myep/tests/Controller/Admin/User/ApproveRoleControllerTest.php

<?php

declare(strict_types=1);

namespace App\Tests\Controller\Admin\User;

use App\Controller\Admin\User\ApproveRoleController;
use App\Entity\User;
use App\Security\Role;
use Doctrine\ORM\EntityManagerInterface;
use PHPUnit\Framework\TestCase;
use Psr\Log\LoggerInterface;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage;
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
use Symfony\Component\Security\Core\User\UserInterface;
use Symfony\Component\Security\Http\Authenticator\Token\PostAuthenticationToken;

/**
 * Covers the guards around approving a nomination — the only way a role is ever granted here.
 */
class ApproveRoleControllerTest extends TestCase
{
    public function testGetRendersTheConfirmationModal(): void
    {
        $user = $this->nominatedUser();

        $entityManager = $this->createMock(EntityManagerInterface::class);
        $entityManager->expects(self::never())->method('flush');

        $controller = new TestableApproveRoleController($entityManager, $this->createStub(LoggerInterface::class));

        $response = $controller->index($user, Role::GROUPS_ADMIN, Request::create('/admin/user/1/approve/ROLE_GROUPS_ADMIN'));

        self::assertSame(Response::HTTP_OK, $response->getStatusCode());
        self::assertSame('admin/user/modal_approve_role.html.twig', $controller->renderedView);
        self::assertSame([Role::TEAMER, Role::pending(Role::GROUPS_ADMIN)], Role::assignedOnly($user->getRoles()));
    }

    public function testPostGrantsTheRoleAndRedirectsTheBrowser(): void
    {
        $user = $this->nominatedUser();

        $entityManager = $this->createMock(EntityManagerInterface::class);
        $entityManager->expects(self::once())->method('flush');

        $controller = new TestableApproveRoleController($entityManager, $this->createStub(LoggerInterface::class));

        $response = $controller->index($user, Role::GROUPS_ADMIN, Request::create('/admin/user/1/approve/ROLE_GROUPS_ADMIN', 'POST'));

        self::assertSame([Role::TEAMER, Role::GROUPS_ADMIN], Role::assignedOnly($user->getRoles()));
        self::assertTrue($response->headers->has('HX-Redirect'));
        self::assertSame(['success'], array_column($controller->flashes, 'type'));
    }

    public function testARoleTheCrmNeverClaimedCannotBeApproved(): void
    {
        $entityManager = $this->createMock(EntityManagerInterface::class);
        $entityManager->expects(self::never())->method('flush');

        $controller = new TestableApproveRoleController($entityManager, $this->createStub(LoggerInterface::class));

        $this->expectException(NotFoundHttpException::class);

        // ROLE_ADMIN is not nominated, so no hand-crafted request can grant it.
        $controller->index($this->nominatedUser(), Role::ADMIN, Request::create('/admin/user/1/approve/ROLE_ADMIN', 'POST'));
    }

    public function testApprovingRoleAdminForYourOwnAccountIsRefused(): void
    {
        $user = (new User('[email protected]'))->setRoles([Role::ADMIN, Role::pending(Role::ADMIN)]);

        $entityManager = $this->createMock(EntityManagerInterface::class);
        $entityManager->expects(self::never())->method('flush');

        $controller = new TestableApproveRoleController($entityManager, $this->createStub(LoggerInterface::class), currentUser: $user);

        $this->expectException(AccessDeniedException::class);

        $controller->index($user, Role::ADMIN, Request::create('/admin/user/1/approve/ROLE_ADMIN', 'POST'));
    }

    public function testApprovingALesserRoleForYourOwnAccountIsAllowed(): void
    {
        $user = $this->nominatedUser();

        $entityManager = $this->createMock(EntityManagerInterface::class);
        $entityManager->expects(self::once())->method('flush');

        $controller = new TestableApproveRoleController($entityManager, $this->createStub(LoggerInterface::class), currentUser: $user);

