fix: crash on empty-quiz overview and answer-mapping, use FlashType enum consistently

- fetchWithQuestionsAndCandidates / fetchWithQuestions used INNER JOINs on
  questions/answers, so quizzes with no questions threw NoResultException (500)
  when opening the overview tab. Switched to LEFT JOINs.
- answerMapping bare \assert() replaced with a proper flash + redirect when
  the quiz has no questions, instead of crashing with AssertionError.
- Three raw 'success' flash strings in QuizController replaced with FlashType::Success.
- Added Dutch translation for "This quiz has no questions yet".
- Two new tests: empty-quiz overview loads (200), answer-mapping redirects with flash.

.githooks/pre-commit

@@ -0,0 +1,48 @@
+#!/usr/bin/env zsh
+setopt ERR_EXIT PIPE_FAIL NOUNSET
+
+# Collect staged PHP and Twig files
+STAGED_PHP=()
+while IFS= read -r file; do
+    [[ -n "$file" ]] && STAGED_PHP+=("$file")
+done < <(git diff --cached --name-only --diff-filter=ACMR | grep -E '\.php$' || true)
+
+STAGED_TWIG=()
+while IFS= read -r file; do
+    [[ -n "$file" ]] && STAGED_TWIG+=("$file")
+done < <(git diff --cached --name-only --diff-filter=ACMR | grep -E '\.twig$' || true)
+
+if [[ ${#STAGED_PHP[@]} -eq 0 && ${#STAGED_TWIG[@]} -eq 0 ]]; then
+    exit 0
+fi
+
+# Use exec if the service is up, otherwise spin up a one-off container
+if docker compose exec -T php true 2>/dev/null; then
+    DOCKER_CMD=(docker compose exec -T php)
+else
+    echo "PHP service not running — using docker compose run..."
+    DOCKER_CMD=(docker compose run --rm php)
+fi
+
+if [[ ${#STAGED_PHP[@]} -gt 0 ]]; then
+    echo "PHP (${#STAGED_PHP[@]} file(s)): Rector → CS-Fixer → PHPStan"
+
+    echo "  → Rector"
+    "${DOCKER_CMD[@]}" vendor/bin/rector process "${STAGED_PHP[@]}"
+    git add "${STAGED_PHP[@]}"
+
+    echo "  → PHP-CS-Fixer"
+    "${DOCKER_CMD[@]}" vendor/bin/php-cs-fixer fix --config=.php-cs-fixer.dist.php "${STAGED_PHP[@]}"
+    git add "${STAGED_PHP[@]}"
+
+    echo "  → PHPStan"
+    "${DOCKER_CMD[@]}" vendor/bin/phpstan analyse "${STAGED_PHP[@]}" --no-progress
+fi
+
+if [[ ${#STAGED_TWIG[@]} -gt 0 ]]; then
+    echo "Twig (${#STAGED_TWIG[@]} file(s)): Twig-CS-Fixer"
+
+    echo "  → Twig-CS-Fixer"
+    "${DOCKER_CMD[@]}" vendor/bin/twig-cs-fixer fix "${STAGED_TWIG[@]}"
+    git add "${STAGED_TWIG[@]}"
+fi

.github/dependabot.yml

@@ -7,9 +7,28 @@ version: 2
 updates:
   - package-ecosystem: "composer" # See documentation for possible values
     directory: "/" # Location of package manifests
+    allow:
+      # Allow both direct and indirect updates for all packages
+      - dependency-type: "all"
     schedule:
       interval: "daily"
+    ignore:
+      - dependency-name: "symfony/*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+      symfony:
+        patterns:
+          - "symfony/*"
+      twig:
+        patterns:
+          - "twig/*"
   - package-ecosystem: "docker"
-    directtory: "/"
+    directory: "/"
     schedule:
       interval: "daily"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -15,44 +15,134 @@ concurrency:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
-  tests:
-    name: Tests
+  build:
+    name: Build Dev Image
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: "!startsWith(github.ref, 'refs/tags/')"
+    permissions:
+      contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
       - name: Lint Dockerfile
-        uses: hadolint/hadolint-action@v3.1.0
+        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
       - name: Build Docker images
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
         with:
           pull: true
+          files: |
+            compose.yaml
+            compose.override.yaml
+          set: |
+            *.cache-from=type=gha,scope=${{github.ref}}-devbuild
+            *.cache-from=type=gha,scope=refs/heads/main-devbuild
+            *.cache-to=type=gha,scope=${{github.ref}}-devbuild,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }}
+
+  quality:
+    name: Code Quality
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    needs: build
+    if: "!startsWith(github.ref, 'refs/tags/')"
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - name: Load Docker images
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
+        with:
           load: true
           files: |
             compose.yaml
             compose.override.yaml
           set: |
-            *.cache-from=type=gha,scope=${{github.ref}}
-            *.cache-from=type=gha,scope=refs/heads/main
-            *.cache-to=type=gha,scope=${{github.ref}},mode=max
+            *.cache-from=type=gha,scope=${{github.ref}}-devbuild
       - name: Start services
         run: docker compose up php database --wait --no-build
+      - name: Warm up dev cache
+        run: docker compose exec -T php bin/console cache:warmup --env=dev
       - name: Lint Twig templates
+        id: twig_lint
+        continue-on-error: true
         run: docker compose exec -T php bin/console lint:twig --format=github templates
       - name: Coding Style
+        id: cs
+        continue-on-error: true
         run: docker compose exec -T php vendor/bin/php-cs-fixer check --diff --show-progress=none
       - name: Twig Coding Style
+        id: twig_cs
+        continue-on-error: true
         run: docker compose exec -T php vendor/bin/twig-cs-fixer check
+      - name: Static Analysis (PHPStan)
+        id: phpstan
+        continue-on-error: true
+        run: docker compose exec -T php vendor/bin/phpstan analyse --no-progress --no-ansi --error-format=github
+      - name: Rector
+        id: rector
+        continue-on-error: true
+        run: docker compose exec -T php vendor/bin/rector process --dry-run --no-progress-bar --output-format=github
       - name: Check HTTP reachability
         run: curl -v --fail-with-body http://localhost
-      - name: Check Mercure reachability
-        if: false
-        run: curl -vkI --fail-with-body https://localhost/.well-known/mercure?topic=test
+      - name: Assert all checks passed
+        if: always()
+        run: |
+          failed=0
+          check() {
+            local name="$1" outcome="$2"
+            if [[ "$outcome" == "failure" ]]; then
+              echo "::error::$name failed"
+              failed=1
+            fi
+          }
+          check "Twig Lint"        "${{ steps.twig_lint.outcome }}"
+          check "Coding Style"     "${{ steps.cs.outcome }}"
+          check "Twig Coding Style" "${{ steps.twig_cs.outcome }}"
+          check "PHPStan"          "${{ steps.phpstan.outcome }}"
+          check "Rector"           "${{ steps.rector.outcome }}"
+          exit $failed
+
+  tests:
+    name: Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    needs: build
+    if: "!startsWith(github.ref, 'refs/tags/')"
+    permissions:
+      checks: write
+      pull-requests: write
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - name: Load Docker images
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
+        with:
+          load: true
+          files: |
+            compose.yaml
+            compose.override.yaml
+          set: |
+            *.cache-from=type=gha,scope=${{github.ref}}-devbuild
+      - name: Start services
+        run: docker compose up php database --wait --no-build
+      - name: Build SCSS
+        run: docker compose exec -T php bin/console sass:build
       - name: Create test database
         run: docker compose exec -T php bin/console -e test doctrine:database:create
       - name: Run migrations
@@ -60,25 +150,81 @@ jobs:
       - name: Load fixtures
         run: docker compose exec -T php bin/console -e test doctrine:fixtures:load --no-interaction --group=test
       - name: Run PHPUnit
-        run: docker compose exec -T php vendor/bin/phpunit
+        run: docker compose exec -T php vendor/bin/phpunit --log-junit var/phpunit/junit.xml
+      - name: Publish PHPUnit test results
+        if: always()
+        uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16 # v6
+        with:
+          report_paths: var/phpunit/junit.xml
+          check_name: PHPUnit
       - name: Doctrine Schema Validator
         run: docker compose exec -T php bin/console -e test doctrine:schema:validate
-  
-  build-deploy:
-    name: Build and deploy to ${{ startsWith(github.ref, 'refs/tags/') && 'production' || (github.ref == 'refs/heads/main' && 'acceptance' || '') }}
-    environment:
-      name: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || (github.ref == 'refs/heads/main' && 'acceptance' || '') }}
-      url: ${{ vars.URL }}
-    needs: tests
+
+  verify-prior-run:
+    name: Verify Prior CI Run
     runs-on: ubuntu-latest
-    if: (github.ref == 'refs/heads/main' && false) || startsWith(github.ref, 'refs/tags/')
+    timeout-minutes: 20
+    if: startsWith(github.ref, 'refs/tags/')
+    permissions:
+      actions: read
+    steps:
+      - name: Wait for and verify successful CI run on this commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          max_attempts=30
+          attempt=0
+          while [[ $attempt -lt $max_attempts ]]; do
+            attempt=$((attempt + 1))
+
+            success_count=$(gh api \
+              "repos/${{ github.repository }}/actions/workflows/ci.yml/runs?head_sha=${{ github.sha }}&status=success&per_page=5" \
+              --jq "[.workflow_runs[] | select(.id != ${{ github.run_id }})] | length")
+
+            if [[ "$success_count" -gt 0 ]]; then
+              echo "Found $success_count prior successful CI run(s) for ${{ github.sha }}."
+              exit 0
+            fi
+
+            in_progress_count=$(gh api \
+              "repos/${{ github.repository }}/actions/workflows/ci.yml/runs?head_sha=${{ github.sha }}&per_page=10" \
+              --jq "[.workflow_runs[] | select(.id != ${{ github.run_id }}) | select(.status == \"in_progress\" or .status == \"queued\" or .status == \"waiting\" or .status == \"requested\" or .status == \"pending\")] | length")
+
+            if [[ "$in_progress_count" -gt 0 ]]; then
+              echo "CI still in progress (attempt $attempt/$max_attempts), waiting 30s..."
+              sleep 30
+            else
+              echo "::error::No prior successful CI run found for ${{ github.sha }}. Only tag commits that have passed CI on main."
+              exit 1
+            fi
+          done
+
+          echo "::error::Timed out waiting for CI run to complete for ${{ github.sha }}."
+          exit 1
+
+  build-deploy:
+    name: Build and Deploy
+    permissions:
+      contents: read
+      packages: write
+    environment:
+      name: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'acceptance' }}
+      url: ${{ vars.URL }}
+    needs: [quality, tests, verify-prior-run]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: >-
+      always() && !cancelled() && !failure() &&
+      ((github.ref == 'refs/heads/main' && false) || startsWith(github.ref, 'refs/tags/'))
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -90,20 +236,23 @@ jobs:
           REPO_LOWER=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
           if [[ "${{ github.ref }}" == refs/tags/* ]]; then
             TAG="${GITHUB_REF#refs/tags/}"
+            SENTRY_VERSION="${TAG#v}"
             {
               echo "tag=$TAG"
+              echo "sentry_version=$SENTRY_VERSION"
               echo "full_name=ghcr.io/${REPO_LOWER}:$TAG"
             } >> "$GITHUB_OUTPUT"
           else
             SHORT_SHA=$(git rev-parse --short HEAD)
             {
               echo "tag=$SHORT_SHA"
+              echo "sentry_version=$SHORT_SHA"
               echo "full_name=ghcr.io/${REPO_LOWER}:$SHORT_SHA"
             } >> "$GITHUB_OUTPUT"
           fi
 
       - name: Build and Push Docker images
-        uses: docker/bake-action@v5
+        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7
         with:
           pull: true
           push: true
@@ -116,9 +265,21 @@ jobs:
             *.cache-to=type=gha,scope=${{github.ref}},mode=max
             *.tags=${{ steps.meta.outputs.full_name }}
 
+      - name: Create Sentry release
+        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
+          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
+        with:
+          release: ${{steps.meta.outputs.sentry_version}}
+          environment: ${{ startsWith(github.ref, 'refs/tags/') && 'production' || 'acceptance' }}
+
       - name: Trigger Portainer Deployment
         shell: bash
         env:
           PORTAINER_WEBHOOK: ${{secrets.PORTAINER_WEBHOOK}}
+          IMAGE_TAG: ${{steps.meta.outputs.tag}}
+          SENTRY_RELEASE: ${{steps.meta.outputs.sentry_version}}
         run: |
-          curl -v -X POST "$PORTAINER_WEBHOOK"?IMAGE_TAG=${{steps.meta.outputs.tag}} --fail-with-body
+          curl -v -X POST "${PORTAINER_WEBHOOK}?IMAGE_TAG=${IMAGE_TAG}&SENTRY_RELEASE=${SENTRY_RELEASE}" --fail-with-body

