new: dev: hardening the registration process with removing the not activated registrations #14

tests/Command/PurgeExpiredPendingUsersCommandTest.php

@@ -0,0 +1,73 @@
+<?php declare(strict_types=1);
+/*
+ * This file is part of the SplendidBear Websites' projects.
+ *
+ * Copyright (c) 2026 @ www.splendidbear.org
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\Command;
+
+use App\Command\PurgeExpiredPendingUsersCommand;
+use App\Entity\User;
+use App\Tests\Factory\UserFactory;
+use App\Tests\WebTestCase;
+use DateTime;
+use Doctrine\ORM\EntityManagerInterface;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\Attributes\TestDox;
+use Symfony\Component\Console\Tester\CommandTester;
+
+#[TestDox('Purge Expired Pending Users Command')]
+class PurgeExpiredPendingUsersCommandTest extends WebTestCase
+{
+    #[Test]
+    #[TestDox('Deletes expired unverified users only')]
+    public function deletesOnlyExpiredUnverifiedUsers(): void
+    {
+        $expiredUser = UserFactory::createOne([
+            'isVerified'                 => false,
+            'verificationToken'          => 'expired-token',
+            'verificationTokenExpiresAt' => new DateTime('-1 minute'),
+        ]);
+        $pendingUser = UserFactory::createOne([
+            'isVerified'                 => false,
+            'verificationToken'          => 'valid-token',
+            'verificationTokenExpiresAt' => new DateTime('+1 day'),
+        ]);
+        $verifiedUser = UserFactory::createOne([
+            'isVerified'                 => true,
+            'verificationToken'          => 'verified-token',
+            'verificationTokenExpiresAt' => new DateTime('-1 minute'),
+        ]);
+
+        $command = static::getContainer()->get(PurgeExpiredPendingUsersCommand::class);
+        $tester = new CommandTester($command);
+        $tester->execute([]);
+
+        $em = static::getContainer()->get(EntityManagerInterface::class);
+        self::assertNull($em->find(User::class, $expiredUser->_real()->id));
+        self::assertNotNull($em->find(User::class, $pendingUser->_real()->id));
+        self::assertNotNull($em->find(User::class, $verifiedUser->_real()->id));
+    }
+
+    #[Test]
+    #[TestDox('Dry run keeps expired unverified users')]
+    public function dryRunDoesNotDeleteExpiredUsers(): void
+    {
+        $expiredUser = UserFactory::createOne([
+            'isVerified'                 => false,
+            'verificationToken'          => 'expired-token',
+            'verificationTokenExpiresAt' => new DateTime('-1 minute'),
+        ]);
+
+        $command = static::getContainer()->get(PurgeExpiredPendingUsersCommand::class);
+        $tester = new CommandTester($command);
+        $tester->execute(['--dry-run' => true]);
+
+        $em = static::getContainer()->get(EntityManagerInterface::class);
+        self::assertNotNull($em->find(User::class, $expiredUser->_real()->id));
+    }
+}

tests/Controller/SecurityControllerTest.php

@@ -10,6 +10,8 @@
 
 namespace App\Tests\Controller;
 
+use DateTime;
+use Doctrine\ORM\EntityManagerInterface;
 use App\Tests\Factory\UserFactory;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
@@ -103,6 +105,25 @@ class SecurityControllerTest extends WebTestCase
         self::assertResponseRedirects('/login');
     }
 
+    #[Test]
+    #[TestDox('Expired account activation token does not activate the account')]
+    public function expiredActivationTokenDoesNotActivateAccount(): void
+    {
+        $user = UserFactory::createOne([
+            'isVerified'                 => false,
+            'verificationToken'          => 'expired-activation-token',
+            'verificationTokenExpiresAt' => new DateTime('-1 minute'),
+        ]);
+
+        $this->client->request('GET', '/activate/expired-activation-token');
+
+        self::assertResponseRedirects('/login');
+
+        static::getContainer()->get(EntityManagerInterface::class)->refresh($user->_real());
+        self::assertFalse($user->isVerified);
+        self::assertSame('expired-activation-token', $user->verificationToken);
+    }
+
     #[Test]
     #[TestDox('Password reset with invalid token redirects to forgot password')]
     public function resetPasswordWithInvalidTokenShowsError(): void