feat: Gestion des utilisateurs (invitation, blocage, déblocage)

Permet aux administrateurs d'un établissement de gérer le cycle de vie des comptes utilisateurs : inviter de nouveaux membres, bloquer/débloquer des comptes actifs, et renvoyer des invitations en attente. Chaque mutation vérifie l'appartenance au tenant courant pour empêcher les accès cross-tenant. Le blocage est restreint aux comptes actifs uniquement et un administrateur ne peut pas bloquer son propre compte. Les comptes suspendus reçoivent une erreur 403 spécifique au login (sans déclencher l'escalade du rate limiting) et les tentatives sont tracées dans les métriques Prometheus.
2026-02-07 16:44:30 +01:00
parent ff18850a43
commit 4005c70082
58 changed files with 4443 additions and 29 deletions
--- a/backend/tests/Unit/Administration/Application/Command/BlockUser/BlockUserHandlerTest.php
+++ b/backend/tests/Unit/Administration/Application/Command/BlockUser/BlockUserHandlerTest.php
@@ -0,0 +1,114 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Administration\Application\Command\BlockUser;
+
+use App\Administration\Application\Command\BlockUser\BlockUserCommand;
+use App\Administration\Application\Command\BlockUser\BlockUserHandler;
+use App\Administration\Domain\Exception\UserNotFoundException;
+use App\Administration\Domain\Exception\UtilisateurNonBlocableException;
+use App\Administration\Domain\Model\User\Email;
+use App\Administration\Domain\Model\User\Role;
+use App\Administration\Domain\Model\User\StatutCompte;
+use App\Administration\Domain\Model\User\User;
+use App\Administration\Domain\Model\User\UserId;
+use App\Administration\Domain\Policy\ConsentementParentalPolicy;
+use App\Administration\Infrastructure\Persistence\InMemory\InMemoryUserRepository;
+use App\Shared\Domain\Clock;
+use App\Shared\Domain\Tenant\TenantId;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+final class BlockUserHandlerTest extends TestCase
+{
+    private const string TENANT_ID = '550e8400-e29b-41d4-a716-446655440002';
+
+    private InMemoryUserRepository $userRepository;
+    private Clock $clock;
+    private BlockUserHandler $handler;
+
+    protected function setUp(): void
+    {
+        $this->userRepository = new InMemoryUserRepository();
+        $this->clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-02-10 15:00:00');
+            }
+        };
+        $this->handler = new BlockUserHandler($this->userRepository, $this->clock);
+    }
+
+    #[Test]
+    public function blocksUserSuccessfully(): void
+    {
+        $user = User::inviter(
+            email: new Email('teacher@example.com'),
+            role: Role::PROF,
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            schoolName: 'École Alpha',
+            firstName: 'Jean',
+            lastName: 'Dupont',
+            invitedAt: new DateTimeImmutable('2026-02-01 10:00:00'),
+        );
+        $user->activer(
+            '$argon2id$hashed',
+            new DateTimeImmutable('2026-02-02 10:00:00'),
+            new ConsentementParentalPolicy($this->clock),
+        );
+        $this->userRepository->save($user);
+
+        $command = new BlockUserCommand(
+            userId: (string) $user->id,
+            reason: 'Comportement inapproprié',
+        );
+
+        ($this->handler)($command);
+
+        $updated = $this->userRepository->get($user->id);
+        self::assertSame(StatutCompte::SUSPENDU, $updated->statut);
+        self::assertSame('Comportement inapproprié', $updated->blockedReason);
+        self::assertNotNull($updated->blockedAt);
+    }
+
+    #[Test]
+    public function throwsWhenUserAlreadySuspendu(): void
+    {
+        $user = User::inviter(
+            email: new Email('teacher@example.com'),
+            role: Role::PROF,
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            schoolName: 'École Alpha',
+            firstName: 'Jean',
+            lastName: 'Dupont',
+            invitedAt: new DateTimeImmutable('2026-02-01 10:00:00'),
+        );
+        $user->activer(
+            '$argon2id$hashed',
+            new DateTimeImmutable('2026-02-02 10:00:00'),
+            new ConsentementParentalPolicy($this->clock),
+        );
+        $user->bloquer('Première raison', new DateTimeImmutable('2026-02-08 10:00:00'));
+        $this->userRepository->save($user);
+
