Release 2.58 (#5952)

* bump version
* fix formatting locale reset after embedded controller sub-requests (#5944)
* fix GHSA-c6w6-57jj-62vh
* fix GHSA-m492-gv72-xvxj
* fix GHSA-jr9p-4h4j-6c58
* make sure to only use JS logic to call API endpoints
* fixes GHSA-r8vr-m544-qh4h
* make sure to only use JS logic to call API endpoints
* fix GHSA-rw46-qg69-vg6h
* fix GHSA-pj8j-p4g4-4vw8 - prevent kimai from rendering images via markdown
* fix GHSA-pj8j-p4g4-4vw8 - use a safe network client to prevent SSRF via images
* fix GHSA-xv4r-4885-gwpg
* fix GHSA-pgcc-vfmc-7cw5 - move GET routes to API with POST method to prevent CSRF
* fix tooltip survives page reload
* updated wizard images
* split wizard and password reset subscriber into two classes
* relax upper php limit
* added zizmor workflow scans and apply findings
* user permissions <name>_other_profile  now respect teams
* move all linting steps to new job
* updated docker image version names
* use .env.local for storing APP_SECRET
* improve build order and use given tag as ref for checkout, not default main branch
* improved APP_SECRET handling, see entrypoint.sh
* use local code for building the image for more flexibility, added dockerignore

tests/EventSubscriber/PasswordResetSubscriberTest.php

@@ -0,0 +1,216 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\EventSubscriber;
+
+use App\Entity\User;
+use App\EventSubscriber\PasswordResetSubscriber;
+use App\EventSubscriber\WizardSubscriber;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
+use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+#[CoversClass(PasswordResetSubscriber::class)]
+class PasswordResetSubscriberTest extends TestCase
+{
+    public function testGetSubscribedEvents(): void
+    {
+        self::assertEquals([KernelEvents::REQUEST => ['onKernelRequest', -20]], PasswordResetSubscriber::getSubscribedEvents());
+    }
+
+    public function testPasswordResetHasHigherPriorityThanWizardSubscriber(): void
+    {
+        self::assertGreaterThan(
+            WizardSubscriber::getSubscribedEvents()[KernelEvents::REQUEST][1],
+            PasswordResetSubscriber::getSubscribedEvents()[KernelEvents::REQUEST][1]
+        );
+    }
+
+    public function testOnKernelRequestIgnoresSubRequest(): void
+    {
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->never())->method('getToken');
+
+        $sut = new PasswordResetSubscriber($urlGenerator, $security, $storage);
+        $event = $this->createRequestEvent('/dashboard', false);
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    public function testOnKernelRequestIgnoresMissingToken(): void
+    {
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $security->expects($this->never())->method('isGranted');
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn(null);
+
+        $sut = new PasswordResetSubscriber($urlGenerator, $security, $storage);
+        $event = $this->createRequestEvent('/dashboard');
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    /**
+     * @return iterable<array{string}>
+     */
+    public static function provideExcludedUris(): iterable
+    {
+        yield ['/api/timesheets'];
+        yield ['/register/new'];
+        yield ['/wizard/intro'];
+    }
+
+    #[DataProvider('provideExcludedUris')]
+    public function testOnKernelRequestIgnoresExcludedUris(string $uri): void
+    {
+        $token = $this->createMock(TokenInterface::class);
+        $token->expects($this->never())->method('getUser');
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $security->expects($this->never())->method('isGranted');
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $sut = new PasswordResetSubscriber($urlGenerator, $security, $storage);
+        $event = $this->createRequestEvent($uri);
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    public function testOnKernelRequestIgnoresNonUserToken(): void
+    {
+        $token = $this->createMock(TokenInterface::class);
+        $token->expects($this->once())->method('getUser')->willReturn($this->createMock(UserInterface::class));
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $security->expects($this->never())->method('isGranted');
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $sut = new PasswordResetSubscriber($urlGenerator, $security, $storage);
+        $event = $this->createRequestEvent('/dashboard');
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    public function testOnKernelRequestIgnoresUserWithoutFullAuthentication(): void
+    {
+        $user = new User();
+        $token = $this->createUserToken($user);
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $security->expects($this->once())->method('isGranted')->with('IS_AUTHENTICATED_FULLY')->willReturn(false);
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $sut = new PasswordResetSubscriber($urlGenerator, $security, $storage);
+        $event = $this->createRequestEvent('/dashboard');
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    public function testOnKernelRequestIgnoresUserWithoutPasswordReset(): void
+    {
+        $user = new User();
+        $user->setEnabled(true);
+        $token = $this->createUserToken($user);
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $urlGenerator->expects($this->never())->method('generate');
+
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $security->expects($this->once())->method('isGranted')->with('IS_AUTHENTICATED_FULLY')->willReturn(true);
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $sut = new PasswordResetSubscriber($urlGenerator, $security, $storage);
+        $event = $this->createRequestEvent('/dashboard');
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    public function testOnKernelRequestRedirectsToPasswordWizard(): void
+    {
+        $user = new User();
+        $user->setEnabled(true);
+        $user->setRequiresPasswordReset();
+        $token = $this->createUserToken($user);
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $urlGenerator
+            ->expects($this->once())
+            ->method('generate')
+            ->with('wizard', ['wizard' => 'password'])
+            ->willReturn('/wizard/password');
+
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $security->expects($this->once())->method('isGranted')->with('IS_AUTHENTICATED_FULLY')->willReturn(true);
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $sut = new PasswordResetSubscriber($urlGenerator, $security, $storage);
+        $event = $this->createRequestEvent('/dashboard');
+
+        $sut->onKernelRequest($event);
+
+        $response = $event->getResponse();
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/wizard/password', $response->headers->get('Location'));
+    }
+
+    private function createUserToken(User $user): TokenInterface
+    {
+        $token = $this->createMock(TokenInterface::class);
+        $token->expects($this->once())->method('getUser')->willReturn($user);
+
+        return $token;
+    }
+
+    private function createRequestEvent(string $uri, bool $mainRequest = true): RequestEvent
+    {
+        $kernel = $this->createMock(HttpKernelInterface::class);
+        $request = Request::create($uri);
+
+        return new RequestEvent($kernel, $request, $mainRequest ? HttpKernelInterface::MAIN_REQUEST : HttpKernelInterface::SUB_REQUEST);
+    }
+}

