feat: Gestion des utilisateurs (invitation, blocage, déblocage)

Permet aux administrateurs d'un établissement de gérer le cycle de vie des comptes utilisateurs : inviter de nouveaux membres, bloquer/débloquer des comptes actifs, et renvoyer des invitations en attente. Chaque mutation vérifie l'appartenance au tenant courant pour empêcher les accès cross-tenant. Le blocage est restreint aux comptes actifs uniquement et un administrateur ne peut pas bloquer son propre compte. Les comptes suspendus reçoivent une erreur 403 spécifique au login (sans déclencher l'escalade du rate limiting) et les tentatives sont tracées dans les métriques Prometheus.
2026-02-07 16:44:30 +01:00
parent ff18850a43
commit 4005c70082
58 changed files with 4443 additions and 29 deletions
--- a/backend/tests/Unit/Administration/Infrastructure/Security/DatabaseUserProviderTest.php
+++ b/backend/tests/Unit/Administration/Infrastructure/Security/DatabaseUserProviderTest.php
@@ -23,6 +23,7 @@ use PHPUnit\Framework\TestCase;
 use stdClass;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\RequestStack;
+use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException;
 use Symfony\Component\Security\Core\Exception\UserNotFoundException;

 final class DatabaseUserProviderTest extends TestCase
@@ -83,6 +84,22 @@ final class DatabaseUserProviderTest extends TestCase
        $provider->loadUserByIdentifier('user@example.com');
    }