+        $this->expectException(UtilisateurNonBlocableException::class);
+
+        ($this->handler)(new BlockUserCommand(
+            userId: (string) $user->id,
+            reason: 'Seconde raison',
+        ));
+    }
+
+    #[Test]
+    public function throwsWhenUserNotFound(): void
+    {
+        $this->expectException(UserNotFoundException::class);
+
+        ($this->handler)(new BlockUserCommand(
+            userId: (string) UserId::generate(),
+            reason: 'Raison',
+        ));
+    }
+}
--- a/backend/tests/Unit/Administration/Application/Command/InviteUser/InviteUserHandlerTest.php
+++ b/backend/tests/Unit/Administration/Application/Command/InviteUser/InviteUserHandlerTest.php
@@ -0,0 +1,109 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Administration\Application\Command\InviteUser;
+
+use App\Administration\Application\Command\InviteUser\InviteUserCommand;
+use App\Administration\Application\Command\InviteUser\InviteUserHandler;
+use App\Administration\Domain\Exception\EmailDejaUtiliseeException;
+use App\Administration\Domain\Model\User\Email;
+use App\Administration\Domain\Model\User\Role;
+use App\Administration\Domain\Model\User\StatutCompte;
+use App\Administration\Domain\Model\User\User;
+use App\Administration\Infrastructure\Persistence\InMemory\InMemoryUserRepository;
+use App\Shared\Domain\Clock;
+use App\Shared\Domain\Tenant\TenantId;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+final class InviteUserHandlerTest extends TestCase
+{
+    private const string TENANT_ID = '550e8400-e29b-41d4-a716-446655440002';
+    private const string SCHOOL_NAME = 'École Alpha';
+
+    private InMemoryUserRepository $userRepository;
+    private Clock $clock;
+    private InviteUserHandler $handler;
+
+    protected function setUp(): void
+    {
+        $this->userRepository = new InMemoryUserRepository();
+        $this->clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-02-07 10:00:00');
+            }
+        };
+        $this->handler = new InviteUserHandler($this->userRepository, $this->clock);
+    }
+
+    #[Test]
+    public function invitesUserSuccessfully(): void
+    {
+        $command = new InviteUserCommand(
+            tenantId: self::TENANT_ID,
+            schoolName: self::SCHOOL_NAME,
+            email: 'teacher@example.com',
+            role: Role::PROF->value,
+            firstName: 'Jean',
+            lastName: 'Dupont',
+        );
+
+        $user = ($this->handler)($command);
+
+        self::assertSame(StatutCompte::EN_ATTENTE, $user->statut);
+        self::assertSame('Jean', $user->firstName);
+        self::assertSame('Dupont', $user->lastName);
+        self::assertSame('teacher@example.com', (string) $user->email);
+        self::assertNotNull($user->invitedAt);
+    }
+
+    #[Test]
+    public function throwsWhenEmailAlreadyUsedInTenant(): void
+    {
+        // Pre-populate with existing user
+        $existingUser = User::inviter(
+            email: new Email('teacher@example.com'),
+            role: Role::PROF,
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            schoolName: self::SCHOOL_NAME,
+            firstName: 'Existing',
+            lastName: 'User',
+            invitedAt: new DateTimeImmutable('2026-02-01 10:00:00'),
+        );
+        $this->userRepository->save($existingUser);
+
+        $command = new InviteUserCommand(
+            tenantId: self::TENANT_ID,
+            schoolName: self::SCHOOL_NAME,
+            email: 'teacher@example.com',
+            role: Role::PROF->value,
+            firstName: 'Jean',
+            lastName: 'Dupont',
+        );
+
+        $this->expectException(EmailDejaUtiliseeException::class);
+
+        ($this->handler)($command);
+    }
+
+    #[Test]
+    public function savesUserToRepository(): void
+    {
+        $command = new InviteUserCommand(
+            tenantId: self::TENANT_ID,
+            schoolName: self::SCHOOL_NAME,
+            email: 'teacher@example.com',
+            role: Role::PROF->value,
+            firstName: 'Jean',
+            lastName: 'Dupont',
+        );
+
+        $user = ($this->handler)($command);
+
+        $found = $this->userRepository->get($user->id);
+        self::assertSame((string) $user->id, (string) $found->id);
+    }
+}
--- a/backend/tests/Unit/Administration/Application/Command/ResendInvitation/ResendInvitationHandlerTest.php