tests/EventSubscriber/RedirectToLocaleSubscriberTest.php

@@ -10,31 +10,152 @@
 namespace App\Tests\EventSubscriber;
 
 use App\Configuration\LocaleService;
+use App\Entity\User;
 use App\EventSubscriber\RedirectToLocaleSubscriber;
 use PHPUnit\Framework\Attributes\CoversClass;
 use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
 use Symfony\Component\HttpKernel\KernelEvents;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 
 #[CoversClass(RedirectToLocaleSubscriber::class)]
 class RedirectToLocaleSubscriberTest extends TestCase
 {
-    public function testConstruct(): void
+    public function testGetSubscribedEvents(): void
     {
+        self::assertEquals([KernelEvents::REQUEST => ['onKernelRequest', 0]], RedirectToLocaleSubscriber::getSubscribedEvents());
+    }
+
+    public function testOnKernelRequestIgnoresNonHomepageRequest(): void
+    {
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->never())->method('getToken');
+
         $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
-        $sut = new RedirectToLocaleSubscriber($urlGenerator, new LocaleService(['de' => LocaleService::DEFAULT_SETTINGS, 'en' => LocaleService::DEFAULT_SETTINGS]));
+        $urlGenerator->expects($this->never())->method('generate');
 
-        self::assertEquals([KernelEvents::REQUEST => ['onKernelRequest']], RedirectToLocaleSubscriber::getSubscribedEvents());
-
-        $request = $this->createMock(Request::class);
-        $request->expects($this->once())->method('getPathInfo')->willReturn('/de');
-
-        $event = $this->createMock(RequestEvent::class);
-        $event->expects($this->once())->method('getRequest')->willReturn($request);
-        $event->expects($this->never())->method('setResponse');
+        $sut = new RedirectToLocaleSubscriber($urlGenerator, $this->createLocaleService(), $storage);
+        $event = $this->createRequestEvent('/de');
 