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,25 @@
+name: Dependabot auto-merge
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v3
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Enable auto-merge for Dependabot PRs
+        if: contains(steps.metadata.outputs.dependency-type, 'development')
+        run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

.gitignore

@@ -72,10 +72,8 @@ Icon
 /.idea/
 /.vscode/
 
-# Junie
-!/.junie/
-/.junie/memory/
-/.junie/plans/
+# Claude Code
+/.claude/settings.local.json
 
 # Windows
 Thumbs.db

.idea/TijdVoorDeTest.iml

@@ -4,6 +4,7 @@
     <content url="file://$MODULE_DIR$">
       <sourceFolder url="file://$MODULE_DIR$/src" isTestSource="false" packagePrefix="Tvdt\" />
       <sourceFolder url="file://$MODULE_DIR$/tests" isTestSource="true" packagePrefix="Tvdt\Tests\" />
+      <sourceFolder url="file://$MODULE_DIR$/vendor/maennchen/zipstream-php/test" isTestSource="true" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/clue/ndjson-react" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/composer" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/doctrine/collections" />
@@ -166,6 +167,10 @@
       <excludeFolder url="file://$MODULE_DIR$/vendor/gedmo/doctrine-extensions" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/stof/doctrine-extensions-bundle" />
       <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/git-state" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/ergebnis/agent-detector" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/polyfill-deepclone" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/sebastian/file-filter" />
+      <excludeFolder url="file://$MODULE_DIR$/vendor/symfony/object-mapper" />
     </content>
     <orderEntry type="inheritedJdk" />
     <orderEntry type="sourceFolder" forTests="false" />

.idea/dataSources.xml

@@ -13,5 +13,17 @@
       </jdbc-additional-properties>
       <working-dir>$ProjectFileDir$</working-dir>
     </data-source>
+    <data-source source="LOCAL" name="Prod DB" uuid="2cfa902e-fb09-4e39-a09c-15bdbe41ec57">
+      <driver-ref>postgresql</driver-ref>
+      <synchronize>true</synchronize>
+      <jdbc-driver>org.postgresql.Driver</jdbc-driver>
+      <jdbc-url>jdbc:postgresql://10.0.0.21:5430/postgres</jdbc-url>
+      <jdbc-additional-properties>
+        <property name="com.intellij.clouds.kubernetes.db.host.port" />
+        <property name="com.intellij.clouds.kubernetes.db.enabled" value="false" />
+        <property name="com.intellij.clouds.kubernetes.db.container.port" />
+      </jdbc-additional-properties>
+      <working-dir>$ProjectFileDir$</working-dir>
+    </data-source>
   </component>
 </project>

.idea/inspectionProfiles/Project_Default.xml

@@ -73,6 +73,7 @@
     <inspection_tool class="PhpFullyQualifiedNameUsageInspection" enabled="true" level="WEAK WARNING" enabled_by_default="true">
       <option name="IGNORE_GLOBAL_NAMESPACE" value="true" />
     </inspection_tool>
+    <inspection_tool class="PhpPublicPropertyModifierCanBeOmittedInspection" enabled="false" level="WEAK WARNING" enabled_by_default="false" />
     <inspection_tool class="PhpStanGlobal" enabled="true" level="WEAK WARNING" enabled_by_default="true" />
     <inspection_tool class="SecurityAdvisoriesInspection" enabled="true" level="WARNING" enabled_by_default="true">
       <option name="optionConfiguration">

