feat(transport) : CarrierProcessor + champs conditionnels formulaire principal (ERP-158)

Ecriture du formulaire principal transporteur (M4, WT4) : POST/PATCH via CarrierProcessor + CarrierFieldNormalizer, contraintes conditionnelles sur l'entite Carrier. - RG-4.01 : POST qualimatCarrier -> certificationType=QUALIMAT + FK persistee ; cas LIOT (name=LIOT) -> certification non requise, liotPlates accepte. - RG-4.02 : certificationType=AUTRE sans dischargeDocument -> 422 (Assert\Callback). - RG-4.03 : isChartered=true sans indexationRate/containerType/volumeM3 -> 422. - RG-4.12 : doublon de nom (parmi actifs) -> 409 (index partiel uq_carrier_name_active). - RG-4.13 : normalisation serveur (name UPPER, liotPlates ;-split/trim/UPPER) + methodes personne/telephone/email pour les sous-ressources Contact (WT7). - RG-4.14 : PATCH isArchived exige transport.carriers.archive (Admin seul), mode strict -> 403 + 422 si autre champ ; restauration en conflit -> 409. Operations Post/Patch ajoutees a l'ApiResource (lecture posee au WT3 conservee). RG conditionnelles portees par validateMainFormConsistency (Assert\Callback + ->atPath()) pour un propertyPath mappable inline (useFormErrors, ERP-101). certificationType / containerType whitelistes dans EXCLUDED_LENGTH_MIRROR (Choice borne deja les valeurs, miroir SupplierAddress::addressType). Tests : CarrierWriteApiTest (RG-4.01->4.03/4.12->4.14), CarrierRBACMatrixTest (matrice bureau/compta/commerciale/usine), CarrierArchiveTest (409 restauration), CarrierFieldNormalizerTest (RG-4.13). make test vert (750).
2026-06-16 08:14:54 +02:00
parent d9313dbec8
commit 97d7cacd2c
9 changed files with 1040 additions and 23 deletions
@@ -58,6 +58,10 @@ final class EntityConstraintsHaveFrenchMessageTest extends TestCase
        'ProviderAddress::postalCode' => 'Regex {4,5} borne deja la longueur.',
        // Le Choice {PROSPECT,DEPART,RENDU} borne les valeurs (<= 8 < 20).
        'SupplierAddress::addressType' => 'Choice {PROSPECT,DEPART,RENDU} borne deja les valeurs.',
+        // Le Choice {QUALIMAT,GMP_PLUS,OVOCOM,COMPTE_PROPRE,AUTRE} borne les valeurs (<= 13 < 20).
+        'Carrier::certificationType' => 'Choice des 5 certifications borne deja les valeurs.',
+        // Le Choice {BENNE,FOND_MOUVANT} borne les valeurs (<= 12).
+        'Carrier::containerType' => 'Choice {BENNE,FOND_MOUVANT} borne deja les valeurs.',
        // Le Regex /^#[0-9A-Fa-f]{6}$/ borne la longueur a exactement 7 caracteres.
        'Site::color' => 'Regex code hex #RRGGBB borne deja la longueur.',
    ];
@@ -31,7 +31,8 @@ use DateTimeImmutable;
 */
 abstract class AbstractCarrierApiTestCase extends AbstractApiTestCase
 {
-    protected const string LD = 'application/ld+json';
+    protected const string LD    = 'application/ld+json';
+    protected const string MERGE = 'application/merge-patch+json';

    /** Prefixe SIRET des lignes qualimat_carrier seedees par les tests (purge ciblee). */
    private const string TEST_SIRET_PREFIX = 'TESTQ';
@@ -63,6 +64,22 @@ abstract class AbstractCarrierApiTestCase extends AbstractApiTestCase
        return $this->authenticatedClient('admin', 'admin');
    }

+    /**
+     * Payload minimal valide du formulaire principal (transporteur non-QUALIMAT,
+     * non affrete) : nom + certification GMP_PLUS. Sert de base aux tests
+     * d'ecriture / RBAC.