        // Only ROLE_ADMIN needs a second pair of eyes — an approver already holds it, so the
        // rest grant less than they could grant themselves anyway.
        $controller->index($user, Role::GROUPS_ADMIN, Request::create('/admin/user/1/approve/ROLE_GROUPS_ADMIN', 'POST'));

        self::assertSame([Role::TEAMER, Role::GROUPS_ADMIN], Role::assignedOnly($user->getRoles()));
    }

    public function testPostWithAnInvalidTokenIsDenied(): void
    {
        $entityManager = $this->createMock(EntityManagerInterface::class);
        $entityManager->expects(self::never())->method('flush');

        $controller = new TestableApproveRoleController($entityManager, $this->createStub(LoggerInterface::class), tokenValid: false);

        $this->expectException(AccessDeniedException::class);

        $controller->index($this->nominatedUser(), Role::GROUPS_ADMIN, Request::create('/admin/user/1/approve/ROLE_GROUPS_ADMIN', 'POST'));
    }

    public function testApprovingForYourselfReissuesTheSecurityToken(): void
    {
        $user = $this->nominatedUser();

        $tokenStorage = new TokenStorage();
        $tokenStorage->setToken(new PostAuthenticationToken($user, 'main', $user->getRoles()));

        $controller = new TestableApproveRoleController(
            $this->createStub(EntityManagerInterface::class),
            $this->createStub(LoggerInterface::class),
            currentUser: $user,
            tokenStorage: $tokenStorage,
        );

        $controller->index($user, Role::GROUPS_ADMIN, Request::create('/admin/user/1/approve/ROLE_GROUPS_ADMIN', 'POST'));

        // Without this the next request would find the stored roles out of step with the token
        // and end the session, logging the approver out mid-action.
        self::assertContains(Role::GROUPS_ADMIN, $tokenStorage->getToken()?->getRoleNames() ?? []);
        self::assertNotContains(Role::pending(Role::GROUPS_ADMIN), $tokenStorage->getToken()?->getRoleNames() ?? []);
    }

    public function testApprovingForSomebodyElseLeavesYourOwnTokenAlone(): void
    {
        $other = $this->nominatedUser();

        $tokenStorage = new TokenStorage();
        $admin = (new User('[email protected]'))->setRoles([Role::ADMIN]);
        $tokenStorage->setToken($originalToken = new PostAuthenticationToken($admin, 'main', $admin->getRoles()));

        $controller = new TestableApproveRoleController(
            $this->createStub(EntityManagerInterface::class),
            $this->createStub(LoggerInterface::class),
            currentUser: $admin,
            tokenStorage: $tokenStorage,
        );

        $controller->index($other, Role::GROUPS_ADMIN, Request::create('/admin/user/1/approve/ROLE_GROUPS_ADMIN', 'POST'));

        self::assertSame($originalToken, $tokenStorage->getToken());
    }

    private function nominatedUser(): User
    {
        return (new User('[email protected]'))->setRoles([Role::TEAMER, Role::pending(Role::GROUPS_ADMIN)]);
    }
}

final class TestableApproveRoleController extends ApproveRoleController
{
    public ?string $renderedView = null;

    /** @var list<array{type: string, message: mixed}> */
    public array $flashes = [];

    public function __construct(
        EntityManagerInterface $entityManager,
        LoggerInterface $logger,
        private readonly bool $tokenValid = true,
        private readonly ?UserInterface $currentUser = null,
        public readonly TokenStorageInterface $tokenStorage = new TokenStorage(),
    ) {
        parent::__construct($entityManager, $logger, $this->tokenStorage);
    }

    protected function getUser(): ?UserInterface
    {
        return $this->currentUser;
    }

    protected function isCsrfTokenValid(string $id, #[\SensitiveParameter] ?string $token): bool
    {
        return $this->tokenValid;
    }

    /**
     * @param array<string, mixed> $parameters
     */
    protected function render(string $view, array $parameters = [], ?Response $response = null): Response
    {
        $this->renderedView = $view;

        return new Response();
    }

    protected function addFlash(string $type, mixed $message): void
    {
        $this->flashes[] = ['type' => $type, 'message' => $message];
    }

    /**
     * @param array<string, mixed> $parameters
     */
    public function generateUrl(string $route, array $parameters = [], int $referenceType = 1): string
    {
        return '/'.$route.'?'.http_build_query($parameters);
    }
}