.idea/php.xml

@@ -41,90 +41,134 @@
   </component>
   <component name="PhpIncludePathManager">
     <include_path>
-      <path value="$PROJECT_DIR$/vendor/symfony/cache" />
-      <path value="$PROJECT_DIR$/vendor/symfony/validator" />
-      <path value="$PROJECT_DIR$/vendor/symfony/dotenv" />
-      <path value="$PROJECT_DIR$/vendor/symfony/serializer" />
+      <path value="$PROJECT_DIR$/vendor/composer" />
+      <path value="$PROJECT_DIR$/vendor/dama/doctrine-test-bundle" />
+      <path value="$PROJECT_DIR$/vendor/clue/ndjson-react" />
+      <path value="$PROJECT_DIR$/vendor/psr/http-factory" />
+      <path value="$PROJECT_DIR$/vendor/psr/clock" />
+      <path value="$PROJECT_DIR$/vendor/twig/twig" />
+      <path value="$PROJECT_DIR$/vendor/twig/intl-extra" />
+      <path value="$PROJECT_DIR$/vendor/twig/extra-bundle" />
+      <path value="$PROJECT_DIR$/vendor/stof/doctrine-extensions-bundle" />
+      <path value="$PROJECT_DIR$/vendor/psr/event-dispatcher" />
+      <path value="$PROJECT_DIR$/vendor/psr/cache" />
+      <path value="$PROJECT_DIR$/vendor/psr/simple-cache" />
+      <path value="$PROJECT_DIR$/vendor/psr/log" />
+      <path value="$PROJECT_DIR$/vendor/psr/container" />
+      <path value="$PROJECT_DIR$/vendor/psr/http-message" />
+      <path value="$PROJECT_DIR$/vendor/rector/rector" />
+      <path value="$PROJECT_DIR$/vendor/jean85/pretty-package-versions" />
+      <path value="$PROJECT_DIR$/vendor/react/child-process" />
+      <path value="$PROJECT_DIR$/vendor/react/socket" />
+      <path value="$PROJECT_DIR$/vendor/egulias/email-validator" />
+      <path value="$PROJECT_DIR$/vendor/staabm/side-effects-detector" />
+      <path value="$PROJECT_DIR$/vendor/sentry/sentry" />
+      <path value="$PROJECT_DIR$/vendor/sentry/sentry-symfony" />
+      <path value="$PROJECT_DIR$/vendor/react/event-loop" />
+      <path value="$PROJECT_DIR$/vendor/nikic/php-parser" />
+      <path value="$PROJECT_DIR$/vendor/gedmo/doctrine-extensions" />
+      <path value="$PROJECT_DIR$/vendor/fidry/cpu-core-counter" />
+      <path value="$PROJECT_DIR$/vendor/react/dns" />
+      <path value="$PROJECT_DIR$/vendor/react/promise" />
+      <path value="$PROJECT_DIR$/vendor/react/stream" />
+      <path value="$PROJECT_DIR$/vendor/react/cache" />
+      <path value="$PROJECT_DIR$/vendor/phpunit/php-text-template" />
+      <path value="$PROJECT_DIR$/vendor/phpunit/phpunit" />
+      <path value="$PROJECT_DIR$/vendor/phpunit/php-timer" />
+      <path value="$PROJECT_DIR$/vendor/phpstan/phpdoc-parser" />
+      <path value="$PROJECT_DIR$/vendor/symfony/framework-bundle" />
+      <path value="$PROJECT_DIR$/vendor/phpunit/php-file-iterator" />
+      <path value="$PROJECT_DIR$/vendor/phpunit/php-invoker" />
+      <path value="$PROJECT_DIR$/vendor/phpunit/php-code-coverage" />
+      <path value="$PROJECT_DIR$/vendor/phpstan/phpstan" />
+      <path value="$PROJECT_DIR$/vendor/phar-io/version" />
+      <path value="$PROJECT_DIR$/vendor/phar-io/manifest" />
+      <path value="$PROJECT_DIR$/vendor/myclabs/deep-copy" />
+      <path value="$PROJECT_DIR$/vendor/phpstan/extension-installer" />
+      <path value="$PROJECT_DIR$/vendor/phpstan/phpstan-phpunit" />
+      <path value="$PROJECT_DIR$/vendor/phpstan/phpstan-symfony" />
+      <path value="$PROJECT_DIR$/vendor/phpstan/phpstan-doctrine" />
       <path value="$PROJECT_DIR$/vendor/symfony/intl" />
       <path value="$PROJECT_DIR$/vendor/symfony/security-bundle" />
       <path value="$PROJECT_DIR$/vendor/symfony/browser-kit" />
       <path value="$PROJECT_DIR$/vendor/symfony/asset" />
-      <path value="$PROJECT_DIR$/vendor/phpunit/php-file-iterator" />
-      <path value="$PROJECT_DIR$/vendor/phpunit/php-invoker" />
-      <path value="$PROJECT_DIR$/vendor/phpunit/php-code-coverage" />
-      <path value="$PROJECT_DIR$/vendor/phpunit/php-text-template" />
-      <path value="$PROJECT_DIR$/vendor/symfony/ux-turbo" />
-      <path value="$PROJECT_DIR$/vendor/symfony/form" />
-      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-intl-icu" />
-      <path value="$PROJECT_DIR$/vendor/symfony/framework-bundle" />
-      <path value="$PROJECT_DIR$/vendor/symfony/mailer" />
-      <path value="$PROJECT_DIR$/vendor/symfony/brevo-mailer" />
-      <path value="$PROJECT_DIR$/vendor/symfony/var-dumper" />
-      <path value="$PROJECT_DIR$/vendor/symfony/phpunit-bridge" />
-      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-intl-idn" />
-      <path value="$PROJECT_DIR$/vendor/symfony/security-csrf" />
-      <path value="$PROJECT_DIR$/vendor/symfony/options-resolver" />
-      <path value="$PROJECT_DIR$/vendor/symfony/filesystem" />
       <path value="$PROJECT_DIR$/vendor/symfony/security-http" />
       <path value="$PROJECT_DIR$/vendor/symfony/config" />
       <path value="$PROJECT_DIR$/vendor/symfony/translation-contracts" />
       <path value="$PROJECT_DIR$/vendor/symfony/translation" />
-      <path value="$PROJECT_DIR$/vendor/symfony/runtime" />
-      <path value="$PROJECT_DIR$/vendor/symfony/event-dispatcher" />
-      <path value="$PROJECT_DIR$/vendor/symfony/asset-mapper" />
-      <path value="$PROJECT_DIR$/vendor/symfony/uid" />
-      <path value="$PROJECT_DIR$/vendor/symfony/http-client" />
-      <path value="$PROJECT_DIR$/vendor/symfony/finder" />
-      <path value="$PROJECT_DIR$/vendor/symfony/twig-bundle" />
-      <path value="$PROJECT_DIR$/vendor/symfony/property-access" />
-      <path value="$PROJECT_DIR$/vendor/symfony/yaml" />
-      <path value="$PROJECT_DIR$/vendor/symfony/http-kernel" />
-      <path value="$PROJECT_DIR$/vendor/symfony/psr-http-message-bridge" />
-      <path value="$PROJECT_DIR$/vendor/symfony/stopwatch" />
+      <path value="$PROJECT_DIR$/vendor/symfony/ux-turbo" />
+      <path value="$PROJECT_DIR$/vendor/symfony/form" />
+      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-intl-icu" />
+      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-deepclone" />
+      <path value="$PROJECT_DIR$/vendor/symfony/cache" />
+      <path value="$PROJECT_DIR$/vendor/symfony/validator" />
+      <path value="$PROJECT_DIR$/vendor/symfony/dotenv" />
+      <path value="$PROJECT_DIR$/vendor/symfony/serializer" />
+      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-intl-idn" />
+      <path value="$PROJECT_DIR$/vendor/symfony/security-csrf" />
+      <path value="$PROJECT_DIR$/vendor/symfony/options-resolver" />
+      <path value="$PROJECT_DIR$/vendor/symfony/filesystem" />
       <path value="$PROJECT_DIR$/vendor/symfony/web-profiler-bundle" />
       <path value="$PROJECT_DIR$/vendor/symfony/polyfill-uuid" />
       <path value="$PROJECT_DIR$/vendor/symfony/twig-bridge" />
       <path value="$PROJECT_DIR$/vendor/symfony/maker-bundle" />
-      <path value="$PROJECT_DIR$/vendor/symfony/dom-crawler" />
-      <path value="$PROJECT_DIR$/vendor/symfony/event-dispatcher-contracts" />
-      <path value="$PROJECT_DIR$/vendor/symfony/css-selector" />
-      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-intl-normalizer" />
-      <path value="$PROJECT_DIR$/vendor/symfony/var-exporter" />
-      <path value="$PROJECT_DIR$/vendor/symfony/doctrine-bridge" />
-      <path value="$PROJECT_DIR$/vendor/symfony/http-foundation" />
-      <path value="$PROJECT_DIR$/vendor/symfony/type-info" />
-      <path value="$PROJECT_DIR$/vendor/symfony/dependency-injection" />
-      <path value="$PROJECT_DIR$/vendor/symfony/cache-contracts" />
-      <path value="$PROJECT_DIR$/vendor/symfony/error-handler" />
-      <path value="$PROJECT_DIR$/vendor/symfony/flex" />
+      <path value="$PROJECT_DIR$/vendor/symfony/runtime" />
+      <path value="$PROJECT_DIR$/vendor/symfony/event-dispatcher" />
+      <path value="$PROJECT_DIR$/vendor/symfony/asset-mapper" />
+      <path value="$PROJECT_DIR$/vendor/symfony/uid" />
+      <path value="$PROJECT_DIR$/vendor/symfony/mailer" />
+      <path value="$PROJECT_DIR$/vendor/symfony/brevo-mailer" />
+      <path value="$PROJECT_DIR$/vendor/symfony/var-dumper" />
+      <path value="$PROJECT_DIR$/vendor/symfony/phpunit-bridge" />
+      <path value="$PROJECT_DIR$/vendor/symfony/yaml" />
+      <path value="$PROJECT_DIR$/vendor/symfony/http-kernel" />
+      <path value="$PROJECT_DIR$/vendor/symfony/psr-http-message-bridge" />
+      <path value="$PROJECT_DIR$/vendor/symfony/stopwatch" />
       <path value="$PROJECT_DIR$/vendor/symfony/deprecation-contracts" />
       <path value="$PROJECT_DIR$/vendor/symfony/security-core" />
       <path value="$PROJECT_DIR$/vendor/symfony/string" />
       <path value="$PROJECT_DIR$/vendor/symfony/mime" />
-      <path value="$PROJECT_DIR$/vendor/symfony/property-info" />
-      <path value="$PROJECT_DIR$/vendor/symfony/http-client-contracts" />
-      <path value="$PROJECT_DIR$/vendor/symfony/service-contracts" />
-      <path value="$PROJECT_DIR$/vendor/symfony/routing" />
+      <path value="$PROJECT_DIR$/vendor/symfony/dom-crawler" />
+      <path value="$PROJECT_DIR$/vendor/symfony/event-dispatcher-contracts" />
+      <path value="$PROJECT_DIR$/vendor/symfony/css-selector" />
+      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-intl-normalizer" />
+      <path value="$PROJECT_DIR$/vendor/symfony/http-client" />
+      <path value="$PROJECT_DIR$/vendor/symfony/finder" />
+      <path value="$PROJECT_DIR$/vendor/symfony/twig-bundle" />
+      <path value="$PROJECT_DIR$/vendor/symfony/property-access" />
+      <path value="$PROJECT_DIR$/vendor/symfony/dependency-injection" />
+      <path value="$PROJECT_DIR$/vendor/symfony/cache-contracts" />
+      <path value="$PROJECT_DIR$/vendor/symfony/error-handler" />
+      <path value="$PROJECT_DIR$/vendor/symfony/flex" />
       <path value="$PROJECT_DIR$/vendor/symfony/process" />
       <path value="$PROJECT_DIR$/vendor/symfony/password-hasher" />
       <path value="$PROJECT_DIR$/vendor/symfony/clock" />
       <path value="$PROJECT_DIR$/vendor/symfony/stimulus-bundle" />
+      <path value="$PROJECT_DIR$/vendor/symfony/property-info" />
+      <path value="$PROJECT_DIR$/vendor/symfony/http-client-contracts" />
+      <path value="$PROJECT_DIR$/vendor/symfony/service-contracts" />
+      <path value="$PROJECT_DIR$/vendor/symfony/routing" />
+      <path value="$PROJECT_DIR$/vendor/symfony/var-exporter" />
+      <path value="$PROJECT_DIR$/vendor/symfony/doctrine-bridge" />
+      <path value="$PROJECT_DIR$/vendor/symfony/http-foundation" />
+      <path value="$PROJECT_DIR$/vendor/symfony/type-info" />
       <path value="$PROJECT_DIR$/vendor/theseer/tokenizer" />
       <path value="$PROJECT_DIR$/vendor/symfony/polyfill-intl-grapheme" />
       <path value="$PROJECT_DIR$/vendor/symfony/console" />
+      <path value="$PROJECT_DIR$/vendor/doctrine/orm" />
       <path value="$PROJECT_DIR$/vendor/doctrine/instantiator" />
       <path value="$PROJECT_DIR$/vendor/doctrine/doctrine-fixtures-bundle" />
       <path value="$PROJECT_DIR$/vendor/doctrine/persistence" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/inflector" />
+      <path value="$PROJECT_DIR$/vendor/doctrine/deprecations" />
       <path value="$PROJECT_DIR$/vendor/doctrine/sql-formatter" />
       <path value="$PROJECT_DIR$/vendor/doctrine/collections" />
       <path value="$PROJECT_DIR$/vendor/doctrine/event-manager" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/orm" />
+      <path value="$PROJECT_DIR$/vendor/doctrine/migrations" />
       <path value="$PROJECT_DIR$/vendor/doctrine/doctrine-migrations-bundle" />
+      <path value="$PROJECT_DIR$/vendor/doctrine/inflector" />
       <path value="$PROJECT_DIR$/vendor/doctrine/dbal" />
       <path value="$PROJECT_DIR$/vendor/doctrine/lexer" />
       <path value="$PROJECT_DIR$/vendor/doctrine/data-fixtures" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/migrations" />
       <path value="$PROJECT_DIR$/vendor/sebastian/object-reflector" />
       <path value="$PROJECT_DIR$/vendor/sebastian/object-enumerator" />
       <path value="$PROJECT_DIR$/vendor/sebastian/global-state" />
@@ -135,74 +179,32 @@
       <path value="$PROJECT_DIR$/vendor/sebastian/complexity" />
       <path value="$PROJECT_DIR$/vendor/maennchen/zipstream-php" />
       <path value="$PROJECT_DIR$/vendor/evenement/evenement" />
+      <path value="$PROJECT_DIR$/vendor/ergebnis/agent-detector" />
       <path value="$PROJECT_DIR$/vendor/doctrine/doctrine-bundle" />
-      <path value="$PROJECT_DIR$/vendor/doctrine/deprecations" />
       <path value="$PROJECT_DIR$/vendor/ralouphie/getallheaders" />
       <path value="$PROJECT_DIR$/vendor/phpoffice/phpspreadsheet" />
       <path value="$PROJECT_DIR$/vendor/markbaker/matrix" />
       <path value="$PROJECT_DIR$/vendor/markbaker/complex" />
-      <path value="$PROJECT_DIR$/vendor/phpdocumentor/type-resolver" />
-      <path value="$PROJECT_DIR$/vendor/phpdocumentor/reflection-common" />
       <path value="$PROJECT_DIR$/vendor/symfonycasts/sass-bundle" />
       <path value="$PROJECT_DIR$/vendor/symfonycasts/verify-email-bundle" />
-      <path value="$PROJECT_DIR$/vendor/thecodingmachine/safe" />
-      <path value="$PROJECT_DIR$/vendor/martin-georgiev/postgresql-for-doctrine" />
+      <path value="$PROJECT_DIR$/vendor/friendsofphp/php-cs-fixer" />
+      <path value="$PROJECT_DIR$/vendor/guzzlehttp/psr7" />
       <path value="$PROJECT_DIR$/vendor/vincentlanglet/twig-cs-fixer" />
       <path value="$PROJECT_DIR$/vendor/phpdocumentor/reflection-docblock" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/environment" />
+      <path value="$PROJECT_DIR$/vendor/phpdocumentor/type-resolver" />
+      <path value="$PROJECT_DIR$/vendor/phpdocumentor/reflection-common" />
       <path value="$PROJECT_DIR$/vendor/sebastian/cli-parser" />
       <path value="$PROJECT_DIR$/vendor/sebastian/version" />
       <path value="$PROJECT_DIR$/vendor/sebastian/type" />
-      <path value="$PROJECT_DIR$/vendor/friendsofphp/php-cs-fixer" />
-      <path value="$PROJECT_DIR$/vendor/guzzlehttp/psr7" />
+      <path value="$PROJECT_DIR$/vendor/sebastian/file-filter" />
       <path value="$PROJECT_DIR$/vendor/webmozart/assert" />
-      <path value="$PROJECT_DIR$/vendor/sebastian/exporter" />
-      <path value="$PROJECT_DIR$/vendor/thecodingmachine/phpstan-safe-rule" />
-      <path value="$PROJECT_DIR$/vendor/composer" />
-      <path value="$PROJECT_DIR$/vendor/psr/log" />
-      <path value="$PROJECT_DIR$/vendor/psr/container" />
-      <path value="$PROJECT_DIR$/vendor/psr/http-message" />
-      <path value="$PROJECT_DIR$/vendor/psr/event-dispatcher" />
-      <path value="$PROJECT_DIR$/vendor/clue/ndjson-react" />
-      <path value="$PROJECT_DIR$/vendor/psr/http-factory" />
-      <path value="$PROJECT_DIR$/vendor/psr/clock" />
-      <path value="$PROJECT_DIR$/vendor/psr/simple-cache" />
-      <path value="$PROJECT_DIR$/vendor/psr/cache" />
-      <path value="$PROJECT_DIR$/vendor/react/promise" />
-      <path value="$PROJECT_DIR$/vendor/react/stream" />
-      <path value="$PROJECT_DIR$/vendor/react/cache" />
-      <path value="$PROJECT_DIR$/vendor/react/event-loop" />
-      <path value="$PROJECT_DIR$/vendor/jean85/pretty-package-versions" />
-      <path value="$PROJECT_DIR$/vendor/react/child-process" />
-      <path value="$PROJECT_DIR$/vendor/react/socket" />
-      <path value="$PROJECT_DIR$/vendor/react/dns" />
-      <path value="$PROJECT_DIR$/vendor/twig/intl-extra" />
-      <path value="$PROJECT_DIR$/vendor/twig/extra-bundle" />
-      <path value="$PROJECT_DIR$/vendor/stof/doctrine-extensions-bundle" />
-      <path value="$PROJECT_DIR$/vendor/dama/doctrine-test-bundle" />
-      <path value="$PROJECT_DIR$/vendor/nikic/php-parser" />
-      <path value="$PROJECT_DIR$/vendor/gedmo/doctrine-extensions" />
-      <path value="$PROJECT_DIR$/vendor/fidry/cpu-core-counter" />
-      <path value="$PROJECT_DIR$/vendor/twig/twig" />
-      <path value="$PROJECT_DIR$/vendor/phpstan/phpstan-phpunit" />
-      <path value="$PROJECT_DIR$/vendor/phpstan/phpstan-symfony" />
-      <path value="$PROJECT_DIR$/vendor/phpstan/phpstan-doctrine" />
-      <path value="$PROJECT_DIR$/vendor/phpstan/phpstan" />
-      <path value="$PROJECT_DIR$/vendor/phpunit/phpunit" />
-      <path value="$PROJECT_DIR$/vendor/phpunit/php-timer" />
-      <path value="$PROJECT_DIR$/vendor/phpstan/phpdoc-parser" />
-      <path value="$PROJECT_DIR$/vendor/phpstan/extension-installer" />
-      <path value="$PROJECT_DIR$/vendor/staabm/side-effects-detector" />
-      <path value="$PROJECT_DIR$/vendor/sentry/sentry" />
-      <path value="$PROJECT_DIR$/vendor/sentry/sentry-symfony" />
-      <path value="$PROJECT_DIR$/vendor/rector/rector" />
-      <path value="$PROJECT_DIR$/vendor/phar-io/version" />
-      <path value="$PROJECT_DIR$/vendor/phar-io/manifest" />
-      <path value="$PROJECT_DIR$/vendor/myclabs/deep-copy" />
-      <path value="$PROJECT_DIR$/vendor/egulias/email-validator" />
-      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-php84" />
-      <path value="$PROJECT_DIR$/vendor/symfony/polyfill-php85" />
       <path value="$PROJECT_DIR$/vendor/sebastian/git-state" />
+      <path value="$PROJECT_DIR$/vendor/sebastian/exporter" />
+      <path value="$PROJECT_DIR$/vendor/sebastian/environment" />
+      <path value="$PROJECT_DIR$/vendor/thecodingmachine/phpstan-safe-rule" />
+      <path value="$PROJECT_DIR$/vendor/thecodingmachine/safe" />
+      <path value="$PROJECT_DIR$/vendor/martin-georgiev/postgresql-for-doctrine" />
+      <path value="$PROJECT_DIR$/vendor/symfony/object-mapper" />
     </include_path>
   </component>
   <component name="PhpInterpreters">