         $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    public function testOnKernelRequestIgnoresHomepageWithSameHostReferer(): void
+    {
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->never())->method('getToken');
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $urlGenerator->expects($this->never())->method('generate');
+
+        $sut = new RedirectToLocaleSubscriber($urlGenerator, $this->createLocaleService(), $storage);
+        $event = $this->createRequestEvent('/', ['referer' => 'https://www.kimai.test/de/dashboard']);
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    public function testOnKernelRequestRedirectsAuthenticatedUserToLanguage(): void
+    {
+        $user = new User();
+        $user->setLanguage('fr');
+
+        $token = $this->createMock(TokenInterface::class);
+        $token->expects($this->once())->method('getUser')->willReturn($user);
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $urlGenerator
+            ->expects($this->once())
+            ->method('generate')
+            ->with('homepage', ['_locale' => 'fr'])
+            ->willReturn('/fr');
+
+        $sut = new RedirectToLocaleSubscriber($urlGenerator, $this->createLocaleService(), $storage);
+        $event = $this->createRequestEvent('/');
+
+        $sut->onKernelRequest($event);
+
+        $response = $event->getResponse();
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/fr', $response->headers->get('Location'));
+    }
+
+    public function testOnKernelRequestRedirectsAnonymousUserToPreferredBrowserLanguage(): void
+    {
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn(null);
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $urlGenerator
+            ->expects($this->once())
+            ->method('generate')
+            ->with('homepage', ['_locale' => 'de'])
+            ->willReturn('/de');
+
+        $sut = new RedirectToLocaleSubscriber($urlGenerator, $this->createLocaleService(), $storage);
+        $event = $this->createRequestEvent('/', ['Accept-Language' => 'de-DE,de;q=0.9,en;q=0.8']);
+
+        $sut->onKernelRequest($event);
+
+        $response = $event->getResponse();
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/de', $response->headers->get('Location'));
+    }
+
+    public function testOnKernelRequestFallsBackToDefaultLocaleForAnonymousUser(): void
+    {
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn(null);
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $urlGenerator
+            ->expects($this->once())
+            ->method('generate')
+            ->with('homepage', ['_locale' => 'en'])
+            ->willReturn('/en');
+
+        $sut = new RedirectToLocaleSubscriber($urlGenerator, $this->createLocaleService(), $storage);
+        $event = $this->createRequestEvent('/', ['Accept-Language' => 'es-ES,es;q=0.9']);
+
+        $sut->onKernelRequest($event);
+
+        $response = $event->getResponse();
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/en', $response->headers->get('Location'));
+    }
+
+    private function createLocaleService(): LocaleService
+    {
+        return new LocaleService([
+            'de' => [...LocaleService::DEFAULT_SETTINGS, 'translation' => true],
+            'en' => [...LocaleService::DEFAULT_SETTINGS, 'translation' => true],
+            'fr' => [...LocaleService::DEFAULT_SETTINGS, 'translation' => true],
+        ]);
+    }
+
+    /**
+     * @param array<string, string> $headers
+     */
+    private function createRequestEvent(string $uri, array $headers = []): RequestEvent
+    {
+        $kernel = $this->createMock(HttpKernelInterface::class);
+        $request = Request::create($uri, 'GET', [], [], [], ['HTTP_HOST' => 'www.kimai.test', 'HTTPS' => 'on']);
+
+        foreach ($headers as $name => $value) {
+            $request->headers->set($name, $value);
+        }
+
+        return new RequestEvent($kernel, $request, HttpKernelInterface::MAIN_REQUEST);
     }
 }

