new: dev: hardening the registration process with removing the not activated registrations #14

tests/Controller/SecurityControllerTest.php

@@ -10,6 +10,8 @@
 
 namespace App\Tests\Controller;
 
+use DateTime;
+use Doctrine\ORM\EntityManagerInterface;
 use App\Tests\Factory\UserFactory;
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestDox;
@@ -103,6 +105,25 @@ class SecurityControllerTest extends WebTestCase
         self::assertResponseRedirects('/login');
     }
 
+    #[Test]
+    #[TestDox('Expired account activation token does not activate the account')]
+    public function expiredActivationTokenDoesNotActivateAccount(): void
+    {
+        $user = UserFactory::createOne([
+            'isVerified'                 => false,
+            'verificationToken'          => 'expired-activation-token',
+            'verificationTokenExpiresAt' => new DateTime('-1 minute'),
+        ]);
+
+        $this->client->request('GET', '/activate/expired-activation-token');
+
+        self::assertResponseRedirects('/login');
+
+        static::getContainer()->get(EntityManagerInterface::class)->refresh($user->_real());
+        self::assertFalse($user->isVerified);
+        self::assertSame('expired-activation-token', $user->verificationToken);
+    }
+
     #[Test]
     #[TestDox('Password reset with invalid token redirects to forgot password')]
     public function resetPasswordWithInvalidTokenShowsError(): void