AGENTS.md

@@ -1,82 +0,0 @@
-# Agent Guide: Tijd Voor De Test (Tvdt)
-
-This document provides essential context and instructions for AI agents working on the **Tijd Voor De Test** project.
-
-## Project Overview
-A web application for managing "Wie is de Mol?" style tests, including seasons, quizzes, candidates, and eliminations.
-
-- **Namespace**: `Tvdt`
-- **PHP Version**: 8.5+
-- **Framework**: Symfony 8.0
-
-## Tech Stack
-- **Server**: FrankenPHP (Caddy-based PHP server)
-- **Database**: PostgreSQL
-- **Frontend**: Symfony Asset Mapper (no Node.js/Webpack), Stimulus, Turbo
-- **Styling**: Sass (via `symfonycasts/sass-bundle`)
-- **Persistence**: Doctrine ORM 3.x
-
-## Core Domain Entities
-- **Season**: Groups quizzes and candidates for a specific period.
-- **SeasonSettings**: Configuration for a season.
-- **Quiz**: A test within a season containing multiple questions.
-- **Question**: Questions belonging to a quiz.
-- **Answer**: Possible answers for a question.
-- **Candidate**: A participant in the season.
-- **QuizCandidate**: Represents a candidate's attempt at a specific quiz (tracking start/end time).
-- **GivenAnswer**: The specific answer a candidate selected during a quiz.
-- **Elimination**: Records of red/green screens and forced results.
-- **User**: Administrative accounts for managing the system.
-
-## Development Workflow
-The project uses `just` as the primary task runner. Always prefer `just` commands over manual docker calls.
-
-### Common Commands
-- `just up`: Start the environment.
-- `just down`: Stop the environment.
-- `just shell`: Enter the PHP container.
-- `just migrate`: Run database migrations.
-- `just fixtures`: Load development fixtures.
-- `just fix-cs`: Run `php-cs-fixer` and `twig-cs-fixer`.
-- `just phpstan`: Run static analysis.
-- `just rector`: Run Rector for automated refactorings.
-- `just reload-tests`: Reset the test database and load test fixtures.
-
-## Coding Standards
-- **PSR-12**: Follow standard PHP coding styles.
-- **Strict Typing**: Use strict types in all PHP files.
-- **Doctrine ORM 3**: Be aware of ORM 3 changes (e.g., lazy loading behavior, attribute-based mapping).
-- **Symfony 8**: Use modern Symfony features (Attributes, Type-hinting).
-- **Safe Functions**: Use `thecodingmachine/safe` for standard PHP functions that throw exceptions instead of returning false.
-
-## Testing
-- **Framework**: PHPUnit
-- **Bundle**: `dama/doctrine-test-bundle` is used to wrap tests in transactions.
-- **Location**: `tests/` directory mirroring `src/`.
-- **Execution**: Run via `bin/phpunit` inside the container or `just reload-tests` to prepare the environment.
-
-## Frontend Development
-- JavaScript is managed via **Import Maps**.
-- Stimulus controllers are located in `assets/controllers/`.
-- CSS/Sass is in `assets/styles/`.
-- Assets are compiled on-the-fly or mapped; do not look for a `node_modules` folder.
-
-## Key Components
-### Controllers
-- **Backoffice**: Located in `src/Controller/Backoffice`, handles season and quiz management.
-- **Quiz**: `src/Controller/QuizController` handles the candidate-facing side of quizzes.
-- **Elimination**: `src/Controller/EliminationController` handles elimination screens.
-
-### Services
-- **QuizSpreadsheetService**: Handles importing quizzes from XLSX files.
-
-### Base Classes & Enums
-- **AbstractController**: Base class for all controllers, containing common regexes and flash helpers.
-- **FlashType Enum**: Used for consistent flash messaging (`FlashType::Success`, `FlashType::Danger`, etc.).
-
-## Key Files
-- `composer.json`: Dependency management.
-- `importmap.php`: JavaScript module mapping.
-- `Justfile`: Automation shortcuts.
-- `config/`: Application configuration.
-- `templates/`: Twig templates.

CLAUDE.md

@@ -0,0 +1,232 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+**Tijd voor de test** is a PHP/Symfony 8.1 application for managing quizzes in the style of **Wie is de Mol?** (WIDM) — a Dutch TV show where contestants try to identify a saboteur ("de Mol") among them. At the end of each episode, participants take a quiz about the Mol's identity and actions; the candidate with the least correct answers is eliminated. This app replicates that quiz format with:
+- Test creation with variable question counts
+- Season management with active test controls
+- Candidate answer tracking with automatic timing
+- Elimination tracking with joker adjustments
+- Backoffice management for quiz administration and statistics
+
+Tech Stack:
+- **Framework**: Symfony 8.1
+- **PHP**: 8.5+
+- **Database**: PostgreSQL 16
+- **ORM**: Doctrine
+- **Server**: FrankenPHP with Caddy
+- **Container**: Docker Compose
+- **Frontend**: Twig templates with SASS (via asset mapper)
+- **Testing**: PHPUnit 13 with DAMA Doctrine test bundle
+
+## Build & Development Commands
+
+All commands assume Docker is running. The project uses a [Justfile](https://just.systems) as the primary interface.
+
+### Essential Commands
+
+```bash
+just up           # Start Docker services (PHP, PostgreSQL)
+just stop         # Stop services
+just down         # Stop and remove containers/orphans
+just shell        # Interactive shell inside the PHP container
+just shell-run    # Shell in a fresh one-off container
+```
+
+### Database
+
+```bash
+just migrate                  # Run Doctrine migrations (starts services first)
+just fixtures                 # Load dev fixtures (truncates first)
+just reload-tests             # Drop/recreate test DB, migrate, load test fixtures
+```
+
+### Testing
+
+```bash
+just test                                  # Run full PHPUnit suite
+just test tests/Path/To/TestFile.php       # Run a specific test file
+just test --coverage-html var/coverage     # Generate HTML coverage report
+```
+
+### Code Quality & Linting
+
+```bash
+just fix-cs                        # Auto-fix PHP-CS-Fixer + Twig-CS-Fixer
+just phpstan                       # PHPStan static analysis (level 9)
+just phpstan --no-progress         # Without progress output
+just rector                        # Apply Rector modernizations
+just rector --dry-run              # Preview Rector changes
+```
+
+### Other
+
+```bash
+just translations   # Extract/update nl translation strings
+just clean          # Nuke containers (volumes) + all generated files (prompts for confirmation)
+just trust-cert     # Trust the local Caddy TLS certificate (macOS)
+just exec <cmd>     # Run any command inside the PHP container
+```
+
+All code quality checks run in CI/CD (.github/workflows/ci.yml) and should pass before merging.
+
+## Project Structure
+
+```
+src/
+  Controller/              # HTTP request handlers (attribute-routed)
+    Backoffice/           # Admin panel controllers
+  Entity/                 # Doctrine ORM entities
+  Repository/             # Database queries
+  Service/                # Business logic
+  Command/                # CLI commands
+  Form/                   # Symfony form types
+  Dto/                    # Data transfer objects
+  Enum/                   # Enumerations (FlashType, etc.)
+  Exception/              # Custom exceptions
+  Factory/                # Object factories
+  Helpers/                # Utility functions
+  Security/               # Auth and voter classes
+    Voter/                # Authorization voters
+  DataFixtures/           # Test data loaders
+
+config/
+  packages/               # Symfony bundle configurations
+  routes/                 # Route definitions
+  services.yaml           # Service container configuration
+  routes.yaml             # Main route entry point
+
+templates/
+  backoffice/             # Admin UI templates
+  quiz/                   # Public quiz UI templates
+  base.html.twig          # Main layout
+
+tests/
+  Command/                # Command tests
+  Controller/             # Controller/integration tests
+  Repository/             # Repository tests
+  Security/               # Auth tests
+  Helpers/                # Utility tests
+  bootstrap.php           # PHPUnit bootstrap with test container setup
+```
+
+## Core Domain Entities
+
+- **Season**: Groups quizzes and candidates for a specific period, with a linked `SeasonSettings`.
+- **Quiz**: A test within a season containing multiple `Question`s, each with multiple `Answer`s.
+- **Candidate**: A participant in the season.
+- **QuizCandidate**: Represents a candidate's attempt at a specific quiz (tracks start/end time).
+- **GivenAnswer**: The specific answer a candidate selected during a quiz.
+- **Elimination**: Records red/green screens and forced results with joker adjustments.
+- **User**: Administrative accounts for managing the system.
+
+## Architecture Notes
+
+### Routing
+- Routes are **attribute-based** (PHP 8 attributes in controller methods)
+- Configured in `config/routes/attributes.yaml` for automatic discovery
+- Main entry point: `config/routes.yaml`
+
+### Service Container & Dependency Injection
+- Services in `src/` are automatically registered via PSR-4 namespace `Tvdt\`
+- Exclusions: Entity, DependencyInjection, Kernel classes
+- Autowiring and autoconfiguration enabled by default
+- Service definitions in `config/services.yaml`
+
+### Database & Migrations
+- PostgreSQL-based with Doctrine ORM
+- Migrations in `migrations/` at project root, namespace `DoctrineMigrations` (intentionally not autoloaded); generate with `bin/console make:migration`
+- Test fixtures in `src/DataFixtures/` (loaded with `--group=test`)
+- Test database configured separately via `.env.test`
+
+### Testing Infrastructure
+- **PHPUnit 13** with DAMA Doctrine Test Bundle for transaction rollback
+- Bootstrap: `tests/bootstrap.php` loads env vars and autoloader; `tests/symfony-container.php` boots the test kernel/container (used by Rector)
+- Symfony test utilities (BrowserKit, CSS selectors) available
+- Coverage excluded from: `src/DataFixtures/`
+- Test environment: `APP_ENV=test` (set in phpunit.dist.xml)
+
+### Code Style & Standards
+- **PHP-CS-Fixer**: Symfony ruleset + risky rules enabled
+  - Strict types declaration required
+  - Trailing commas in multiline structures
+  - No else-only blocks
+- **Rector**: Aggressive modernization with all attribute sets + prepared sets (dead code, code quality, Doctrine, Symfony, PHPUnit)
+- **PHPStan**: Level 8 with extensions for Doctrine and Symfony
+- **Twig-CS-Fixer**: Template style enforcement
+- **Safe functions**: Use `thecodingmachine/safe` wrappers for standard PHP functions that return `false` on failure — they throw exceptions instead
+
+### Environment Configuration
+- `.env` - Local development defaults (uncommitted in .env.local)
+- `.env.dev` - Development overrides
+- `.env.test` - Test environment configuration
+- Production uses `composer dump-env prod` for compiled configuration
+- Key variables:
+  - `APP_ENV` - Environment (dev/test/prod)
+  - `DATABASE_URL` - PostgreSQL connection string
+  - `MAILER_SENDER` - From address for emails
+
+### Frontend Build
+- Asset mapper (no Node.js/Webpack) for JS/CSS bundling; JS modules declared in `importmap.php`
+- **Stimulus** controllers in `assets/controllers/`, **Turbo** for SPA-like navigation
+- Sass sources in `assets/styles/`, compiled via `bin/console sass:build`
+- Production: Assets precompiled during Docker build
+- Development: Watch mode enabled in FrankenPHP container
+
+## CI/CD Pipeline
+
+GitHub Actions workflow (`.github/workflows/ci.yml`):
+
+1. **Linting**: Dockerfile (hadolint), Twig templates
+2. **Code Quality**:
+   - PHP-CS-Fixer style check
+   - Twig-CS-Fixer style check
+   - PHPStan static analysis
+   - Rector dry-run
+3. **Integration Tests**:
+   - Docker image build and start services
+   - Database creation and migration
+   - Fixture loading
+   - Full PHPUnit test suite with JUnit XML output
+   - Doctrine schema validation
+4. **Build & Deploy** (on tags or main, disabled currently):
+   - Docker image push to GitHub Container Registry
+   - Sentry release creation
+   - Portainer webhook trigger for production deployment
+
+Runs on all pushes to main and pull requests. Concurrency cancels old runs on new commits.
+
+## Important Files & Conventions
+
+- **Kernel**: `src/Kernel.php` - Symfony kernel class
+- **AbstractController**: Base class for all controllers — defines route parameter regexes (`SEASON_CODE_REGEX`, `CANDIDATE_HASH_REGEX`) and flash helpers
+- **Flash Messages**: Use `FlashType` enum instead of string literals
+- **QuizSpreadsheetService**: Handles importing quizzes from XLSX files
+- **Rector container**: `tests/symfony-container.php` — boots a test kernel so Rector can resolve Symfony service types
+- **.gitignore**: Excludes var/, vendor/, .env.local, .phpunit.cache
+- **Dockerfile**: Multi-stage build with dev/prod separation, FrankenPHP-based
+- **Docker Compose**: PHP service with Caddy, PostgreSQL database, persistent volumes
+
+## Security & Authorization
+
+- Doctrine extensions enabled (timestamps, slugs, etc.)
+- Voter-based authorization in `src/Security/Voter/`
+- User entity with security encoding configured
+- CSRF protection enabled
+- Email verification available via SymfonyCasts bundle
+
+## Composer Scripts
+
+Auto-executed scripts on install/update:
+- `cache:clear` - Symfony cache clear
+- `assets:install` - Copy public assets
+- `importmap:install` - JS import map setup
+
+## Notes for Future Work
+
+- The backoffice elimination logic is in `Controller/Backoffice/PrepareEliminationController.php`
+- Quiz timing logic starts on candidate start click and stops on final answer selection
+- Background music feature noted but not yet implemented (requirements only)
+- Statistics functionality is marked TBD in README