+     *
+     * @return array<string, mixed>
+     */
+    protected function validMainPayload(string $name): array
+    {
+        return [
+            'name'              => $name,
+            'certificationType' => 'GMP_PLUS',
+            'isChartered'       => false,
+        ];
+    }
+
    /**
     * Seede un transporteur minimal (nom en MAJUSCULES, comme le ferait le
     * futur Processor). Sert aux tests de liste / archivage.
@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Module\Transport\Api;
+
+/**
+ * Archivage / restauration transporteur — trou 409 de restauration en conflit
+ * d'unicite (M4, RG-4.14). Le nominal (archive pose archivedAt) et le 422
+ * « archive + autre champ » sont couverts par CarrierWriteApiTest. Jumeau de
+ * SupplierArchiveTest (M2).
+ *
+ * @internal
+ */
+final class CarrierArchiveTest extends AbstractCarrierApiTestCase
+{
+    /**
+     * RG-4.14 : restaurer un transporteur archive dont le nom a ete repris par un
+     * transporteur actif entre-temps doit echouer en 409 (index partiel
+     * uq_carrier_name_active : un seul actif portant ce nom).
+     */
+    public function testRestoreConflictReturns409(): void
+    {
+        $client = $this->createAdminClient();
+
+        $archived = $this->seedCarrier('Acme Conflict', true);
+        $this->seedCarrier('Acme Conflict', false);
+
+        $client->request('PATCH', '/api/carriers/'.$archived->getId(), [
+            'headers' => ['Content-Type' => self::MERGE],
+            'json'    => ['isArchived' => false],
+        ]);
+
+        self::assertResponseStatusCodeSame(409);
+    }
+}
@@ -0,0 +1,158 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Module\Transport\Api;
+
+use ApiPlatform\Symfony\Bundle\Test\Client;
+use App\Module\Core\Infrastructure\DataFixtures\RbacDemoFixtures;
+use Symfony\Bundle\FrameworkBundle\Console\Application;
+use Symfony\Component\Console\Input\ArrayInput;
+use Symfony\Component\Console\Output\NullOutput;
+
+/**
+ * Matrice RBAC du repertoire transporteurs par role metier (spec-back M4 § 5.2 +
+ * ERP-153/158). Valide 200/403 par verbe pour bureau / compta / commerciale /
+ * usine ; l'archivage reste admin seul (gating CarrierProcessor, RG-4.14). Jumeau
+ * de SupplierRBACMatrixTest (M2).
+ *
+ * Matrice § 5.2 — rappel :
+ *  - bureau      : view + manage (PAS archive)
+ *  - commerciale : view seul (ni manage ni archive)
+ *  - compta      : aucun acces (403 sur view ET manage)
+ *  - usine       : aucun acces (403 partout)
+ *  - archive     : admin seul
+ *
+ * @internal
+ */
+final class CarrierRBACMatrixTest extends AbstractCarrierApiTestCase
+{
+    private const string PWD = RbacDemoFixtures::DEMO_PASSWORD;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // Seed idempotent via la commande applicative (roles + matrice § 5.2 +
+        // comptes demo) — meme chemin qu'en recette.