+++ b/backend/tests/Unit/Administration/Application/Command/ResendInvitation/ResendInvitationHandlerTest.php
@@ -0,0 +1,96 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Administration\Application\Command\ResendInvitation;
+
+use App\Administration\Application\Command\ResendInvitation\ResendInvitationCommand;
+use App\Administration\Application\Command\ResendInvitation\ResendInvitationHandler;
+use App\Administration\Domain\Exception\UserNotFoundException;
+use App\Administration\Domain\Exception\UtilisateurDejaInviteException;
+use App\Administration\Domain\Model\User\Email;
+use App\Administration\Domain\Model\User\Role;
+use App\Administration\Domain\Model\User\User;
+use App\Administration\Domain\Model\User\UserId;
+use App\Administration\Domain\Policy\ConsentementParentalPolicy;
+use App\Administration\Infrastructure\Persistence\InMemory\InMemoryUserRepository;
+use App\Shared\Domain\Clock;
+use App\Shared\Domain\Tenant\TenantId;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+final class ResendInvitationHandlerTest extends TestCase
+{
+    private const string TENANT_ID = '550e8400-e29b-41d4-a716-446655440002';
+
+    private InMemoryUserRepository $userRepository;
+    private Clock $clock;
+    private ResendInvitationHandler $handler;
+
+    protected function setUp(): void
+    {
+        $this->userRepository = new InMemoryUserRepository();
+        $this->clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-02-14 10:00:00');
+            }
+        };
+        $this->handler = new ResendInvitationHandler($this->userRepository, $this->clock);
+    }
+
+    #[Test]
+    public function resendsInvitationSuccessfully(): void
+    {
+        $user = User::inviter(
+            email: new Email('teacher@example.com'),
+            role: Role::PROF,
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            schoolName: 'École Alpha',
+            firstName: 'Jean',
+            lastName: 'Dupont',
+            invitedAt: new DateTimeImmutable('2026-02-01 10:00:00'),
+        );
+        $this->userRepository->save($user);
+
+        $command = new ResendInvitationCommand(userId: (string) $user->id);
+
+        ($this->handler)($command);
+
+        $updated = $this->userRepository->get($user->id);
+        self::assertEquals(new DateTimeImmutable('2026-02-14 10:00:00'), $updated->invitedAt);
+    }
+
+    #[Test]
+    public function throwsWhenUserIsActive(): void
+    {
+        $user = User::inviter(
+            email: new Email('teacher@example.com'),
+            role: Role::PROF,
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            schoolName: 'École Alpha',
+            firstName: 'Jean',
+            lastName: 'Dupont',
+            invitedAt: new DateTimeImmutable('2026-02-01 10:00:00'),
+        );
+        $user->activer(
+            '$argon2id$hashed',
+            new DateTimeImmutable('2026-02-02 10:00:00'),
+            new ConsentementParentalPolicy($this->clock),
+        );
+        $this->userRepository->save($user);
+
+        $this->expectException(UtilisateurDejaInviteException::class);
+
+        ($this->handler)(new ResendInvitationCommand(userId: (string) $user->id));
+    }
+
+    #[Test]
+    public function throwsWhenUserNotFound(): void
+    {
+        $this->expectException(UserNotFoundException::class);
+
+        ($this->handler)(new ResendInvitationCommand(userId: (string) UserId::generate()));
+    }
+}
--- a/backend/tests/Unit/Administration/Application/Command/UnblockUser/UnblockUserHandlerTest.php
+++ b/backend/tests/Unit/Administration/Application/Command/UnblockUser/UnblockUserHandlerTest.php
@@ -0,0 +1,107 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Administration\Application\Command\UnblockUser;
+
+use App\Administration\Application\Command\UnblockUser\UnblockUserCommand;
+use App\Administration\Application\Command\UnblockUser\UnblockUserHandler;
+use App\Administration\Domain\Exception\UserNotFoundException;
+use App\Administration\Domain\Exception\UtilisateurNonDeblocableException;
+use App\Administration\Domain\Model\User\Email;
+use App\Administration\Domain\Model\User\Role;
+use App\Administration\Domain\Model\User\StatutCompte;
+use App\Administration\Domain\Model\User\User;
+use App\Administration\Domain\Model\User\UserId;
