Starseed/src/Module/Commercial/Domain/Entity/SupplierRib.php

<?php

declare(strict_types=1);

namespace App\Module\Commercial\Domain\Entity;

use ApiPlatform\Metadata\ApiResource;
use ApiPlatform\Metadata\Delete;
use ApiPlatform\Metadata\Get;
use ApiPlatform\Metadata\Link;
use ApiPlatform\Metadata\Patch;
use ApiPlatform\Metadata\Post;
use App\Module\Commercial\Infrastructure\ApiPlatform\State\Processor\SupplierRibProcessor;
use App\Module\Commercial\Infrastructure\Doctrine\DoctrineSupplierRibRepository;
use App\Shared\Domain\Attribute\Auditable;
use App\Shared\Domain\Contract\BlamableInterface;
use App\Shared\Domain\Contract\TimestampableInterface;
use App\Shared\Domain\Trait\TimestampableBlamableTrait;
use Doctrine\ORM\Mapping as ORM;
use Symfony\Component\Serializer\Attribute\Groups;
use Symfony\Component\Validator\Constraints as Assert;

/**
 * Coordonnees bancaires d'un fournisseur (1:n) — onglet Comptabilite. Au moins un
 * RIB est obligatoire si le type de reglement est LCR (RG-2.08, verifie au
 * Processor : refus du DELETE du dernier RIB sous LCR, ERP-88).
 *
 * Embarque sous `supplier.ribs` UNIQUEMENT si l'user a accounting.view : le
 * read-group est `supplier:read:accounting`, retire du contexte par le
 * SupplierProvider sinon (gating par omission de cle — evite la fuite IBAN/BIC,
 * piege n°4 du M1). Aucun #[AuditIgnore] sur iban/bic : l'audit etant admin-only,
 * la tracabilite RIB est conservee (decision M1 reportee, § 2.7).
 *
 * Sous-ressource API (ERP-88, spec § 4.5) — gating comptable renforce :
 *  - POST /api/suppliers/{supplierId}/ribs : creation rattachee au fournisseur
 *    parent (Link toProperty 'supplier'), security
 *    commercial.suppliers.accounting.manage.
 *  - PATCH / DELETE /api/supplier_ribs/{id} : security
 *    commercial.suppliers.accounting.manage. Le DELETE refuse la suppression du
 *    dernier RIB sous LCR (RG-2.08, 409).
 *  - GET /api/supplier_ribs/{id} : lecture unitaire, security
 *    commercial.suppliers.accounting.view (donnees bancaires sensibles). Pas de
 *    GET collection autonome.
 * Tout passe par le SupplierRibProcessor (RG-2.08 sur DELETE).
 *
 * Validation IBAN/BIC : Assert\Iban + Assert\Bic standard Symfony (pas de controle
 * banque reelle), avec controle croise pays BIC/IBAN (ibanPropertyPath). Audite
 * (#[Auditable]) + Timestampable / Blamable.
 */
#[ApiResource(
    operations: [
        new Get(
            security: "is_granted('commercial.suppliers.accounting.view')",
            normalizationContext: ['groups' => ['supplier:read:accounting']],
        ),
        new Post(
            uriTemplate: '/suppliers/{supplierId}/ribs',
            uriVariables: [
                'supplierId' => new Link(fromClass: Supplier::class, toProperty: 'supplier'),
            ],
            // read:false : pas de stade lecture du parent. Le Link toProperty
            // resoudrait l'enfant (SELECT SupplierRib ... WHERE supplier = :id) et
            // casse en NonUniqueResult des >= 2 enfants. Le parent est rattache
            // manuellement par SupplierRibProcessor::linkParent (404 si absent).
            read: false,
            security: "is_granted('commercial.suppliers.accounting.manage')",
            normalizationContext: ['groups' => ['supplier:read:accounting']],
            denormalizationContext: ['groups' => ['supplier:write:accounting']],
            processor: SupplierRibProcessor::class,
        ),
        new Patch(
            security: "is_granted('commercial.suppliers.accounting.manage')",
            normalizationContext: ['groups' => ['supplier:read:accounting']],
            denormalizationContext: ['groups' => ['supplier:write:accounting']],
            processor: SupplierRibProcessor::class,
        ),
        new Delete(
            security: "is_granted('commercial.suppliers.accounting.manage')",
            processor: SupplierRibProcessor::class,
        ),
    ],
)]
#[ORM\Entity(repositoryClass: DoctrineSupplierRibRepository::class)]
#[ORM\Table(name: 'supplier_rib')]
#[ORM\Index(name: 'idx_supplier_rib_supplier', columns: ['supplier_id'])]
#[Auditable]
class SupplierRib implements TimestampableInterface, BlamableInterface
{
    use TimestampableBlamableTrait;

