Add functional tests for schema validation and voter assertions

src/Security/Voter/UserVoter.php

@@ -0,0 +1,39 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Security\Voter;
+
+use App\Entity\User;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+
+use function in_array;
+
+/**
+ * Grants USER_EDIT only on the account of the authenticated user.
+ *
+ * Implements VoterInterface instead of extending Voter, whose abstract
+ * voteOnAttribute() signature is not the same across the Symfony versions
+ * covered by the branches of this repository.
+ */
+final class UserVoter implements VoterInterface
+{
+    public const EDIT = 'USER_EDIT';
+
+    /**
+     * @param mixed[] $attributes
+     */
+    public function vote(TokenInterface $token, mixed $subject, array $attributes, mixed ...$args): int
+    {
+        if (!in_array(self::EDIT, $attributes, true) || !$subject instanceof User) {
+            return self::ACCESS_ABSTAIN;
+        }
+
+        $user = $token->getUser();
+
+        return $user instanceof User && $user->getUserIdentifier() === $subject->getUserIdentifier()
+            ? self::ACCESS_GRANTED
+            : self::ACCESS_DENIED;
+    }
+}

tests/Functional/DoctrineCest.php

@@ -44,6 +44,11 @@ public function seeNumRecords(FunctionalTester $I)
         $I->seeNumRecords(1, User::class);
     }
 
+    public function seeDoctrineSchemaIsValid(FunctionalTester $I): void
+    {
+        $I->seeDoctrineSchemaIsValid();
+    }
+
     public function queryCountAssertions(FunctionalTester $I): void
     {
         $I->amOnPage('/run-queries');

tests/Functional/SecurityCest.php

@@ -5,6 +5,7 @@
 namespace App\Tests\Functional;
 
 use App\Entity\User;
+use App\Security\Voter\UserVoter;
 use App\Tests\Support\FunctionalTester;
 
 final class SecurityCest
@@ -70,6 +71,30 @@ public function seeUserHasRoles(FunctionalTester $I)
         $I->seeUserHasRoles(['ROLE_USER', 'ROLE_CUSTOMER']);
     }
 
+    public function seeUserIsGranted(FunctionalTester $I): void
+    {
+        $user = $I->grabEntityFromRepository(User::class, [
+            'email' => 'john_doe@gmail.com',
+        ]);
+        $I->amLoggedInAs($user);
+        $I->amOnPage('/');
+
+        $I->seeUserIsGranted('ROLE_CUSTOMER');
+        $I->seeUserIsGranted(UserVoter::EDIT, $user);
+    }
+
+    public function dontSeeUserIsGranted(FunctionalTester $I): void
+    {
+        $user = $I->grabEntityFromRepository(User::class, [
+            'email' => 'john_doe@gmail.com',
+        ]);
+        $I->amLoggedInAs($user);
+        $I->amOnPage('/');
+
+        $I->dontSeeUserIsGranted('ROLE_ADMIN');
+        $I->dontSeeUserIsGranted(UserVoter::EDIT, User::create('jane_doe@gmail.com', '123456'));
+    }
+
     public function seeUserPasswordDoesNotNeedRehash(FunctionalTester $I)
     {
         $user = $I->grabEntityFromRepository(User::class, [