+use App\Administration\Domain\Policy\ConsentementParentalPolicy;
+use App\Administration\Infrastructure\Persistence\InMemory\InMemoryUserRepository;
+use App\Shared\Domain\Clock;
+use App\Shared\Domain\Tenant\TenantId;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+final class UnblockUserHandlerTest extends TestCase
+{
+    private const string TENANT_ID = '550e8400-e29b-41d4-a716-446655440002';
+
+    private InMemoryUserRepository $userRepository;
+    private Clock $clock;
+    private UnblockUserHandler $handler;
+
+    protected function setUp(): void
+    {
+        $this->userRepository = new InMemoryUserRepository();
+        $this->clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-02-12 10:00:00');
+            }
+        };
+        $this->handler = new UnblockUserHandler($this->userRepository, $this->clock);
+    }
+
+    #[Test]
+    public function unblocksUserSuccessfully(): void
+    {
+        $user = User::inviter(
+            email: new Email('teacher@example.com'),
+            role: Role::PROF,
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            schoolName: 'École Alpha',
+            firstName: 'Jean',
+            lastName: 'Dupont',
+            invitedAt: new DateTimeImmutable('2026-02-01 10:00:00'),
+        );
+        $user->activer(
+            '$argon2id$hashed',
+            new DateTimeImmutable('2026-02-02 10:00:00'),
+            new ConsentementParentalPolicy($this->clock),
+        );
+        $user->bloquer('Comportement inapproprié', new DateTimeImmutable('2026-02-10 15:00:00'));
+        $this->userRepository->save($user);
+
+        $command = new UnblockUserCommand(
+            userId: (string) $user->id,
+        );
+
+        ($this->handler)($command);
+
+        $updated = $this->userRepository->get($user->id);
+        self::assertSame(StatutCompte::ACTIF, $updated->statut);
+        self::assertNull($updated->blockedAt);
+        self::assertNull($updated->blockedReason);
+    }
+
+    #[Test]
+    public function throwsWhenUserNotSuspendu(): void
+    {
+        $user = User::inviter(
+            email: new Email('teacher@example.com'),
+            role: Role::PROF,
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            schoolName: 'École Alpha',
+            firstName: 'Jean',
+            lastName: 'Dupont',
+            invitedAt: new DateTimeImmutable('2026-02-01 10:00:00'),
+        );
+        $user->activer(
+            '$argon2id$hashed',
+            new DateTimeImmutable('2026-02-02 10:00:00'),
+            new ConsentementParentalPolicy($this->clock),
+        );
+        $this->userRepository->save($user);
+
+        $this->expectException(UtilisateurNonDeblocableException::class);
+
+        ($this->handler)(new UnblockUserCommand(userId: (string) $user->id));
+    }
+
+    #[Test]
+    public function throwsWhenUserNotFound(): void
+    {
+        $this->expectException(UserNotFoundException::class);
+
+        ($this->handler)(new UnblockUserCommand(userId: (string) UserId::generate()));
+    }
+}
--- a/backend/tests/Unit/Administration/Application/Query/GetUsers/GetUsersHandlerTest.php
+++ b/backend/tests/Unit/Administration/Application/Query/GetUsers/GetUsersHandlerTest.php
@@ -0,0 +1,174 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Administration\Application\Query\GetUsers;
+
+use App\Administration\Application\Query\GetUsers\GetUsersHandler;
+use App\Administration\Application\Query\GetUsers\GetUsersQuery;
+use App\Administration\Domain\Model\User\Email;
+use App\Administration\Domain\Model\User\Role;
+use App\Administration\Domain\Model\User\User;
+use App\Administration\Domain\Policy\ConsentementParentalPolicy;
+use App\Administration\Infrastructure\Persistence\InMemory\InMemoryUserRepository;
+use App\Shared\Domain\Clock;
+use App\Shared\Domain\Tenant\TenantId;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+
+final class GetUsersHandlerTest extends TestCase
+{
+    private const string TENANT_ID = '550e8400-e29b-41d4-a716-446655440002';
+    private const string OTHER_TENANT_ID = '550e8400-e29b-41d4-a716-446655440099';
+
+    private InMemoryUserRepository $userRepository;
+    private Clock $clock;
+    private GetUsersHandler $handler;
+
+    protected function setUp(): void
+    {
+        $this->userRepository = new InMemoryUserRepository();