Justfile

@@ -14,7 +14,9 @@ exec *args:
 shell:
     @docker compose exec php bash
 
-bash: shell
+[no-exit-message]
+shell-run:
+    @docker compose run --rm php bash
 
 migrate: up
     docker compose run --rm php bin/console doctrine:migrations:migrate --no-interaction
@@ -49,6 +51,11 @@ reload-tests:
     @docker compose exec php bin/console --env=test doctrine:migrations:migrate -n
     @docker compose exec php bin/console --env=test doctrine:fixtures:load -n --group=test
 
+install-hooks:
+    git config core.hooksPath .githooks
+    chmod +x .githooks/pre-commit
+    @echo "Pre-commit hook installed."
+
 trust-cert:
     sudo security add-trusted-cer -d \
     -r trustRoot \

LICENSE

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published
+    by the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

Makefile

@@ -1,16 +0,0 @@
-.DEFAULT_GOAL := help
-
-.PHONY: up
-up: ## Start application
-	@docker compose up -d
-
-stop: ## Stop application
-	@docker compose stop
-
-.PHONY: shell
-shell: ## Start a shell inside the container
-	@docker compose exec php bash
-
-.PHONY: help
-help:
-	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-10s\033[0m %s\n", $$1, $$2}'

README.md

@@ -1,39 +1,162 @@
 # Tijd voor de test
 
+![CI](https://github.com/MarijnDoeve/TijdVoorDeTest/actions/workflows/ci.yml/badge.svg)
+
+PHP/Symfony application for WIDM-style quiz management.
+Built with FrankenPHP, PostgreSQL, and Docker.
+
+> **Disclaimer:** This is an unofficial, non-commercial, open-source fan
+> project. It is not affiliated with, endorsed by, or associated with
+> *Wie is de Mol?* (produced by IDTV, broadcast by AVROTROS/NPO) or
+> *De Mol* (produced by Woestijnvis, broadcast by Play/De Vijver Media).
+> *Wie is de Mol?* and *De Mol* are trademarks of their respective rights
+> holders. No copyright infringement is intended.
+
 ## Requirements
 
-### Maken van de test
+- Docker
+- [Just](https://just.systems) (`brew install just`)
 
-- WIDM-tests met een variabel aantal vragen.
-- Vragen in een vaste volgorde zijn samen één test (een vraag kan niet bij
-  meerdere tests horen).
-- Vragen hebben 2 of meer antwoordmogelijkheden. Slechts één antwoord is correct.
-- Meerdere test samen vormen een seizoen.
-- Een seizoen heeft één of geen actieve tests, als er een test actief is kan
-  uitsluitend die test gemaakt worden.
-- Kandidaten kunnen een test maximaal 1 keer invullen.
-- Vanaf het moment dat de kandidaat op start klikt na het intypen van hun naam
-  gaat de tijd lopen. Deze stopt na het aanklikken van een antwoord op de laatste
-  vraag van de test.
-- Achtergrondmuziek
+## Local development
 
-### Schermen kijken
+```bash
+just up        # Start PHP + PostgreSQL containers
+just migrate   # Run pending database migrations
+just fixtures  # Load dev fixtures (truncates first)
+```
 
-- Nadat een speler een test heeft gemaakt (of vooraf als de namen vooraf
-  ingevoerd zijn) kunnen jokers toegekend worden aan de test van kandidaat. Een
-  positief getal om antwoorden goed te rekenen, een negatief getal om
-  antwoorden fout te rekenen.
-- Vooraf kan gekozen worden hoe veel afvallers er zijn.
-- Bij het kijken naam rode en groene schermen wordt een naam ingevoerd. Er
-  wordt een rood of groen scherm getoond.
-- Spelers kunnen geforceerd op groen of rood gezet worden, deze worden dan niet
-  meegenomen in de berekening van de slechtste speler.
+The app is available at **https://localhost** (self-signed cert — run
+`just trust-cert` on macOS to trust it).
 
-### Statistieken
+### Useful commands
 
-TBD
+```bash
+just shell              # Shell inside the running PHP container
+just shell-run          # Shell in a fresh one-off container
+just stop               # Stop containers (keep volumes)
+just down               # Stop and remove containers
+just clean              # Nuclear: remove containers + volumes + generated files
+just exec <cmd>         # Run any command inside the PHP container
+```
 
-## Nice to haves
+### Environment
 
-- Optie voor antwoord geven in twee klikken (selecteren en volgende).
+Copy `.env` and override locally via `.env.local` (not committed):
 
+| Variable       | Description                         |
+|----------------|-------------------------------------|
+| `APP_SECRET`   | Symfony app secret                  |
+| `DATABASE_URL` | PostgreSQL DSN (auto-set in Docker) |
+| `SENTRY_DSN`   | Sentry error tracking               |
+| `DEFAULT_URI`  | Base URL for CLI-generated links    |
+
+## Testing
+
+```bash
+just test                                   # Full PHPUnit suite
+just test tests/Path/To/TestFile.php        # Single file
+just test --coverage-html var/coverage      # HTML coverage report
+just reload-tests             # Drop/recreate test DB + migrate + test fixtures
+```
+
+Tests use a separate database configured via `.env.test`. The DAMA
+Doctrine bundle wraps each test in a transaction that is rolled back after.
+`just reload-tests` loads the `--group=test` fixtures; `just fixtures`
+loads the dev group and is unrelated to the test database.
+
+## Code quality
+
+All checks run in CI and must pass before merging.
+
+```bash
+just fix-cs              # Auto-fix PHP-CS-Fixer + Twig-CS-Fixer
+just phpstan             # PHPStan static analysis (level 8)
+just rector              # Apply Rector modernizations
+just rector --dry-run    # Preview Rector changes without applying
+```
+
+## Database
+
+```bash
+just migrate                      # Run pending migrations
+just fixtures                     # Load dev fixtures
+bin/console make:migration        # Generate a new migration (inside container)
+```
+
+Migrations live in `migrations/` (namespace `DoctrineMigrations`). Test
+fixtures are in `src/DataFixtures/` loaded with `--group=test`.
+
+## Translations
+
+```bash
+just translations    # Extract/update nl translation strings into translations/
+```
+
+## Contributing
+
+1. Create a branch from `main` — use a prefix like `feat/`, `fix/`,
+   or `docs/`.
+2. Open a pull request; CI must pass before merging.
+3. Install the pre-commit hook (see below) to catch issues before pushing.
+
+### Pre-commit hook
+
+A pre-commit hook lives in `.githooks/pre-commit`. Install it once after cloning:
+
+```bash
+just install-hooks
+```
+
+On every commit it runs automatically, **only on staged files**:
+
+| Staged file type        | Tools run                                                                    |
+|-------------------------|------------------------------------------------------------------------------|
+| `.php`                  | Rector → PHP-CS-Fixer (auto-fix + re-stage), then PHPStan (blocks on errors) |
+| `.twig`                 | Twig-CS-Fixer (auto-fix + re-stage)                                          |
+| Other (docs, config, …) | Nothing — commit proceeds immediately                                        |
+
+If the PHP container is not running, the hook falls back to
+`docker compose run --rm` so checks still execute. PHPUnit is not
+run in the hook; CI covers that.
+
+## Deployment
+
+Docker images are published to `ghcr.io/marijndoeve/tijdvoordetest`
+for each tagged release.
+
+### First-time setup
+
+1. Copy `compose.yaml` and `compose.prod.yaml` to your server.
+2. Create a `.env.prod.local` file with the required variables (see below).
+3. Start the stack — migrations run automatically on container start:
+
+```bash
+IMAGE_TAG=latest docker compose -f compose.yaml -f compose.prod.yaml up -d
+```
+
+### Updating to a new version
+
+```bash
+IMAGE_TAG=<tag> docker compose -f compose.yaml -f compose.prod.yaml pull
+IMAGE_TAG=<tag> docker compose -f compose.yaml -f compose.prod.yaml up -d
+```
+
+### Required environment variables
+
+| Variable                   | Description                                 |
+|----------------------------|---------------------------------------------|
+| `IMAGE_TAG`                | Image tag to run (e.g. `1.2.3` or `latest`) |
+| `APP_SECRET`               | Random secret string for Symfony            |
+| `CADDY_MERCURE_JWT_SECRET` | JWT secret for the Mercure hub              |
+| `POSTGRES_PASSWORD`        | PostgreSQL password                         |
+| `MAILER_DSN`               | Mailer transport DSN                        |
+| `MAILER_SENDER`            | From address for emails                     |
+| `SENTRY_DSN`               | Sentry project DSN (optional)               |
+
+The `compose.prod.yaml` configures Traefik labels for TLS termination at
+`tijdvoordetest.nl`. Adjust the `traefik` labels in that file if you're
+hosting on a different domain or using a different reverse proxy.
+
+## License
+
+[MIT](LICENSE)

assets/controllers.json

@@ -3,7 +3,10 @@
         "@symfony/ux-turbo": {
             "turbo-core": {
                 "enabled": false,
-                "fetch": "eager"
+                "fetch": "eager",
+                "autoimport": {
+                    "@symfony/ux-turbo/dist/mercure_stream_source_element.js": true
+                }
             },
             "mercure-turbo-stream": {
                 "enabled": false,

assets/controllers/bo/form_collection_controller.js

@@ -0,0 +1,21 @@
+import {Controller} from '@hotwired/stimulus';
+
+export default class extends Controller {
+  static targets = ['collection'];
+  static values = {prototype: String};
+
+  connect() {
+    this.index = this.collectionTarget.children.length;
+  }
+
+  addItem() {
+    const item = document.createElement('div');
+    item.innerHTML = this.prototypeValue.replace(/__name__/g, this.index);
+    this.collectionTarget.appendChild(item.firstElementChild);
+    this.index++;
+  }
+
+  removeItem(event) {
+    event.target.closest('[data-collection-item]').remove();
+  }
+}

assets/styles/backoffice.scss

@@ -0,0 +1,3 @@
+.col-result-xs { width: 10%; }
+.col-result-sm { width: 15%; }
+.col-result-md { width: 20%; }

assets/styles/quiz.scss

@@ -1,14 +1,97 @@
-html, body {
+html {
     height: 100%;
     background-image: url("../img/background.png");
-    background-position: center center;
+    background-position: center;
     background-repeat: no-repeat;
     background-color: black;
     color: white;
-
     display: grid;
     align-items: center;
-    justify-self: center;
+}
+
+body {
+    height: 100%;
+    background-image: url("../img/background.png");
+    background-position: center;
+    background-repeat: no-repeat;
+    background-color: black;
+    display: grid;
+    align-content: center;
+}
+
+.quiz-form-narrow {
+    max-width: 320px;
+    width: 100%;
+    margin: 0 auto;
+}
+
+.quiz-content {
+    width: fit-content;
+    max-width: min(760px, 100%);
+    margin: 0 auto;
+}
+
+.quiz-answers-grid {
+    display: grid;
+    grid-template-columns: repeat(2, auto);
+    column-gap: 2rem;
+
+    @media (max-width: 767px) {
+        grid-template-columns: 1fr;
+    }
+}
+
+.answer-btn {
+    display: flex;
+    align-items: center;
+    gap: 0.8rem;
+    background: transparent;
+    border: none;
+    color: white;
+    font-size: 1.1rem;
+    padding: 0.4rem 0;
+    cursor: pointer;
+    text-align: left;
+    line-height: 1.3;
+
+    &::before {
+        content: '';
+        display: block;
+        flex-shrink: 0;
+        width: 2rem;
+        height: 2rem;
+        background: radial-gradient(ellipse at 35% 30%, #6abf4b, #2d7a1f);
+        border-radius: 4px;
+        box-shadow: inset 0 1px 2px rgba(255, 255, 255, 0.25), 0 2px 6px rgba(0, 0, 0, 0.6);
+    }
+
+    &:hover,
+    &:focus {
+        color: #7ed45a;
+        outline: none;
+
+        &::before {
+            background: radial-gradient(ellipse at 35% 30%, #86d45f, #3d9c2a);
+        }
+    }
+}
+
+input.btn-check:checked + label.answer-btn {
+    color: #7ed45a;
+
+    &::before {
+        background: radial-gradient(ellipse at 35% 30%, #86d45f, #3d9c2a);
+        box-shadow: 0 0 10px rgba(106, 191, 75, 0.7), inset 0 1px 2px rgba(255, 255, 255, 0.3);
+    }
+}
+
+.quiz-topbar {
+    position: fixed;
+    top: 1rem;
+    right: 1rem;
+    z-index: 1030;
+    display: flex;
+    gap: 0.5rem;
 }
 