+    #[Test]
+    public function loadUserByIdentifierThrowsAccountStatusExceptionForSuspendedUser(): void
+    {
+        $tenantId = TenantId::fromString(self::TENANT_ALPHA_ID);
+        $domainUser = $this->createUser($tenantId, StatutCompte::SUSPENDU, hashedPassword: '$argon2id$hash');
+
+        $repository = $this->createMock(UserRepository::class);
+        $repository->method('findByEmail')->willReturn($domainUser);
+
+        $provider = $this->createProvider($repository, 'ecole-alpha.classeo.local');
+
+        $this->expectException(CustomUserMessageAccountStatusException::class);
+
+        $provider->loadUserByIdentifier('user@example.com');
+    }
+
    #[Test]
    public function loadUserByIdentifierThrowsForUnknownTenant(): void
    {
--- a/backend/tests/Unit/Administration/Infrastructure/Security/LoginFailureHandlerTest.php
+++ b/backend/tests/Unit/Administration/Infrastructure/Security/LoginFailureHandlerTest.php
@@ -0,0 +1,101 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Administration\Infrastructure\Security;
+
+use App\Administration\Infrastructure\Security\LoginFailureHandler;
+use App\Shared\Domain\Clock;
+use App\Shared\Infrastructure\Monitoring\MetricsCollector;
+use App\Shared\Infrastructure\RateLimit\LoginRateLimiterInterface;
+use App\Shared\Infrastructure\RateLimit\LoginRateLimitResult;
+use App\Shared\Infrastructure\Tenant\TenantContext;
+use App\Shared\Infrastructure\Tenant\TenantNotFoundException;
+use App\Shared\Infrastructure\Tenant\TenantResolver;
+use DateTimeImmutable;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use Prometheus\CollectorRegistry;
+use Prometheus\Storage\InMemory;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Messenger\Envelope;
+use Symfony\Component\Messenger\MessageBusInterface;
+use Symfony\Component\Security\Core\Exception\AuthenticationException;
+use Symfony\Component\Security\Core\Exception\CustomUserMessageAccountStatusException;
+
+final class LoginFailureHandlerTest extends TestCase
+{
+    private function createMetricsCollector(): MetricsCollector
+    {
+        return new MetricsCollector(
+            new CollectorRegistry(new InMemory()),
+            new TenantContext(),
+        );
+    }
+
+    #[Test]
+    public function suspendedAccountReturns403WithoutRateLimiting(): void
+    {
+        $rateLimiter = $this->createMock(LoginRateLimiterInterface::class);
+        $rateLimiter->expects(self::never())->method('recordFailure');
+
+        $eventBus = $this->createMock(MessageBusInterface::class);
+        $eventBus->expects(self::never())->method('dispatch');
+
+        $clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-02-07 10:00:00');
+            }
+        };
+
+        $tenantResolver = $this->createMock(TenantResolver::class);
+
+        $handler = new LoginFailureHandler($rateLimiter, $eventBus, $clock, $tenantResolver, $this->createMetricsCollector());
+
+        $request = Request::create('/api/login', 'POST', [], [], [], [], json_encode(['email' => 'blocked@example.com', 'password' => 'test']));
+        $exception = new CustomUserMessageAccountStatusException('Votre compte a été suspendu. Contactez votre établissement.');
+
+        $response = $handler->onAuthenticationFailure($request, $exception);
+
+        self::assertSame(403, $response->getStatusCode());
+        $data = json_decode($response->getContent(), true);
+        self::assertSame('/errors/account-suspended', $data['type']);
+        self::assertSame('Compte suspendu', $data['title']);
+    }
+
+    #[Test]
+    public function standardFailureReturns401WithRateLimiting(): void
+    {
+        $rateLimiter = $this->createMock(LoginRateLimiterInterface::class);
+        $rateLimiter->expects(self::once())
+            ->method('recordFailure')
+            ->willReturn(LoginRateLimitResult::allowed(1, 0, false));
+
+        $eventBus = $this->createMock(MessageBusInterface::class);
+        $eventBus->method('dispatch')->willReturnCallback(
+            static fn (object $message) => new Envelope($message),
+        );
+
+        $clock = new class implements Clock {
+            public function now(): DateTimeImmutable
+            {
+                return new DateTimeImmutable('2026-02-07 10:00:00');
+            }
+        };
+
+        $tenantResolver = $this->createMock(TenantResolver::class);
+        $tenantResolver->method('resolve')->willThrowException(TenantNotFoundException::withSubdomain('unknown'));
+
+        $handler = new LoginFailureHandler($rateLimiter, $eventBus, $clock, $tenantResolver, $this->createMetricsCollector());
+
+        $request = Request::create('/api/login', 'POST', [], [], [], [], json_encode(['email' => 'user@example.com', 'password' => 'wrong']));
+        $exception = new AuthenticationException('Invalid credentials.');
+
+        $response = $handler->onAuthenticationFailure($request, $exception);
+
+        self::assertSame(401, $response->getStatusCode());
+        $data = json_decode($response->getContent(), true);
+        self::assertSame('/errors/authentication-failed', $data['type']);
+    }
+}
--- a/backend/tests/Unit/Administration/Infrastructure/Security/UserVoterTest.php
+++ b/backend/tests/Unit/Administration/Infrastructure/Security/UserVoterTest.php
@@ -0,0 +1,134 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Unit\Administration\Infrastructure\Security;
+
+use App\Administration\Infrastructure\Security\UserVoter;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+final class UserVoterTest extends TestCase
+{
+    private UserVoter $voter;
+
+    protected function setUp(): void
+    {
+        $this->voter = new UserVoter();
+    }
+
+    #[Test]
+    public function itAbstainsForUnrelatedAttributes(): void
+    {
+        $user = $this->createMock(UserInterface::class);
+        $user->method('getRoles')->willReturn(['ROLE_ADMIN']);
+
+        $token = $this->createMock(TokenInterface::class);
+        $token->method('getUser')->willReturn($user);
+
+        $result = $this->voter->vote($token, null, ['SOME_OTHER_ATTRIBUTE']);
+
+        self::assertSame(UserVoter::ACCESS_ABSTAIN, $result);
+    }
+
+    #[Test]
+    public function itDeniesAccessToUnauthenticatedUsers(): void
+    {
+        $token = $this->createMock(TokenInterface::class);
+        $token->method('getUser')->willReturn(null);
+
+        $result = $this->voter->vote($token, null, [UserVoter::VIEW]);
+
+        self::assertSame(UserVoter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itGrantsViewToSuperAdmin(): void
+    {
+        $result = $this->voteWithRole('ROLE_SUPER_ADMIN', UserVoter::VIEW);
+        self::assertSame(UserVoter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itGrantsViewToAdmin(): void
+    {
+        $result = $this->voteWithRole('ROLE_ADMIN', UserVoter::VIEW);
+        self::assertSame(UserVoter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itGrantsViewToSecretariat(): void
+    {
+        $result = $this->voteWithRole('ROLE_SECRETARIAT', UserVoter::VIEW);
+        self::assertSame(UserVoter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itDeniesViewToProf(): void
+    {
+        $result = $this->voteWithRole('ROLE_PROF', UserVoter::VIEW);
+        self::assertSame(UserVoter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itDeniesViewToParent(): void
+    {
+        $result = $this->voteWithRole('ROLE_PARENT', UserVoter::VIEW);
+        self::assertSame(UserVoter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itGrantsCreateToAdmin(): void
+    {
+        $result = $this->voteWithRole('ROLE_ADMIN', UserVoter::CREATE);
+        self::assertSame(UserVoter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itDeniesCreateToSecretariat(): void
+    {
+        $result = $this->voteWithRole('ROLE_SECRETARIAT', UserVoter::CREATE);
+        self::assertSame(UserVoter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itGrantsBlockToAdmin(): void
+    {
+        $result = $this->voteWithRole('ROLE_ADMIN', UserVoter::BLOCK);
+        self::assertSame(UserVoter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itDeniesBlockToProf(): void
+    {
+        $result = $this->voteWithRole('ROLE_PROF', UserVoter::BLOCK);
+        self::assertSame(UserVoter::ACCESS_DENIED, $result);
+    }
+
+    #[Test]
+    public function itGrantsUnblockToAdmin(): void
+    {
+        $result = $this->voteWithRole('ROLE_ADMIN', UserVoter::UNBLOCK);
+        self::assertSame(UserVoter::ACCESS_GRANTED, $result);
+    }
+
+    #[Test]
+    public function itDeniesUnblockToProf(): void
+    {
+        $result = $this->voteWithRole('ROLE_PROF', UserVoter::UNBLOCK);
+        self::assertSame(UserVoter::ACCESS_DENIED, $result);
+    }
+
+    private function voteWithRole(string $role, string $attribute): int
+    {
+        $user = $this->createMock(UserInterface::class);
+        $user->method('getRoles')->willReturn([$role]);
+
+        $token = $this->createMock(TokenInterface::class);
+        $token->method('getUser')->willReturn($user);
+
+        return $this->voter->vote($token, null, [$attribute]);
+    }
+}