+        self::bootKernel();
+        $application = new Application(self::$kernel);
+        $application->setAutoExit(false);
+        $exit = $application->run(
+            new ArrayInput([
+                'command'           => 'app:seed-rbac',
+                '--with-demo-users' => true,
+                '--password'        => self::PWD,
+            ]),
+            new NullOutput(),
+        );
+        self::assertSame(
+            0,
+            $exit,
+            'app:seed-rbac a echoue : les permissions transport.carriers.* sont-elles synchronisees (app:sync-permissions) ?',
+        );
+
+        self::ensureKernelShutdown();
+    }
+
+    public function testUsineIsForbiddenEverywhere(): void
+    {
+        $seed   = $this->seedCarrier('Usine Target');
+        $client = $this->authAs('usine');
+
+        $client->request('GET', '/api/carriers', ['headers' => ['Accept' => self::LD]]);
+        self::assertResponseStatusCodeSame(403);
+
+        $client->request('GET', '/api/carriers/'.$seed->getId(), ['headers' => ['Accept' => self::LD]]);
+        self::assertResponseStatusCodeSame(403);
+
+        $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => $this->validMainPayload('Usine Post'),
+        ]);
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    public function testComptaHasNoAccess(): void
+    {
+        $seed   = $this->seedCarrier('Compta Target');
+        $client = $this->authAs('compta');
+
+        // PAS view (matrice § 5.2 : Compta sans acces transporteurs).
+        $client->request('GET', '/api/carriers', ['headers' => ['Accept' => self::LD]]);
+        self::assertResponseStatusCodeSame(403);
+
+        // PAS manage : creation refusee.
+        $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => $this->validMainPayload('Compta Post'),
+        ]);
+        self::assertResponseStatusCodeSame(403);
+
+        $client->request('PATCH', '/api/carriers/'.$seed->getId(), [
+            'headers' => ['Content-Type' => self::MERGE],
+            'json'    => ['name' => 'Renamed By Compta'],
+        ]);
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    public function testBureauHasViewAndManageButNoArchive(): void
+    {
+        $seed   = $this->seedCarrier('Bureau Target');
+        $client = $this->authAs('bureau');
+
+        // view
+        $client->request('GET', '/api/carriers', ['headers' => ['Accept' => self::LD]]);
+        self::assertResponseStatusCodeSame(200);
+
+        // manage : creation OK
+        $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => $this->validMainPayload('Bureau Created'),
+        ]);
+        self::assertResponseStatusCodeSame(201);
+
+        // manage : edition formulaire principal OK
+        $client->request('PATCH', '/api/carriers/'.$seed->getId(), [
+            'headers' => ['Content-Type' => self::MERGE],
+            'json'    => ['name' => 'Bureau Renamed'],
+        ]);
+        self::assertResponseStatusCodeSame(200);
+
+        // PAS archive : archivage refuse (RG-4.14, gating CarrierProcessor).
+        $client->request('PATCH', '/api/carriers/'.$seed->getId(), [
+            'headers' => ['Content-Type' => self::MERGE],
+            'json'    => ['isArchived' => true],
+        ]);
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    public function testCommercialeHasViewOnly(): void
+    {
+        $seed   = $this->seedCarrier('Commerciale Target');
+        $client = $this->authAs('commerciale');
+
+        // view (consultation « Tout »)
+        $client->request('GET', '/api/carriers', ['headers' => ['Accept' => self::LD]]);
+        self::assertResponseStatusCodeSame(200);
+
+        // PAS manage : creation refusee
+        $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => $this->validMainPayload('Commerciale Post'),
+        ]);
+        self::assertResponseStatusCodeSame(403);
+
+        // PAS manage : edition refusee
+        $client->request('PATCH', '/api/carriers/'.$seed->getId(), [
+            'headers' => ['Content-Type' => self::MERGE],
+            'json'    => ['name' => 'Renamed By Commerciale'],
+        ]);
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    private function authAs(string $role): Client
+    {
+        return $this->authenticatedClient($role, self::PWD);
+    }
+}
@@ -0,0 +1,240 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Module\Transport\Api;
+
+/**
+ * Ecriture du formulaire principal transporteur (M4, WT4 — ERP-158). Couvre les
+ * RG du CarrierProcessor + contraintes conditionnelles : RG-4.01 (QUALIMAT + cas
+ * LIOT), RG-4.02 (AUTRE -> decharge), RG-4.03 (affrete -> indexation/benne/volume),
+ * RG-4.12 (doublon de nom -> 409), RG-4.13 (normalisation), RG-4.14 (archivage +
+ * mode strict). Jumeau des SupplierApiTest / SupplierPatchStrictTest (M2).