 .elimination-screen {

compose.override.yaml

@@ -7,6 +7,7 @@ services:
       target: frankenphp_dev
     volumes:
       - ./:/app
+      - ~/.composer/cache:/root/.composer/cache
       - ./frankenphp/Caddyfile:/etc/caddy/Caddyfile:ro
       - ./frankenphp/conf.d/20-app.dev.ini:/usr/local/etc/php/app.conf.d/20-app.dev.ini:ro
       - ./frankenphp/data:/data
@@ -46,6 +47,8 @@ services:
       - sass:build
       - --watch
       - -v
+    healthcheck:
+      disable: true
   
   ###> symfony/mercure-bundle ###
   ###< symfony/mercure-bundle ###
@@ -61,7 +64,7 @@ services:
     image: axllent/mailpit
     ports:
       - "1025"
-      - "8025"
+      - "8025:8025"
     environment:
       MP_SMTP_AUTH_ACCEPT_ANY: 1
       MP_SMTP_AUTH_ALLOW_INSECURE: 1

compose.prod.yaml

@@ -10,7 +10,7 @@ services:
       MAILER_DSN: ${MAILER_DSN}
       MAILER_SENDER: ${MAILER_SENDER}
       SENTRY_DSN: ${SENTRY_DSN}
-      SENTRY_RELEASE: ${IMAGE_TAG}
+      SENTRY_RELEASE: ${SENTRY_RELEASE}
       SENTRY_ENVIRONMENT: ${SENTRY_ENVIRONMENT}
     labels:
       - "traefik.enable=true"

composer.json

@@ -19,33 +19,34 @@
         "phpstan/phpdoc-parser": "^2.3.2",
         "sentry/sentry-symfony": "^5.9.0",
         "stof/doctrine-extensions-bundle": "^1.15.3",
-        "symfony/asset": "8.0.*",
-        "symfony/asset-mapper": "8.0.*",
-        "symfony/brevo-mailer": "8.0.*",
-        "symfony/console": "8.0.*",
-        "symfony/dotenv": "8.0.*",
-        "symfony/flex": "^2.10.0",
-        "symfony/form": "8.0.*",
-        "symfony/framework-bundle": "8.0.*",
-        "symfony/mailer": "8.0.*",
-        "symfony/property-access": "8.0.*",
-        "symfony/property-info": "8.0.*",
-        "symfony/runtime": "8.0.*",
-        "symfony/security-bundle": "8.0.*",
-        "symfony/security-csrf": "8.0.*",
-        "symfony/serializer": "8.0.*",
-        "symfony/translation": "8.0.*",
-        "symfony/twig-bundle": "8.0.*",
-        "symfony/uid": "8.0.*",
-        "symfony/ux-turbo": "^2.35.0",
-        "symfony/validator": "8.0.*",
-        "symfony/yaml": "8.0.*",
-        "symfonycasts/sass-bundle": "^0.9",
+        "symfony/asset": "8.1.*",
+        "symfony/asset-mapper": "8.1.*",
+        "symfony/brevo-mailer": "8.1.*",
+        "symfony/console": "8.1.*",
+        "symfony/dotenv": "8.1.*",
+        "symfony/flex": "^2.11.0",
+        "symfony/form": "8.1.*",
+        "symfony/framework-bundle": "8.1.*",
+        "symfony/mailer": "8.1.*",
+        "symfony/object-mapper": "8.1.*",
+        "symfony/property-access": "8.1.*",
+        "symfony/property-info": "8.1.*",
+        "symfony/runtime": "8.1.*",
+        "symfony/security-bundle": "8.1.*",
+        "symfony/security-csrf": "8.1.*",
+        "symfony/serializer": "8.1.*",
+        "symfony/translation": "8.1.*",
+        "symfony/twig-bundle": "8.1.*",
+        "symfony/uid": "8.1.*",
+        "symfony/ux-turbo": "^3.1",
+        "symfony/validator": "8.1.*",
+        "symfony/yaml": "8.1.*",
+        "symfonycasts/sass-bundle": "^0.10",
         "symfonycasts/verify-email-bundle": "^1.18.0",
         "thecodingmachine/safe": "^3.4.0",
         "twig/extra-bundle": "^3.24.0",
         "twig/intl-extra": "^3.24.0",
-        "twig/twig": "^3.24.0"
+        "twig/twig": "^3.27.1"
     },
     "require-dev": {
         "dama/doctrine-test-bundle": "^8.6",
@@ -58,14 +59,14 @@
         "phpstan/phpstan-symfony": "^2.0.15",
         "phpunit/phpunit": "^13.0.5",
         "rector/rector": "^2.3.9",
-        "symfony/browser-kit": "8.0.*",
-        "symfony/css-selector": "8.0.*",
+        "symfony/browser-kit": "8.1.*",
+        "symfony/css-selector": "8.1.*",
         "symfony/maker-bundle": "^1.67.0",
-        "symfony/phpunit-bridge": "8.0.*",
-        "symfony/stopwatch": "8.0.*",
-        "symfony/web-profiler-bundle": "8.0.*",
+        "symfony/phpunit-bridge": "8.1.*",
+        "symfony/stopwatch": "8.1.*",
+        "symfony/web-profiler-bundle": "8.1.*",
         "thecodingmachine/phpstan-safe-rule": "^1.4.3",
-        "vincentlanglet/twig-cs-fixer": "^3.14.0"
+        "vincentlanglet/twig-cs-fixer": "^4.0.0"
     },
     "config": {
         "allow-plugins": {
@@ -120,7 +121,7 @@
     "extra": {
         "symfony": {
             "allow-contrib": false,
-            "require": "8.0.*",
+            "require": "8.1.*",
             "docker": true
         }
     }

config/packages/doctrine.yaml

@@ -22,6 +22,10 @@ doctrine:
         identity_generation_preferences:
             Doctrine\DBAL\Platforms\PostgreSQLPlatform: identity
         auto_mapping: true
+        filters:
+            softdeleteable:
+                class: Gedmo\SoftDeleteable\Filter\SoftDeleteableFilter
+                enabled: true
         mappings:
             Tvdt:
                 type: attribute

config/packages/security.yaml

@@ -24,7 +24,10 @@ security:
                 default_target_path: tvdt_backoffice_index
             logout:
                 path: tvdt_login_logout
-            
+            remember_me:
+                secret: '%kernel.secret%'
+                lifetime: 604800 # 1 week in seconds
+
     access_control:
         - { path: ^/admin, roles: ROLE_ADMIN }
         - { path: ^/backoffice, roles: ROLE_USER }

config/packages/stof_doctrine_extensions.yaml

@@ -5,3 +5,4 @@ stof_doctrine_extensions:
     orm:
         default:
             timestampable: true
+            softdeleteable: true

config/packages/verify_email.yaml

@@ -0,0 +1,2 @@
+symfonycasts_verify_email:
+    lifetime: 604800 # 1 week in seconds

config/packages/web_profiler.yaml

@@ -6,7 +6,6 @@ when@dev:
     framework:
         profiler:
             only_exceptions: false
-            collect_serializer_data: true
 
 when@test:
     web_profiler:

