        self::assertInstanceOf(SelfValidatingPassport::class, $passport);
+        self::assertInstanceOf(User::class, $persistedUser);
+        self::assertSame('local-hash', $persistedUser->getPassword());
+        self::assertSame(123, $persistedUser->getAddressId());
+        self::assertSame(456, $persistedUser->getPersonId());
+        self::assertSame(['ROLE_USER', 'ROLE_CUSTOMER'], $persistedUser->getRoles());
+        self::assertSame(['AAA'], $persistedUser->getHotelCodes());
+        self::assertTrue($persistedUser->isProfileComplete());
+    }
+
+    private function createAuthenticator(
+        ?User $user = null,
+        ?ApiClient $apiClient = null,
+        ?Crypt $crypt = null,
+        ?ProfileCompletenessChecker $completenessChecker = null,
+        ?UserPasswordHasherInterface $passwordHasher = null,
+    ): BpnAuthenticator {
+        $repository = $this->createMock(EntityRepository::class);
+        $repository
+            ->expects(self::once())
+            ->method('findOneBy')
+            ->with(self::callback(static function (array $criteria): bool {
+                return isset($criteria['email']) && is_string($criteria['email']);
+            }))
+            ->willReturn($user);
+
+        $entityManager = $this->createMock(EntityManagerInterface::class);
+        $entityManager
+            ->method('getRepository')
+            ->with(User::class)
+            ->willReturn($repository);
+        $entityManager
+            ->expects(self::once())
+            ->method('flush');
+        $entityManager
+            ->expects(null === $user ? self::once() : self::never())
+            ->method('persist');
+
+        return new BpnAuthenticator(
+            $this->createMock(UrlGeneratorInterface::class),
+            $apiClient ?? $this->createMock(ApiClient::class),
+            $entityManager,
+            $crypt ?? $this->createMock(Crypt::class),
+            $completenessChecker ?? $this->createMock(ProfileCompletenessChecker::class),
+            $passwordHasher ?? $this->createMock(UserPasswordHasherInterface::class),
+            $this->createMock(LoggerInterface::class),
+        );
+    }
+
+    private function createRequest(string $email, string $password): Request
+    {
+        return Request::create('/login', Request::METHOD_POST, [
+            '_username' => $email,
+            '_password' => $password,
+            '_csrf_token' => 'csrf-token',
+        ]);
+    }
+}

tests/Service/ParticipantDataPrefillerTest.php

@@ -12,7 +12,6 @@ use App\BusProNet\Model\PersonalData;
 use App\Entity\User;
 use App\Form\Model\BookingDto;
 use App\Form\Model\ParticipantDto;
-use App\Security\Crypt;
 use App\Service\ParticipantDataPrefiller;
 use Carbon\CarbonImmutable;
 use PHPUnit\Framework\TestCase;
@@ -21,19 +20,16 @@ use Psr\Log\LoggerInterface;
 class ParticipantDataPrefillerTest extends TestCase
 {
     private ApiClient $apiClient;
-    private Crypt $crypt;
     private LoggerInterface $logger;
     private ParticipantDataPrefiller $service;
 
     protected function setUp(): void
     {
         $this->apiClient = $this->createMock(ApiClient::class);
-        $this->crypt = $this->createMock(Crypt::class);
         $this->logger = $this->createMock(LoggerInterface::class);
 
         $this->service = new ParticipantDataPrefiller(
             $this->apiClient,
-            $this->crypt,
             $this->logger
         );
     }
@@ -46,14 +42,9 @@ class ParticipantDataPrefillerTest extends TestCase
 
         $personalData = $this->createCompletePersonalData();
 
-        $this->crypt->expects($this->once())
-            ->method('decrypt')
-            ->with('encrypted_password')
-            ->willReturn('decrypted_password');
-
         $this->apiClient->expects($this->once())
             ->method('getPersonalData')
-            ->with('[email protected]', 'decrypted_password')
+            ->with('[email protected]', null, null)
             ->willReturn($personalData);
 
         $result = $this->service->prefillApplicantFromUser($user, $applicant);
@@ -94,12 +85,9 @@ class ParticipantDataPrefillerTest extends TestCase
 
         $personalData = $this->createPartialPersonalData();
 
-        $this->crypt->expects($this->once())
-            ->method('decrypt')
-            ->willReturn('decrypted_password');
-
         $this->apiClient->expects($this->once())
             ->method('getPersonalData')
+            ->with('[email protected]', null, null)
             ->willReturn($personalData);
 
         $result = $this->service->prefillApplicantFromUser($user, $applicant);
@@ -129,12 +117,9 @@ class ParticipantDataPrefillerTest extends TestCase
 
         $notification = new Notification(401, 'Authentication failed');
 
-        $this->crypt->expects($this->once())
-            ->method('decrypt')
-            ->willReturn('decrypted_password');
-
         $this->apiClient->expects($this->once())
             ->method('getPersonalData')
+            ->with('[email protected]', null, null)
             ->willReturn($notification);
 
         $this->logger->expects($this->once())
@@ -156,46 +141,15 @@ class ParticipantDataPrefillerTest extends TestCase
         $this->assertNull($result->email);
     }
 
-    public function testPrepopulateApplicantWithDecryptionException(): void
-    {
-        $user = $this->createUser('[email protected]', 'encrypted_password');
-        $applicant = new ParticipantDto();
-        $applicant->index = 0;
-
-        $this->crypt->expects($this->once())
-            ->method('decrypt')
-            ->willThrowException(new \RuntimeException('Decryption failed'));
-
-        $this->apiClient->expects($this->never())
-            ->method('getPersonalData');
-
-        $this->logger->expects($this->once())
-            ->method('error')
-            ->with('Exception during applicant prepopulation', [
-                'error' => 'Decryption failed',
-                'email' => '[email protected]',
-            ]);
-
-        $result = $this->service->prefillApplicantFromUser($user, $applicant);
-
-        // Should return unchanged applicant
-        $this->assertNull($result->firstName);
-        $this->assertNull($result->lastName);
-        $this->assertNull($result->email);
-    }
-
     public function testPrepopulateApplicantWithApiException(): void
     {
         $user = $this->createUser('[email protected]', 'encrypted_password');
         $applicant = new ParticipantDto();
         $applicant->index = 0;
 
-        $this->crypt->expects($this->once())
-            ->method('decrypt')
-            ->willReturn('decrypted_password');
-
         $this->apiClient->expects($this->once())
             ->method('getPersonalData')
+            ->with('[email protected]', null, null)
             ->willThrowException(new \RuntimeException('API connection failed'));
 
         $this->logger->expects($this->once())
@@ -223,12 +177,9 @@ class ParticipantDataPrefillerTest extends TestCase
 
         $personalData = $this->createCompletePersonalData();
 
-        $this->crypt->expects($this->once())
-            ->method('decrypt')
-            ->willReturn('decrypted_password');
-
         $this->apiClient->expects($this->once())
             ->method('getPersonalData')
+            ->with('[email protected]', null, null)
             ->willReturn($personalData);
 
         $result = $this->service->prefillApplicantFromUser($user, $applicant);