+ *
+ * @internal
+ */
+final class CarrierWriteApiTest extends AbstractCarrierApiTestCase
+{
+    /**
+     * RG-4.01 : POST avec qualimatCarrier -> certificationType=QUALIMAT accepte et
+     * FK persistee (verifiee au detail, qualimatCarrier embarque).
+     */
+    public function testPostQualimatPersistsCertificationAndForeignKey(): void
+    {
+        $client   = $this->createAdminClient();
+        $qualimat = $this->seedQualimatCarrier('Transports Grelillier');
+
+        $created = $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => [
+                'name'              => 'Transports Grelillier',
+                'qualimatCarrier'   => '/api/qualimat_carriers/'.$qualimat->getId(),
+                'certificationType' => 'QUALIMAT',
+                'isChartered'       => false,
+            ],
+        ])->toArray();
+
+        self::assertResponseStatusCodeSame(201);
+        self::assertSame('QUALIMAT', $created['certificationType']);
+
+        $detail = $client->request('GET', $created['@id'], ['headers' => ['Accept' => self::LD]])->toArray();
+        self::assertIsArray($detail['qualimatCarrier']);
+        self::assertSame((int) $qualimat->getId(), (int) $detail['qualimatCarrier']['id']);
+    }
+
+    /**
+     * RG-4.01 (cas LIOT) : nom = LIOT -> certificationType non requis (champ masque)
+     * et liotPlates accepte (et normalise, RG-4.13).
+     */
+    public function testPostLiotAcceptsPlatesWithoutCertification(): void
+    {
+        $client = $this->createAdminClient();
+
+        $created = $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => [
+                'name'        => 'LIOT',
+                'liotPlates'  => 'ab-123-cd ; ef-456-gh',
+                'isChartered' => false,
+            ],
+        ])->toArray();
+
+        self::assertResponseStatusCodeSame(201);
+        self::assertNull($created['certificationType']);
+        self::assertSame('AB-123-CD; EF-456-GH', $created['liotPlates']);
+    }
+
+    /**
+     * RG-4.01 : hors cas LIOT, l'absence de certification est rejetee (422 cible
+     * sur certificationType).
+     */
+    public function testPostWithoutCertificationOutsideLiotIsRejected(): void
+    {
+        $client = $this->createAdminClient();
+
+        $response = $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => ['name' => 'Sans Certif', 'isChartered' => false],
+        ]);
+
+        self::assertResponseStatusCodeSame(422);
+        self::assertViolationOnPath($response, 'certificationType');
+    }
+
+    /**
+     * RG-4.02 : certificationType=AUTRE sans dischargeDocument -> 422 cible ; une
+     * certification != AUTRE sans decharge passe (201).
+     */
+    public function testAutreCertificationRequiresDischarge(): void
+    {
+        $client = $this->createAdminClient();
+
+        $response = $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => ['name' => 'Sans Decharge', 'certificationType' => 'AUTRE', 'isChartered' => false],
+        ]);
+        self::assertResponseStatusCodeSame(422);
+        self::assertViolationOnPath($response, 'dischargeDocument');
+
+        // Certification != AUTRE : pas de decharge requise.
+        $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => ['name' => 'Avec GmpPlus', 'certificationType' => 'GMP_PLUS', 'isChartered' => false],
+        ]);
+        self::assertResponseStatusCodeSame(201);
+    }
+
+    /**
+     * RG-4.03 : isChartered=true sans indexationRate / containerType / volumeM3 ->
+     * 422 (violations ciblees) ; complet -> 201.