config/reference.php

@@ -78,6 +78,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *     tags?: TagsType,
  *     resource_tags?: TagsType,
  *     decorates?: string,
+ *     decorates_tag?: string,
  *     decoration_inner_name?: string,
  *     decoration_priority?: int,
  *     decoration_on_invalid?: 'exception'|'ignore'|null,
@@ -118,10 +119,15 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *     stack: list<DefinitionType|AliasType|PrototypeType|array<class-string, ArgumentsType|null>>,
  *     public?: bool,
  *     deprecated?: DeprecationType,
+ *     decorates?: string,
+ *     decorates_tag?: string,
+ *     decoration_inner_name?: string,
+ *     decoration_priority?: int,
+ *     decoration_on_invalid?: 'exception'|'ignore'|null,
  * }
  * @psalm-type ServicesConfig = array{
  *     _defaults?: DefaultsType,
- *     _instanceof?: InstanceofType,
+ *     _instanceof?: array<class-string, InstanceofType>,
  *     ...<string, DefinitionType|AliasType|PrototypeType|StackType|ArgumentsType|null>
  * }
  * @psalm-type ExtensionType = array<string, mixed>
@@ -168,7 +174,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         allow_revalidate?: bool|Param,
  *         stale_while_revalidate?: int|Param,
  *         stale_if_error?: int|Param,
- *         terminate_on_cache_hit?: bool|Param,
+ *         terminate_on_cache_hit?: bool|Param, // Deprecated: Setting the "framework.http_cache.terminate_on_cache_hit.terminate_on_cache_hit" configuration option is deprecated. It will be removed in version 9.0.
  *     },
  *     esi?: bool|array{ // ESI configuration
  *         enabled?: bool|Param, // Default: false
@@ -188,7 +194,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         only_exceptions?: bool|Param, // Default: false
  *         only_main_requests?: bool|Param, // Default: false
  *         dsn?: scalar|Param|null, // Default: "file:%kernel.cache_dir%/profiler"
- *         collect_serializer_data?: true|Param, // Default: true
+ *         collect_serializer_data?: true|Param, // Deprecated: Setting the "framework.profiler.collect_serializer_data.collect_serializer_data" configuration option is deprecated. It will be removed in version 9.0. // Default: true
  *     },
  *     workflows?: bool|array{
  *         enabled?: bool|Param, // Default: false
@@ -340,6 +346,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *             endpoint?: scalar|Param|null, // API endpoint for the NotCompromisedPassword Validator. // Default: null
  *         },
  *         disable_translation?: bool|Param, // Default: false
+ *         property_metadata_existence_check?: bool|Param, // When enabled, validateProperty() and validatePropertyValue() throw an exception if no metadata is found for the given property. // Default: false
  *         auto_mapping?: array<string, array{ // Default: []
  *             services?: list<scalar|Param|null>,
  *         }>,
@@ -396,6 +403,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *             provider?: scalar|Param|null, // Overwrite the setting from the default provider for this adapter.
  *             early_expiration_message_bus?: scalar|Param|null,
  *             clearer?: scalar|Param|null,
+ *             marshaller?: scalar|Param|null, // The marshaller service to use for this pool.
  *         }>,
  *     },
  *     php_errors?: array{ // PHP errors handling configuration
@@ -420,9 +428,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *     },
  *     messenger?: bool|array{ // Messenger configuration
  *         enabled?: bool|Param, // Default: false
- *         routing?: array<string, string|array{ // Default: []
- *             senders?: list<scalar|Param|null>,
- *         }>,
+ *         routing?: array<string, string|list<scalar|Param|null>>,
  *         serializer?: array{
  *             default_serializer?: scalar|Param|null, // Service id to use as the default serializer for the transports. // Default: "messenger.transport.native_php_serializer"
  *             symfony_serializer?: array{
@@ -498,7 +504,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *                 enabled?: bool|Param, // Default: false
  *                 cache_pool?: string|Param, // The taggable cache pool to use for storing the responses. // Default: "cache.http_client"
  *                 shared?: bool|Param, // Indicates whether the cache is shared (public) or private. // Default: true
- *                 max_ttl?: int|Param, // The maximum TTL (in seconds) allowed for cached responses. Null means no cap. // Default: null
+ *                 max_ttl?: int|Param, // The maximum TTL (in seconds) allowed for cached responses. // Default: 86400
  *             },
  *             retry_failed?: bool|array{
  *                 enabled?: bool|Param, // Default: false
@@ -514,7 +520,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *                 jitter?: float|Param, // Randomness in percent (between 0 and 1) to apply to the delay. // Default: 0.1
  *             },
  *         },
- *         mock_response_factory?: scalar|Param|null, // The id of the service that should generate mock responses. It should be either an invokable or an iterable.
+ *         mock_response_factory?: scalar|Param|null, // `true` to always return empty 200 responses, or the id of the service to use to generate mock responses - which should be either an invokable or an iterable.
  *         scoped_clients?: array<string, string|array{ // Default: []
  *             scope?: scalar|Param|null, // The regular expression that the request URL must match before adding the other options. When none is provided, the base URI is used instead.
  *             base_uri?: scalar|Param|null, // The URI to resolve relative URLs, following rules in RFC 3985, section 2.
@@ -545,13 +551,14 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *                 md5?: mixed,
  *             },
  *             crypto_method?: scalar|Param|null, // The minimum version of TLS to accept; must be one of STREAM_CRYPTO_METHOD_TLSv*_CLIENT constants.
+ *             mock_response_factory?: scalar|Param|null, // `true` to always return empty 200 responses, `false` to disable mocking, or the id of the service to use to generate mock responses (invokable or iterable).
  *             extra?: array<string, mixed>,
  *             rate_limiter?: scalar|Param|null, // Rate limiter name to use for throttling requests. // Default: null
  *             caching?: bool|array{ // Caching configuration.
  *                 enabled?: bool|Param, // Default: false
  *                 cache_pool?: string|Param, // The taggable cache pool to use for storing the responses. // Default: "cache.http_client"
  *                 shared?: bool|Param, // Indicates whether the cache is shared (public) or private. // Default: true
- *                 max_ttl?: int|Param, // The maximum TTL (in seconds) allowed for cached responses. Null means no cap. // Default: null
+ *                 max_ttl?: int|Param, // The maximum TTL (in seconds) allowed for cached responses. // Default: 86400
  *             },
  *             retry_failed?: bool|array{
  *                 enabled?: bool|Param, // Default: false
@@ -635,6 +642,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *                 interval?: scalar|Param|null, // Configures the rate interval. The value must be a number followed by "second", "minute", "hour", "day", "week" or "month" (or their plural equivalent).
  *                 amount?: int|Param, // Amount of tokens to add each interval. // Default: 1
  *             },
+ *             anchor_at?: scalar|Param|null, // Aligns the "fixed_window" policy to a calendar (e.g. "2024-01-05 00:00:00 UTC" combined with `interval: 1 month` resets the counter on the 5th of each month). UTC if not specified. // Default: null
  *         }>,
  *     },
  *     uid?: bool|array{ // Uid configuration
@@ -644,10 +652,12 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         name_based_uuid_namespace?: scalar|Param|null,
  *         time_based_uuid_version?: 7|6|1|Param, // Default: 7
  *         time_based_uuid_node?: scalar|Param|null,
+ *         uuid47_secret?: scalar|Param|null, // A high-entropy secret used by the "uuid47_transformer" service. Defaults to "kernel.secret". // Default: null
  *     },
  *     html_sanitizer?: bool|array{ // HtmlSanitizer configuration
  *         enabled?: bool|Param, // Default: false
  *         sanitizers?: array<string, array{ // Default: []
+ *             default_action?: "drop"|"block"|"allow"|Param, // Defines how the sanitizer must behave by default.
  *             allow_safe_elements?: bool|Param, // Allows "safe" elements and attributes. // Default: false
  *             allow_static_elements?: bool|Param, // Allows all static elements and attributes from the W3C Sanitizer API standard. // Default: false
  *             allow_elements?: array<string, mixed>,
@@ -671,6 +681,10 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *     webhook?: bool|array{ // Webhook configuration
  *         enabled?: bool|Param, // Default: false
  *         message_bus?: scalar|Param|null, // The message bus to use. // Default: "messenger.default_bus"
+ *         event_header_name?: scalar|Param|null, // Default: "Webhook-Event"
+ *         id_header_name?: scalar|Param|null, // Default: "Webhook-Id"
+ *         signature_header_name?: scalar|Param|null, // Default: "Webhook-Signature"
+ *         signing_algorithm?: scalar|Param|null, // Default: "sha256"
  *         routing?: array<string, array{ // Default: []
  *             service?: scalar|Param|null,
  *             secret?: scalar|Param|null, // Default: ""
@@ -681,6 +695,10 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *     },
  *     json_streamer?: bool|array{ // JSON streamer configuration
  *         enabled?: bool|Param, // Default: false
+ *         default_options?: array{
+ *             include_null_properties?: bool|Param, // Encode the properties with null value // Default: false
+ *             ...<string, mixed>
+ *         },
  *     },
  * }
  * @psalm-type DoctrineConfig = array{
@@ -709,7 +727,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *             servicename?: scalar|Param|null, // Overrules dbname parameter if given and used as SERVICE_NAME or SID connection parameter for Oracle depending on the service parameter.
  *             sessionMode?: scalar|Param|null, // The session mode to use for the oci8 driver
  *             server?: scalar|Param|null, // The name of a running database server to connect to for SQL Anywhere.
- *             default_dbname?: scalar|Param|null, // Override the default database (postgres) to connect to for PostgreSQL connexion.
+ *             default_dbname?: scalar|Param|null, // Override the default database (postgres) to connect to for PostgreSQL connection.
  *             sslmode?: scalar|Param|null, // Determines whether or with what priority a SSL TCP/IP connection will be negotiated with the server for PostgreSQL.
  *             sslrootcert?: scalar|Param|null, // The name of a file containing SSL certificate authority (CA) certificate(s). If the file exists, the server's certificate will be verified to be signed by one of these authorities.
  *             sslcert?: scalar|Param|null, // The path to the SSL client certificate file for PostgreSQL.
@@ -755,7 +773,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *                 servicename?: scalar|Param|null, // Overrules dbname parameter if given and used as SERVICE_NAME or SID connection parameter for Oracle depending on the service parameter.
  *                 sessionMode?: scalar|Param|null, // The session mode to use for the oci8 driver
  *                 server?: scalar|Param|null, // The name of a running database server to connect to for SQL Anywhere.
- *                 default_dbname?: scalar|Param|null, // Override the default database (postgres) to connect to for PostgreSQL connexion.
+ *                 default_dbname?: scalar|Param|null, // Override the default database (postgres) to connect to for PostgreSQL connection.
  *                 sslmode?: scalar|Param|null, // Determines whether or with what priority a SSL TCP/IP connection will be negotiated with the server for PostgreSQL.
  *                 sslrootcert?: scalar|Param|null, // The name of a file containing SSL certificate authority (CA) certificate(s). If the file exists, the server's certificate will be verified to be signed by one of these authorities.
  *                 sslcert?: scalar|Param|null, // The path to the SSL client certificate file for PostgreSQL.
@@ -834,7 +852,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *                     lock_path?: scalar|Param|null, // Default: "%kernel.cache_dir%/doctrine/orm/slc/filelock"
  *                     lock_lifetime?: scalar|Param|null, // Default: 60
  *                     type?: scalar|Param|null, // Default: "default"
- *                     lifetime?: scalar|Param|null, // Default: 0
+ *                     lifetime?: scalar|Param|null, // Default: null
  *                     service?: scalar|Param|null,
  *                     name?: scalar|Param|null,
  *                 }>,
@@ -932,7 +950,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *     access_denied_url?: scalar|Param|null, // Default: null
  *     session_fixation_strategy?: "none"|"migrate"|"invalidate"|Param, // Default: "migrate"
  *     expose_security_errors?: \Symfony\Component\Security\Http\Authentication\ExposeSecurityLevel::None|\Symfony\Component\Security\Http\Authentication\ExposeSecurityLevel::AccountStatus|\Symfony\Component\Security\Http\Authentication\ExposeSecurityLevel::All|Param, // Default: "none"
- *     erase_credentials?: bool|Param, // Default: true
+ *     erase_credentials?: bool|Param, // Deprecated: Setting the "security.erase_credentials.erase_credentials" configuration option is deprecated. It will be removed in Symfony 9.0, as the "eraseCredentials()" method was removed in Symfony 8.0. // Default: true
  *     access_decision_manager?: array{
  *         strategy?: "affirmative"|"consensus"|"unanimous"|"priority"|Param,
  *         service?: scalar|Param|null,
@@ -1004,7 +1022,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *             path?: scalar|Param|null, // Default: "/logout"
  *             target?: scalar|Param|null, // Default: "/"
  *             invalidate_session?: bool|Param, // Default: true
- *             clear_site_data?: string|list<"*"|"cache"|"cookies"|"storage"|"executionContexts"|Param>,
+ *             clear_site_data?: string|list<"*"|"cache"|"cookies"|"storage"|"clientHints"|"executionContexts"|"prefetchCache"|"prerenderCache"|Param>,
  *             delete_cookies?: string|array<string, array{ // Default: []
  *                 path?: scalar|Param|null, // Default: null
  *                 domain?: scalar|Param|null, // Default: null
@@ -1162,6 +1180,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *                         cache?: array{
  *                             id?: scalar|Param|null, // Cache service id to use to cache the OIDC discovery configuration.
  *                         },
+ *                         enforce_key_usage_verification?: bool|Param, // When enabled (default), only keys explicitly designated for signature (via "use":"sig" or a "key_ops" entry containing "sign"/"verify") are accepted. When disabled, keys without any usage designation are also accepted; keys explicitly restricted to encryption are still rejected. // Default: true
  *                     },
  *                     claim?: scalar|Param|null, // Claim which contains the user identifier (e.g.: sub, email..). // Default: "sub"
  *                     audience?: scalar|Param|null, // Audience set in the token, for validation purpose.
@@ -1309,6 +1328,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         traces_sampler?: scalar|Param|null,
  *         profiles_sample_rate?: float|Param, // The sampling factor to apply to profiles. A value of 0 will deny sending any profiles, and a value of 1 will send all profiles. Profiles are sampled in relation to traces_sample_rate
  *         enable_logs?: bool|Param,
+ *         log_flush_threshold?: mixed, // Default: null
  *         enable_metrics?: bool|Param, // Default: true
  *         attach_stacktrace?: bool|Param,
  *         attach_metric_code_locations?: bool|Param,
@@ -1318,6 +1338,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         spotlight?: bool|Param,
  *         spotlight_url?: scalar|Param|null,
  *         release?: scalar|Param|null, // Default: "%env(default::SENTRY_RELEASE)%"
+ *         org_id?: int|Param,
  *         server_name?: scalar|Param|null,
  *         ignore_exceptions?: list<scalar|Param|null>,
  *         ignore_transactions?: list<scalar|Param|null>,
@@ -1328,6 +1349,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         before_send_log?: scalar|Param|null,
  *         before_send_metric?: scalar|Param|null,
  *         trace_propagation_targets?: mixed,
+ *         strict_trace_continuation?: bool|Param,
  *         tags?: array<string, scalar|Param|null>,
  *         error_types?: scalar|Param|null,
  *         max_breadcrumbs?: int|Param,
@@ -1352,11 +1374,13 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  *         enabled?: bool|Param, // Default: false
  *         capture_soft_fails?: bool|Param, // Default: true
  *         isolate_breadcrumbs_by_message?: bool|Param, // Default: false
+ *         isolate_context_by_message?: bool|Param, // Default: false
  *     },
  *     tracing?: bool|array{
  *         enabled?: bool|Param, // Default: true
  *         dbal?: bool|array{
  *             enabled?: bool|Param, // Default: true
+ *             ignore_prepare_spans?: bool|Param, // Default: false
  *             connections?: list<scalar|Param|null>,
  *         },
  *         twig?: bool|array{
@@ -1376,6 +1400,7 @@ use Symfony\Component\Config\Loader\ParamConfigurator as Param;
  * @psalm-type SymfonycastsSassConfig = array{
  *     root_sass?: list<scalar|Param|null>,
  *     binary?: scalar|Param|null, // The Sass binary to use // Default: null
+ *     search_for_binary?: scalar|Param|null, // Whether to search for the Sass binary in the system PATH // Default: true
  *     sass_options?: array{
  *         style?: "compressed"|"expanded"|Param, // The style of the generated CSS: compressed or expanded. // Default: "expanded"
  *         charset?: bool|Param, // Whether to include the charset declaration in the generated Sass.