    #[ORM\Id]
    #[ORM\GeneratedValue]
    #[ORM\Column]
    #[Groups(['supplier:read:accounting'])]
    private ?int $id = null;

    #[ORM\ManyToOne(targetEntity: Supplier::class, inversedBy: 'ribs')]
    #[ORM\JoinColumn(name: 'supplier_id', referencedColumnName: 'id', nullable: false, onDelete: 'CASCADE')]
    private ?Supplier $supplier = null;

    #[ORM\Column(length: 120)]
    #[Assert\NotBlank(message: 'Le libellé du RIB est obligatoire.', normalizer: 'trim')]
    #[Assert\Length(max: 120, maxMessage: 'Le libellé ne peut dépasser {{ limit }} caractères.', normalizer: 'trim')]
    #[Groups(['supplier:read:accounting', 'supplier:write:accounting'])]
    private ?string $label = null;

    // Bic/Iban bornent deja le format (et donc la longueur) : pas de Length
    // redondant calee sur la colonne (auto-exempte du miroir ERP-107).
    // ibanPropertyPath : controle croise — le pays du BIC (positions 5-6) doit
    // correspondre au pays de l'IBAN (positions 1-2). Violation portee sur `bic`.
    #[ORM\Column(length: 20)]
    #[Assert\NotBlank(message: 'Le BIC est obligatoire.', normalizer: 'trim')]
    #[Assert\Bic(
        message: 'Le BIC n\'est pas valide.',
        ibanPropertyPath: 'iban',
        ibanMessage: 'Le BIC ne correspond pas au pays de l\'IBAN.',
    )]
    #[Groups(['supplier:read:accounting', 'supplier:write:accounting'])]
    private ?string $bic = null;

    #[ORM\Column(length: 34)]
    #[Assert\NotBlank(message: 'L\'IBAN est obligatoire.', normalizer: 'trim')]
    #[Assert\Iban(message: 'L\'IBAN n\'est pas valide.')]
    #[Groups(['supplier:read:accounting', 'supplier:write:accounting'])]
    private ?string $iban = null;

    // Ordre d'affichage du RIB (gere serveur, non expose au M2).
    #[ORM\Column(options: ['default' => 0])]
    private int $position = 0;

    public function getId(): ?int
    {
        return $this->id;
    }

    public function getSupplier(): ?Supplier
    {
        return $this->supplier;
    }

    public function setSupplier(?Supplier $supplier): static
    {
        $this->supplier = $supplier;

        return $this;
    }

    public function getLabel(): ?string
    {
        return $this->label;
    }

    public function setLabel(string $label): static
    {
        $this->label = $label;

        return $this;
    }

    public function getBic(): ?string
    {
        return $this->bic;
    }

    public function setBic(string $bic): static
    {
        $this->bic = $bic;

        return $this;
    }

    public function getIban(): ?string
    {
        return $this->iban;
    }

    public function setIban(string $iban): static
    {
        $this->iban = $iban;

        return $this;
    }

    public function getPosition(): int
    {
        return $this->position;
    }

    public function setPosition(int $position): static
    {
        $this->position = $position;

        return $this;
    }
}