+     */
+    public function testCharteredRequiresIndexationContainerAndVolume(): void
+    {
+        $client = $this->createAdminClient();
+
+        $response = $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => ['name' => 'Affrete Incomplet', 'certificationType' => 'GMP_PLUS', 'isChartered' => true],
+        ]);
+        self::assertResponseStatusCodeSame(422);
+        self::assertViolationOnPath($response, 'indexationRate');
+        self::assertViolationOnPath($response, 'containerType');
+        self::assertViolationOnPath($response, 'volumeM3');
+
+        $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => [
+                'name'              => 'Affrete Complet',
+                'certificationType' => 'GMP_PLUS',
+                'isChartered'       => true,
+                'indexationRate'    => '5.00',
+                'containerType'     => 'BENNE',
+                'volumeM3'          => '90.00',
+            ],
+        ]);
+        self::assertResponseStatusCodeSame(201);
+    }
+
+    /**
+     * RG-4.12 : nom deja pris (parmi actifs) -> 409. Le meme nom redevient
+     * disponible apres archivage de l'ancien -> 201.
+     */
+    public function testDuplicateNameReturns409AndIsFreedAfterArchive(): void
+    {
+        $client   = $this->createAdminClient();
+        $existing = $this->seedCarrier('Doublon Co');
+
+        $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => $this->validMainPayload('Doublon Co'),
+        ]);
+        self::assertResponseStatusCodeSame(409);
+
+        // Archivage de l'ancien -> le nom se libere (index partiel sur actifs).
+        $client->request('PATCH', '/api/carriers/'.$existing->getId(), [
+            'headers' => ['Content-Type' => self::MERGE],
+            'json'    => ['isArchived' => true],
+        ]);
+        self::assertResponseStatusCodeSame(200);
+
+        $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => $this->validMainPayload('Doublon Co'),
+        ]);
+        self::assertResponseStatusCodeSame(201);
+    }
+
+    /**
+     * RG-4.13 : le nom est persiste en MAJUSCULES (normalisation serveur).
+     */
+    public function testNameIsUpperCasedOnPersist(): void
+    {
+        $client = $this->createAdminClient();
+
+        $created = $client->request('POST', '/api/carriers', [
+            'headers' => ['Content-Type' => self::LD],
+            'json'    => $this->validMainPayload('transports x'),
+        ])->toArray();
+
+        self::assertResponseStatusCodeSame(201);
+        self::assertSame('TRANSPORTS X', $created['name']);
+    }
+
+    /**
+     * RG-4.14 : PATCH isArchived=true par Admin -> 200 + archivedAt rempli ;
+     * restauration -> archivedAt remis a null.
+     */
+    public function testAdminArchiveSetsArchivedAtAndRestoreClearsIt(): void
+    {
+        $client  = $this->createAdminClient();
+        $carrier = $this->seedCarrier('A Archiver');
+
+        $archived = $client->request('PATCH', '/api/carriers/'.$carrier->getId(), [
+            'headers' => ['Content-Type' => self::MERGE],
+            'json'    => ['isArchived' => true],
+        ])->toArray();
+        self::assertResponseStatusCodeSame(200);
+        self::assertTrue($archived['isArchived']);
+        self::assertNotNull($archived['archivedAt']);
+
+        $restored = $client->request('PATCH', '/api/carriers/'.$carrier->getId(), [
+            'headers' => ['Content-Type' => self::MERGE],
+            'json'    => ['isArchived' => false],
+        ])->toArray();
+        self::assertResponseStatusCodeSame(200);
+        self::assertFalse($restored['isArchived']);
+        self::assertNull($restored['archivedAt']);
+    }
+
+    /**
+     * RG-4.14 (mode strict) : une requete d'archivage ne peut modifier aucun autre
+     * champ ecrivable -> 422.
