Implements right "see confidential course" on method findByPerson

Add unit tests for that

src/Bundle/ChillPersonBundle/Repository/AccompanyingPeriodACLAwareRepository.php

@@ -13,54 +13,51 @@ namespace Chill\PersonBundle\Repository;
 
 use Chill\MainBundle\Entity\Address;
 use Chill\MainBundle\Entity\Location;
-use Chill\MainBundle\Entity\PostalCode;
 use Chill\MainBundle\Entity\Scope;
 use Chill\MainBundle\Entity\User;
 use Chill\MainBundle\Entity\UserJob;
-use Chill\MainBundle\Security\Authorization\AuthorizationHelper;
-use Chill\MainBundle\Security\Resolver\CenterResolverDispatcherInterface;
+use Chill\MainBundle\Security\Authorization\AuthorizationHelperForCurrentUserInterface;
+use Chill\MainBundle\Security\Resolver\CenterResolverManagerInterface;
 use Chill\PersonBundle\Entity\AccompanyingPeriod;
 use Chill\PersonBundle\Entity\AccompanyingPeriodParticipation;
 use Chill\PersonBundle\Entity\Household\PersonHouseholdAddress;
 use Chill\PersonBundle\Entity\Person;
 use Chill\PersonBundle\Security\Authorization\AccompanyingPeriodVoter;
 use DateTime;
-
 use DateTimeImmutable;
 use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Query\Expr\Join;
 use Doctrine\ORM\QueryBuilder;
+use Repository\AccompanyingPeriodACLAwareRepositoryTest;
 use Symfony\Component\Security\Core\Security;
 use function count;
 
-final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodACLAwareRepositoryInterface
+/**
+ * @see AccompanyingPeriodACLAwareRepositoryTest
+ */
+final readonly class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodACLAwareRepositoryInterface
 {
     private AccompanyingPeriodRepository $accompanyingPeriodRepository;
 
-    private AuthorizationHelper $authorizationHelper;
+    private AuthorizationHelperForCurrentUserInterface $authorizationHelper;
 
-    private CenterResolverDispatcherInterface $centerResolverDispatcher;
+    private CenterResolverManagerInterface $centerResolver;
 
     private Security $security;
 
     public function __construct(
         AccompanyingPeriodRepository $accompanyingPeriodRepository,
         Security $security,
-        AuthorizationHelper $authorizationHelper,
-        CenterResolverDispatcherInterface $centerResolverDispatcher
+        AuthorizationHelperForCurrentUserInterface $authorizationHelper,
+        CenterResolverManagerInterface $centerResolverDispatcher
     ) {
         $this->accompanyingPeriodRepository = $accompanyingPeriodRepository;
         $this->security = $security;
         $this->authorizationHelper = $authorizationHelper;
-        $this->centerResolverDispatcher = $centerResolverDispatcher;
+        $this->centerResolver = $centerResolverDispatcher;
     }
 
-    /**
-     * @param array|PostalCode[]
-     *
-     * @return QueryBuilder
-     */
-    public function buildQueryOpenedAccompanyingCourseByUser(?User $user, array $postalCodes = [])
+    public function buildQueryOpenedAccompanyingCourseByUser(?User $user, array $postalCodes = []): QueryBuilder
     {
         $qb = $this->accompanyingPeriodRepository->createQueryBuilder('ap');
 
@@ -152,10 +149,14 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
     ): array {
         $qb = $this->accompanyingPeriodRepository->createQueryBuilder('ap');
         $scopes = $this->authorizationHelper
-            ->getReachableCircles(
-                $this->security->getUser(),
+            ->getReachableScopes(
                 $role,
-                $this->centerResolverDispatcher->resolveCenter($person)
+                $this->centerResolver->resolveCenters($person)
+            );
+        $scopesCanSeeConfidential = $this->authorizationHelper
+            ->getReachableScopes(
+                AccompanyingPeriodVoter::SEE_CONFIDENTIAL_ALL,
+                $this->centerResolver->resolveCenters($person)
             );
 