+        $this->clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-02-07 10:00:00');
+            }
+        };
+        $this->handler = new GetUsersHandler($this->userRepository, $this->clock);
+    }
+
+    #[Test]
+    public function returnsAllUsersForTenant(): void
+    {
+        $this->seedUsers();
+
+        $query = new GetUsersQuery(tenantId: self::TENANT_ID);
+        $result = ($this->handler)($query);
+
+        self::assertCount(3, $result);
+    }
+
+    #[Test]
+    public function filtersUsersByRole(): void
+    {
+        $this->seedUsers();
+
+        $query = new GetUsersQuery(
+            tenantId: self::TENANT_ID,
+            role: Role::PROF->value,
+        );
+        $result = ($this->handler)($query);
+
+        self::assertCount(2, $result);
+        foreach ($result as $dto) {
+            self::assertSame(Role::PROF->value, $dto->role);
+        }
+    }
+
+    #[Test]
+    public function filtersUsersByStatut(): void
+    {
+        $this->seedUsers();
+
+        $query = new GetUsersQuery(
+            tenantId: self::TENANT_ID,
+            statut: 'pending',
+        );
+        $result = ($this->handler)($query);
+
+        self::assertCount(2, $result);
+        foreach ($result as $dto) {
+            self::assertSame('pending', $dto->statut);
+        }
+    }
+
+    #[Test]
+    public function excludesUsersFromOtherTenants(): void
+    {
+        $this->seedUsers();
+
+        // Add user to different tenant
+        $otherUser = User::inviter(
+            email: new Email('other@example.com'),
+            role: Role::ADMIN,
+            tenantId: TenantId::fromString(self::OTHER_TENANT_ID),
+            schoolName: 'Autre École',
+            firstName: 'Autre',
+            lastName: 'User',
+            invitedAt: new DateTimeImmutable('2026-02-01 10:00:00'),
+        );
+        $this->userRepository->save($otherUser);
+
+        $query = new GetUsersQuery(tenantId: self::TENANT_ID);
+        $result = ($this->handler)($query);
+
+        self::assertCount(3, $result);
+    }
+
+    #[Test]
+    public function calculatesInvitationExpiree(): void
+    {
+        // Invited 10 days ago — should be expired
+        $user = User::inviter(
+            email: new Email('old@example.com'),
+            role: Role::PROF,
+            tenantId: TenantId::fromString(self::TENANT_ID),
+            schoolName: 'École Alpha',
+            firstName: 'Old',
+            lastName: 'Invitation',
+            invitedAt: new DateTimeImmutable('2026-01-25 10:00:00'),
+        );
+        $this->userRepository->save($user);
+
+        $query = new GetUsersQuery(tenantId: self::TENANT_ID);
+        $result = ($this->handler)($query);
+
+        self::assertCount(1, $result);
+        self::assertTrue($result[0]->invitationExpiree);
+    }
+
+    private function seedUsers(): void
+    {
+        $tenantId = TenantId::fromString(self::TENANT_ID);
+
+        $teacher1 = User::inviter(
+            email: new Email('teacher1@example.com'),
+            role: Role::PROF,
+            tenantId: $tenantId,
+            schoolName: 'École Alpha',
+            firstName: 'Jean',
+            lastName: 'Dupont',
+            invitedAt: new DateTimeImmutable('2026-02-01 10:00:00'),
+        );
+        $this->userRepository->save($teacher1);
+
+        $teacher2 = User::inviter(
+            email: new Email('teacher2@example.com'),
+            role: Role::PROF,
+            tenantId: $tenantId,
+            schoolName: 'École Alpha',
+            firstName: 'Marie',
+            lastName: 'Martin',
+            invitedAt: new DateTimeImmutable('2026-02-01 10:00:00'),
+        );
+        // Activate teacher2
+        $teacher2->activer(
+            '$argon2id$hashed',
+            new DateTimeImmutable('2026-02-02 10:00:00'),
+            new ConsentementParentalPolicy($this->clock),
+        );
+        $this->userRepository->save($teacher2);
+
+        $parent = User::inviter(
+            email: new Email('parent@example.com'),
+            role: Role::PARENT,
+            tenantId: $tenantId,
+            schoolName: 'École Alpha',
+            firstName: 'Pierre',
+            lastName: 'Parent',
+            invitedAt: new DateTimeImmutable('2026-02-01 10:00:00'),
+        );
+        $this->userRepository->save($parent);
+    }
+}