+     */
+    public function testArchiveRequestMixingOtherFieldIsRejected(): void
+    {
+        $client  = $this->createAdminClient();
+        $carrier = $this->seedCarrier('Strict Co');
+
+        $client->request('PATCH', '/api/carriers/'.$carrier->getId(), [
+            'headers' => ['Content-Type' => self::MERGE],
+            'json'    => ['isArchived' => true, 'name' => 'Renamed While Archiving'],
+        ]);
+        self::assertResponseStatusCodeSame(422);
+    }
+
+    /**
+     * Verifie qu'une violation 422 cible bien la propriete attendue (propertyPath),
+     * gage du mapping inline front (useFormErrors, ERP-101).
+     */
+    private function assertViolationOnPath(object $response, string $path): void
+    {
+        /** @var \Symfony\Contracts\HttpClient\ResponseInterface $response */
+        $paths = array_column($response->toArray(false)['violations'] ?? [], 'propertyPath');
+
+        self::assertContains(
+            $path,
+            $paths,
+            sprintf('Aucune violation sur "%s" (paths: %s).', $path, implode(', ', $paths)),
+        );
+    }
+}
@@ -0,0 +1,69 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Module\Transport\Application;
+
+use App\Module\Transport\Application\Service\CarrierFieldNormalizer;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Normalisation serveur des champs texte du repertoire transporteurs (RG-4.13 +
+ * cas LIOT RG-4.01). Jumeau de SupplierFieldNormalizerTest (M2), enrichi de
+ * normalizeLiotPlates.
+ *
+ * @internal
+ */
+final class CarrierFieldNormalizerTest extends TestCase
+{
+    private CarrierFieldNormalizer $normalizer;
+
+    protected function setUp(): void
+    {
+        $this->normalizer = new CarrierFieldNormalizer();
+    }
+
+    public function testNameIsUpperCasedAndTrimmed(): void
+    {
+        self::assertSame('TRANSPORTS X', $this->normalizer->normalizeName('  transports x  '));
+        self::assertNull($this->normalizer->normalizeName(null));
+    }
+
+    public function testPersonNameIsTitleCased(): void
+    {
+        self::assertSame('Jean Dupont', $this->normalizer->normalizePersonName('JEAN dupont'));
+        self::assertNull($this->normalizer->normalizePersonName('   '));
+        self::assertNull($this->normalizer->normalizePersonName(null));
+    }
+
+    public function testEmailIsLowerCased(): void
+    {
+        self::assertSame('marie.martin@seed.test', $this->normalizer->normalizeEmail('  Marie.MARTIN@Seed.Test '));
+        self::assertNull($this->normalizer->normalizeEmail('  '));
+        self::assertNull($this->normalizer->normalizeEmail(null));
+    }
+
+    public function testPhoneKeepsDigitsOnly(): void
+    {
+        self::assertSame('0612345678', $this->normalizer->normalizePhone('06.12.34.56.78'));
+        self::assertSame('33612345678', $this->normalizer->normalizePhone('+33 6 12 34 56 78'));
+        self::assertNull($this->normalizer->normalizePhone('sans chiffre'));
+        self::assertNull($this->normalizer->normalizePhone(null));
+    }
+
+    /**
+     * RG-4.01 / RG-4.13 : la saisie « ; »-separee est decoupee, chaque plaque trim
+     * + UPPER, segments vides ecartes, recomposee avec "; ".
+     */
+    public function testLiotPlatesAreSplitTrimmedUpperedAndRejoined(): void
+    {
+        self::assertSame(
+            'AB-123-CD; EF-456-GH',
+            $this->normalizer->normalizeLiotPlates('ab-123-cd ; ef-456-gh'),
+        );
+        // Segments vides (« ;; » / fin de chaine) ecartes.
+        self::assertSame('AB-123-CD', $this->normalizer->normalizeLiotPlates(' ab-123-cd ; ; '));
+        self::assertNull($this->normalizer->normalizeLiotPlates('  ;  ;  '));
+        self::assertNull($this->normalizer->normalizeLiotPlates(null));
+    }
+}