tests/EventSubscriber/UserEnvironmentSubscriberTest.php

@@ -0,0 +1,145 @@
+<?php
+
+/*
+ * This file is part of the Kimai time-tracking app.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace App\Tests\EventSubscriber;
+
+use App\Configuration\LocaleService;
+use App\Entity\User;
+use App\EventSubscriber\UserEnvironmentSubscriber;
+use App\Twig\LocaleFormatExtensions;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Event\FinishRequestEvent;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
+use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
+
+#[CoversClass(UserEnvironmentSubscriber::class)]
+class UserEnvironmentSubscriberTest extends TestCase
+{
+    private string $defaultLocale;
+    private string $defaultTimezone;
+
+    protected function setUp(): void
+    {
+        $this->defaultLocale = \Locale::getDefault();
+        $this->defaultTimezone = date_default_timezone_get();
+    }
+
+    protected function tearDown(): void
+    {
+        \Locale::setDefault($this->defaultLocale);
+        date_default_timezone_set($this->defaultTimezone);
+    }
+
+    public function testGetSubscribedEvents(): void
+    {
+        self::assertEquals([
+            KernelEvents::REQUEST => ['prepareEnvironment', -10],
+            KernelEvents::FINISH_REQUEST => ['restoreLocale', -20],
+        ], UserEnvironmentSubscriber::getSubscribedEvents());
+    }
+
+    public function testPrepareEnvironmentUsesRequestLocaleWithoutAuthenticatedUser(): void
+    {
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn(null);
+
+        $auth = $this->createMock(AuthorizationCheckerInterface::class);
+        $auth->expects($this->never())->method('isGranted');
+
+        $localeExtension = $this->createLocaleFormatExtensions();
+        $sut = new UserEnvironmentSubscriber($storage, $auth, $localeExtension);
+
+        $sut->prepareEnvironment($this->createRequestEvent('fr', true));
+
+        self::assertSame('fr', \Locale::getDefault());
+        self::assertSame('fr', $localeExtension->getLocale());
+        self::assertSame($this->defaultTimezone, date_default_timezone_get());
+    }
+
+    public function testPrepareEnvironmentUsesUserLocaleTimezoneAndPermission(): void
+    {
+        $user = new User();
+        $user->setLocale('de');
+        $user->setTimezone('Europe/Berlin');
+
+        $token = $this->createMock(TokenInterface::class);
+        $token->expects($this->once())->method('getUser')->willReturn($user);
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $auth = $this->createMock(AuthorizationCheckerInterface::class);
+        $auth->expects($this->once())->method('isGranted')->with('view_all_data')->willReturn(true);
+
+        $localeExtension = $this->createLocaleFormatExtensions();
+        $sut = new UserEnvironmentSubscriber($storage, $auth, $localeExtension);
+
+        $sut->prepareEnvironment($this->createRequestEvent('en', true));
+
+        self::assertSame('de', \Locale::getDefault());
+        self::assertSame('de', $localeExtension->getLocale());
+        self::assertSame('Europe/Berlin', date_default_timezone_get());
+        self::assertTrue($user->canSeeAllData());
+    }
+
+    public function testRestoreLocaleAfterSubRequest(): void
+    {
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn(null);
+
+        $auth = $this->createMock(AuthorizationCheckerInterface::class);
+        $auth->expects($this->never())->method('isGranted');
+
+        $localeExtension = $this->createLocaleFormatExtensions();
+        $sut = new UserEnvironmentSubscriber($storage, $auth, $localeExtension);
+
+        $sut->prepareEnvironment($this->createRequestEvent('de', true));
+
+        \Locale::setDefault('it');
+        $localeExtension->setLocale('it');
+
+        $sut->restoreLocale($this->createFinishRequestEvent(false));
+
+        self::assertSame('de', \Locale::getDefault());
+        self::assertSame('de', $localeExtension->getLocale());
+    }
+
+    private function createLocaleFormatExtensions(): LocaleFormatExtensions
+    {
+        return new LocaleFormatExtensions(new LocaleService([
+            'de' => LocaleService::DEFAULT_SETTINGS,
+            'en' => LocaleService::DEFAULT_SETTINGS,
+            'fr' => LocaleService::DEFAULT_SETTINGS,
+            'it' => LocaleService::DEFAULT_SETTINGS,
+        ]));
+    }
+
+    private function createRequestEvent(string $locale, bool $mainRequest): RequestEvent
+    {
+        $kernel = $this->createMock(HttpKernelInterface::class);
+        $request = new Request();
+        $request->setLocale($locale);
+
+        return new RequestEvent($kernel, $request, $mainRequest ? HttpKernelInterface::MAIN_REQUEST : HttpKernelInterface::SUB_REQUEST);
+    }
+
+    private function createFinishRequestEvent(bool $mainRequest): FinishRequestEvent
+    {
+        $kernel = $this->createMock(HttpKernelInterface::class);
+        $request = new Request();
+
+        return new FinishRequestEvent($kernel, $request, $mainRequest ? HttpKernelInterface::MAIN_REQUEST : HttpKernelInterface::SUB_REQUEST);
+    }
+}

tests/EventSubscriber/WizardSubscriberTest.php

@@ -9,20 +9,214 @@
 
 namespace App\Tests\EventSubscriber;
 
+use App\Entity\User;
 use App\EventSubscriber\WizardSubscriber;
+use App\Tests\Mocks\SystemConfigurationFactory;
 use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\HttpKernel\HttpKernelInterface;
 use Symfony\Component\HttpKernel\KernelEvents;
+use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
 