         if (0 === count($scopes)) {
@@ -165,12 +166,42 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
         $qb
             ->join('ap.participations', 'participation')
             ->where($qb->expr()->eq('participation.person', ':person'))
-            ->andWhere(
-                $qb->expr()->orX(
-                    'ap.confidential = FALSE',
-                    $qb->expr()->eq('ap.user', ':user')
-                )
-            )
+            ->setParameter('person', $person);
+
+        $qb = $this->addACLClauses($qb, $scopes, $scopesCanSeeConfidential);
+        $qb = $this->addOrderLimitClauses($qb, $orderBy, $limit, $offset);
+
+        return $qb->getQuery()->getResult();
+    }
+
+    public function addOrderLimitClauses(QueryBuilder $qb, ?array $orderBy = null, ?int $limit = null, ?int $offset = null): QueryBuilder
+    {
+        if (null !== $orderBy) {
+            foreach ($orderBy as $field => $order) {
+                $qb->addOrderBy('ap.' . $field, $order);
+            }
+        }
+
+        if (null !== $limit) {
+            $qb->setMaxResults($limit);
+        }
+
+        if (null !== $offset) {
+            $qb->setFirstResult($offset);
+        }
+
+        return $qb;
+    }
+
+    /**
+     * @param QueryBuilder $qb where the accompanying period have the `ap` alias
+     * @param array<Scope> $scopesCanSee
+     * @param array<Scope> $scopesCanSeeConfidential
+     * @return QueryBuilder
+     */
+    public function addACLClauses(QueryBuilder $qb, array $scopesCanSee, array $scopesCanSeeConfidential): QueryBuilder
+    {
+        $qb
             ->andWhere(
                 $qb->expr()->orX(
                     $qb->expr()->neq('ap.step', ':draft'),
@@ -181,25 +212,44 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
                 )
             )
             ->setParameter('draft', AccompanyingPeriod::STEP_DRAFT)
-            ->setParameter('person', $person)
             ->setParameter('user', $this->security->getUser())
             ->setParameter('creator', $this->security->getUser());
+
         // add join condition for scopes
         $orx = $qb->expr()->orX(
+            // even if the scope is not in one authorized, the user can see the course if it is in DRAFT state
             $qb->expr()->eq('ap.step', ':draft')
         );
 
-        foreach ($scopes as $key => $scope) {
-            $orx->add($qb->expr()->orX(
+        foreach ($scopesCanSee as $key => $scope) {
+            // for each scope:
+            // - either the user is the referrer of the course
+            // - or the accompanying course is one of the reachable scopes
+            // - and the parcours is not confidential OR the user is the referrer OR the user can see the confidential course
+
+            $orOnScope = $qb->expr()->orX(
                 $qb->expr()->isMemberOf(':scope_' . $key, 'ap.scopes'),
                 $qb->expr()->eq('ap.user', ':user')
-            ));
+            );
+
+            if (in_array($scope, $scopesCanSeeConfidential, true)) {
+                $orx->add($orOnScope);
+            } else {
+                // we must add a condition: the course is not confidential or the user is the referrer
+                $andXOnScope = $qb->expr()->andX(
+                    $orOnScope,
+                    $qb->expr()->orX(
+                        'ap.confidential = FALSE',
+                        $qb->expr()->eq('ap.user', ':user')
+                    )
+                );
+                $orx->add($andXOnScope);
+            }
             $qb->setParameter('scope_' . $key, $scope);
-            $qb->setParameter('user', $this->security->getUser());
         }
         $qb->andWhere($orx);
 
-        return $qb->getQuery()->getResult();
+        return $qb;
     }
 
     public function findByUnDispatched(array $jobs, array $services, array $administrativeLocations, ?int $limit = null, ?int $offset = null): array
@@ -237,9 +287,6 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
         return $qb->getQuery()->getResult();
     }
 
-    /**
-     * @return array|AccompanyingPeriod[]
-     */
     public function findByUserOpenedAccompanyingPeriod(?User $user, array $orderBy = [], int $limit = 0, int $offset = 50): array
     {
         if (null === $user) {
@@ -261,7 +308,6 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
     private function addACLByUnDispatched(QueryBuilder $qb): QueryBuilder
     {
         $centers = $this->authorizationHelper->getReachableCenters(
-            $this->security->getUser(),
             AccompanyingPeriodVoter::SEE
         );
 
@@ -273,8 +319,7 @@ final class AccompanyingPeriodACLAwareRepository implements AccompanyingPeriodAC
 
         foreach ($centers as $key => $center) {
             $scopes = $this->authorizationHelper
-                ->getReachableCircles(
-                    $this->security->getUser(),
+                ->getReachableScopes(
                     AccompanyingPeriodVoter::SEE,
                     $center
                 );