 #[CoversClass(WizardSubscriber::class)]
 class WizardSubscriberTest extends TestCase
 {
     public function testGetSubscribedEvents(): void
     {
-        $events = WizardSubscriber::getSubscribedEvents();
-        self::assertArrayHasKey(KernelEvents::REQUEST, $events);
-        $methodName = $events[KernelEvents::REQUEST][0];
-        self::assertIsString($methodName);
-        self::assertTrue(method_exists(WizardSubscriber::class, $methodName));
+        self::assertEquals([KernelEvents::REQUEST => ['onKernelRequest', -30]], WizardSubscriber::getSubscribedEvents());
+    }
+
+    public function testOnKernelRequestIgnoresSubRequest(): void
+    {
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->never())->method('getToken');
+
+        $sut = new WizardSubscriber($urlGenerator, $security, $storage, SystemConfigurationFactory::createStub());
+        $event = $this->createRequestEvent('/dashboard', false);
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    public function testOnKernelRequestIgnoresMissingToken(): void
+    {
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $security->expects($this->never())->method('isGranted');
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn(null);
+
+        $sut = new WizardSubscriber($urlGenerator, $security, $storage, SystemConfigurationFactory::createStub());
+        $event = $this->createRequestEvent('/dashboard');
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    /**
+     * @return iterable<array{string}>
+     */
+    public static function provideExcludedUris(): iterable
+    {
+        yield ['/api/timesheets'];
+        yield ['/register/new'];
+        yield ['/wizard/intro'];
+    }
+
+    #[DataProvider('provideExcludedUris')]
+    public function testOnKernelRequestIgnoresExcludedUris(string $uri): void
+    {
+        $token = $this->createMock(TokenInterface::class);
+        $token->expects($this->never())->method('getUser');
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $security->expects($this->never())->method('isGranted');
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $sut = new WizardSubscriber($urlGenerator, $security, $storage, SystemConfigurationFactory::createStub());
+        $event = $this->createRequestEvent($uri);
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    public function testOnKernelRequestIgnoresNonUserToken(): void
+    {
+        $token = $this->createMock(TokenInterface::class);
+        $token->expects($this->once())->method('getUser')->willReturn($this->createMock(UserInterface::class));
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $security->expects($this->never())->method('isGranted');
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $sut = new WizardSubscriber($urlGenerator, $security, $storage, SystemConfigurationFactory::createStub([
+            'user' => [
+                'wizard' => true,
+            ]
+        ]));
+        $event = $this->createRequestEvent('/dashboard');
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    public function testOnKernelRequestIgnoresUserWithoutFullAuthentication(): void
+    {
+        $user = new User();
+        $token = $this->createUserToken($user);
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $security->expects($this->once())->method('isGranted')->with('IS_AUTHENTICATED_FULLY')->willReturn(false);
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $sut = new WizardSubscriber($urlGenerator, $security, $storage, SystemConfigurationFactory::createStub([
+            'user' => [
+                'wizard' => true,
+            ]
+        ]));
+        $event = $this->createRequestEvent('/dashboard');
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    public function testOnKernelRequestIgnoresWizardForRegularUserIfDisabled(): void
+    {
+        $user = new User();
+        $token = $this->createUserToken($user);
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $urlGenerator->expects($this->never())->method('generate');
+
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $security->expects($this->once())->method('isGranted')->with('IS_AUTHENTICATED_FULLY')->willReturn(true);
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $sut = new WizardSubscriber($urlGenerator, $security, $storage, SystemConfigurationFactory::createStub([
+            'user' => [
+                'wizard' => false,
+            ]
+        ]));
+        $event = $this->createRequestEvent('/dashboard');
+
+        $sut->onKernelRequest($event);
+
+        self::assertNull($event->getResponse());
+    }
+
+    public function testOnKernelRequestRedirectsToFirstUnseenWizard(): void
+    {
+        $user = new User();
+        $user->setWizardAsSeen('intro');
+        $token = $this->createUserToken($user);
+
+        $urlGenerator = $this->createMock(UrlGeneratorInterface::class);
+        $urlGenerator
+            ->expects($this->once())
+            ->method('generate')
+            ->with('wizard', ['wizard' => 'profile'])
+            ->willReturn('/wizard/profile');
+
+        $security = $this->createMock(AuthorizationCheckerInterface::class);
+        $security->expects($this->once())->method('isGranted')->with('IS_AUTHENTICATED_FULLY')->willReturn(true);
+
+        $storage = $this->createMock(TokenStorageInterface::class);
+        $storage->expects($this->once())->method('getToken')->willReturn($token);
+
+        $sut = new WizardSubscriber($urlGenerator, $security, $storage, SystemConfigurationFactory::createStub([
+            'user' => [
+                'wizard' => true,
+            ]
+        ]));
+        $event = $this->createRequestEvent('/dashboard');
+
+        $sut->onKernelRequest($event);
+
+        $response = $event->getResponse();
+        self::assertInstanceOf(RedirectResponse::class, $response);
+        self::assertSame('/wizard/profile', $response->headers->get('Location'));
+    }
+
+    private function createUserToken(User $user): TokenInterface
+    {
+        $token = $this->createMock(TokenInterface::class);
+        $token->expects($this->once())->method('getUser')->willReturn($user);
+
+        return $token;
+    }
+
+    private function createRequestEvent(string $uri, bool $mainRequest = true): RequestEvent
+    {
+        $kernel = $this->createMock(HttpKernelInterface::class);
+        $request = Request::create($uri);
+
+        return new RequestEvent($kernel, $request, $mainRequest ? HttpKernelInterface::MAIN_REQUEST : HttpKernelInterface::SUB_REQUEST);
     }
 }