migrations/Version20260523095205.php

@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260523095205 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add soft-delete support (deleted_at columns) and rename elimination.created to created_at';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE elimination ADD deleted_at TIMESTAMP(0) WITHOUT TIME ZONE DEFAULT NULL');
+        $this->addSql('ALTER TABLE elimination RENAME COLUMN created TO created_at');
+        $this->addSql('ALTER TABLE given_answer ADD deleted_at TIMESTAMP(0) WITHOUT TIME ZONE DEFAULT NULL');
+        $this->addSql('ALTER TABLE quiz_candidate ADD deleted_at TIMESTAMP(0) WITHOUT TIME ZONE DEFAULT NULL');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE elimination DROP deleted_at');
+        $this->addSql('ALTER TABLE elimination RENAME COLUMN created_at TO created');
+        $this->addSql('ALTER TABLE given_answer DROP deleted_at');
+        $this->addSql('ALTER TABLE quiz_candidate DROP deleted_at');
+    }
+}

migrations/Version20260523095302.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260523095302 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add updated_at column to elimination table and set it to created_at';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE elimination ADD updated_at TIMESTAMP(0) WITHOUT TIME ZONE');
+        $this->addSql('ALTER TABLE elimination ALTER created_at TYPE TIMESTAMP(0) WITHOUT TIME ZONE');
+        $this->addSql('UPDATE elimination SET updated_at = created_at');
+        $this->addSql('ALTER TABLE elimination ALTER updated_at SET NOT NULL');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE elimination DROP updated_at');
+        $this->addSql('ALTER TABLE elimination ALTER created_at TYPE TIMESTAMP(0) WITH TIME ZONE');
+    }
+}

migrations/Version20260524135246.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260524135246 extends AbstractMigration
+{
+    public function getDescription(): string
+    {
+        return 'Add unique constraint for quiz_candidate with deleted_at filter';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('DROP INDEX uniq_ced2ffa291bd8781853cd175');
+        $this->addSql('CREATE UNIQUE INDEX UNIQ_CED2FFA291BD8781853CD175 ON quiz_candidate (candidate_id, quiz_id) WHERE (deleted_at IS NULL)');
+    }
+
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('DROP INDEX UNIQ_CED2FFA291BD8781853CD175');
+        $this->addSql('CREATE UNIQUE INDEX uniq_ced2ffa291bd8781853cd175 ON quiz_candidate (candidate_id, quiz_id)');
+    }
+}

migrations/Version20260704151112.php

@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+/** Auto-generated Migration: Please modify to your needs! */
+final class Version20260704151112 extends AbstractMigration
+{
+    #[\Override]
+    public function getDescription(): string
+    {
+        return 'Add season question bank (bank_question, bank_answer, question_label, bank_question_usage) and quiz finalization';
+    }
+
+    public function up(Schema $schema): void
+    {
+        // this up() migration is auto-generated, please modify it to your needs
+        $this->addSql('CREATE TABLE bank_answer (id UUID NOT NULL, ordering SMALLINT DEFAULT 0 NOT NULL, text VARCHAR(255) NOT NULL, is_right_answer BOOLEAN NOT NULL, bank_question_id UUID NOT NULL, PRIMARY KEY (id))');
+        $this->addSql('CREATE INDEX IDX_FAB865583CAC40C0 ON bank_answer (bank_question_id)');
+        $this->addSql('CREATE TABLE bank_question (id UUID NOT NULL, question VARCHAR(255) NOT NULL, reusable BOOLEAN DEFAULT false NOT NULL, season_id UUID NOT NULL, PRIMARY KEY (id))');
+        $this->addSql('CREATE INDEX IDX_87B753C94EC001D1 ON bank_question (season_id)');
+        $this->addSql('CREATE TABLE bank_question_question_label (bank_question_id UUID NOT NULL, question_label_id UUID NOT NULL, PRIMARY KEY (bank_question_id, question_label_id))');
+        $this->addSql('CREATE INDEX IDX_856E26833CAC40C0 ON bank_question_question_label (bank_question_id)');
+        $this->addSql('CREATE INDEX IDX_856E268350B19F35 ON bank_question_question_label (question_label_id)');
+        $this->addSql('CREATE TABLE bank_question_usage (id UUID NOT NULL, created TIMESTAMP(0) WITH TIME ZONE NOT NULL, bank_question_id UUID NOT NULL, quiz_id UUID NOT NULL, PRIMARY KEY (id))');
+        $this->addSql('CREATE INDEX IDX_775833AD3CAC40C0 ON bank_question_usage (bank_question_id)');
+        $this->addSql('CREATE INDEX IDX_775833AD853CD175 ON bank_question_usage (quiz_id)');
+        $this->addSql('CREATE UNIQUE INDEX UNIQ_775833AD3CAC40C0853CD175 ON bank_question_usage (bank_question_id, quiz_id)');
+        $this->addSql('CREATE TABLE question_label (id UUID NOT NULL, name VARCHAR(64) NOT NULL, season_id UUID NOT NULL, PRIMARY KEY (id))');
+        $this->addSql('CREATE INDEX IDX_3E4C41EC4EC001D1 ON question_label (season_id)');
+        $this->addSql('CREATE UNIQUE INDEX UNIQ_3E4C41EC5E237E064EC001D1 ON question_label (name, season_id)');
+        $this->addSql('ALTER TABLE bank_answer ADD CONSTRAINT FK_FAB865583CAC40C0 FOREIGN KEY (bank_question_id) REFERENCES bank_question (id) NOT DEFERRABLE');
+        $this->addSql('ALTER TABLE bank_question ADD CONSTRAINT FK_87B753C94EC001D1 FOREIGN KEY (season_id) REFERENCES season (id) NOT DEFERRABLE');
+        $this->addSql('ALTER TABLE bank_question_question_label ADD CONSTRAINT FK_856E26833CAC40C0 FOREIGN KEY (bank_question_id) REFERENCES bank_question (id) ON DELETE CASCADE');
+        $this->addSql('ALTER TABLE bank_question_question_label ADD CONSTRAINT FK_856E268350B19F35 FOREIGN KEY (question_label_id) REFERENCES question_label (id) ON DELETE CASCADE');
+        $this->addSql('ALTER TABLE bank_question_usage ADD CONSTRAINT FK_775833AD3CAC40C0 FOREIGN KEY (bank_question_id) REFERENCES bank_question (id) NOT DEFERRABLE');
+        $this->addSql('ALTER TABLE bank_question_usage ADD CONSTRAINT FK_775833AD853CD175 FOREIGN KEY (quiz_id) REFERENCES quiz (id) ON DELETE CASCADE NOT DEFERRABLE');
+        $this->addSql('ALTER TABLE question_label ADD CONSTRAINT FK_3E4C41EC4EC001D1 FOREIGN KEY (season_id) REFERENCES season (id) NOT DEFERRABLE');
+        $this->addSql('ALTER TABLE quiz ADD finalized_at TIMESTAMP(0) WITH TIME ZONE DEFAULT NULL');
+        // Backfill: quizzes that are currently active must stay valid under the new "finalized before activation" rule
+        $this->addSql('UPDATE quiz SET finalized_at = NOW() WHERE id IN (SELECT active_quiz_id FROM season WHERE active_quiz_id IS NOT NULL)');
+    }
+
+    #[\Override]
+    public function down(Schema $schema): void
+    {
+        // this down() migration is auto-generated, please modify it to your needs
+        $this->addSql('ALTER TABLE bank_answer DROP CONSTRAINT FK_FAB865583CAC40C0');
+        $this->addSql('ALTER TABLE bank_question DROP CONSTRAINT FK_87B753C94EC001D1');
+        $this->addSql('ALTER TABLE bank_question_question_label DROP CONSTRAINT FK_856E26833CAC40C0');
+        $this->addSql('ALTER TABLE bank_question_question_label DROP CONSTRAINT FK_856E268350B19F35');
+        $this->addSql('ALTER TABLE bank_question_usage DROP CONSTRAINT FK_775833AD3CAC40C0');
+        $this->addSql('ALTER TABLE bank_question_usage DROP CONSTRAINT FK_775833AD853CD175');
+        $this->addSql('ALTER TABLE question_label DROP CONSTRAINT FK_3E4C41EC4EC001D1');
+        $this->addSql('DROP TABLE bank_answer');
+        $this->addSql('DROP TABLE bank_question');
+        $this->addSql('DROP TABLE bank_question_question_label');
+        $this->addSql('DROP TABLE bank_question_usage');
+        $this->addSql('DROP TABLE question_label');
+        $this->addSql('ALTER TABLE quiz DROP finalized_at');
+    }
+}

migrations/Version20260704200000.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+namespace DoctrineMigrations;
+
+use Doctrine\DBAL\Schema\Schema;
+use Doctrine\Migrations\AbstractMigration;
+
+final class Version20260704200000 extends AbstractMigration
+{
+    #[\Override]
+    public function getDescription(): string
+    {
+        return 'Add question_id FK to bank_question_usage for unassign and sync support';
+    }
+
+    public function up(Schema $schema): void
+    {
+        $this->addSql('ALTER TABLE bank_question_usage ADD question_id UUID DEFAULT NULL');
+        $this->addSql('ALTER TABLE bank_question_usage ADD CONSTRAINT FK_BQU_QUESTION FOREIGN KEY (question_id) REFERENCES question (id) ON DELETE SET NULL NOT DEFERRABLE INITIALLY IMMEDIATE');
+        $this->addSql('CREATE INDEX IDX_BQU_QUESTION ON bank_question_usage (question_id)');
+    }
+
+    #[\Override]
+    public function down(Schema $schema): void
+    {
+        $this->addSql('DROP INDEX IDX_BQU_QUESTION');
+        $this->addSql('ALTER TABLE bank_question_usage DROP CONSTRAINT FK_BQU_QUESTION');
+        $this->addSql('ALTER TABLE bank_question_usage DROP COLUMN question_id');
+    }
+}

phpunit.dist.xml

@@ -8,7 +8,7 @@
          failOnNotice="true"
          failOnWarning="true"
          bootstrap="tests/bootstrap.php"
-         cacheDirectory=".phpunit.cache"
+         cacheDirectory="/tmp/phpunit.cache"
 >
     <php>
         <ini name="display_errors" value="1" />

rector.php

@@ -3,6 +3,7 @@
 declare(strict_types=1);
 
 use Rector\Config\RectorConfig;
+use Rector\PHPUnit\CodeQuality\Rector\Class_\AddSeeTestAnnotationRector;
 use Rector\Symfony\Bridge\Symfony\Routing\SymfonyRoutesProvider;
 use Rector\Symfony\Contract\Bridge\Symfony\Routing\SymfonyRoutesProviderInterface;
 
@@ -13,7 +14,7 @@ return RectorConfig::configure()
         __DIR__.'/src',
         __DIR__.'/tests',
     ])
-    ->withSkip([__DIR__.'/config/reference.php'])
+    ->withSkipPath(__DIR__.'/config/reference.php')
     ->withSymfonyContainerXml(__DIR__.'/var/cache/dev/Tvdt_KernelDevDebugContainer.xml')
     ->withSymfonyContainerPhp(__DIR__.'/tests/symfony-container.php')
     ->registerService(SymfonyRoutesProvider::class, SymfonyRoutesProviderInterface::class)
@@ -34,4 +35,6 @@ return RectorConfig::configure()
     )
     ->withAttributesSets(all: true)
     ->withComposerBased(twig: true, doctrine: true, phpunit: true, symfony: true)
+    ->withSkip([AddSeeTestAnnotationRector::class])
+
 ;

src/Controller/Backoffice/BackofficeController.php

@@ -6,17 +6,21 @@ namespace Tvdt\Controller\Backoffice;
 
 use Doctrine\ORM\EntityManagerInterface;
 use Symfony\Bundle\SecurityBundle\Security;
+use Symfony\Component\HttpFoundation\HeaderUtils;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpFoundation\StreamedResponse;
 use Symfony\Component\HttpKernel\Attribute\AsController;
 use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Routing\Requirement\Requirement;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Tvdt\Controller\AbstractController;
+use Tvdt\Entity\Quiz;
 use Tvdt\Entity\Season;
 use Tvdt\Entity\User;
 use Tvdt\Form\CreateSeasonFormType;
 use Tvdt\Repository\SeasonRepository;
+use Tvdt\Security\Voter\SeasonVoter;
 use Tvdt\Service\QuizSpreadsheetService;
 
 #[AsController]
@@ -78,4 +82,20 @@ final class BackofficeController extends AbstractController
 
         return $response;
     }
+
+    #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
+    #[Route(
+        '/backoffice/quiz/{quiz}/export',
+        name: 'tvdt_backoffice_quiz_export',
+        requirements: ['quiz' => Requirement::UUID],
+        methods: ['GET'],
+    )]
+    public function exportQuiz(Quiz $quiz): StreamedResponse
+    {
+        $response = new StreamedResponse($this->excel->quizToXlsx($quiz));
+        $response->headers->set('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
+        $response->headers->set('Content-Disposition', HeaderUtils::makeDisposition(HeaderUtils::DISPOSITION_ATTACHMENT, $quiz->name.'.xlsx'));
+
+        return $response;
+    }
 }

src/Controller/Backoffice/PrepareEliminationController.php

@@ -10,6 +10,7 @@ use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Routing\Requirement\Requirement;
+use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
 use Tvdt\Controller\AbstractController;
 use Tvdt\Entity\Elimination;
 use Tvdt\Entity\Quiz;
@@ -20,10 +21,12 @@ final class PrepareEliminationController extends AbstractController
 {
     public function __construct(private readonly EliminationFactory $eliminationFactory, private readonly EntityManagerInterface $em) {}
 
+    #[IsCsrfTokenValid('prepare_elimination')]
     #[Route(
         '/backoffice/season/{seasonCode:season}/quiz/{quiz}/elimination/prepare',
         name: 'tvdt_prepare_elimination',
         requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'quiz' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function index(Season $season, Quiz $quiz): RedirectResponse
     {
@@ -32,14 +35,16 @@ final class PrepareEliminationController extends AbstractController
         return $this->redirectToRoute('tvdt_prepare_elimination_view', ['elimination' => $elimination->id]);
     }
 
+    #[IsCsrfTokenValid('prepare_elimination', methods: ['POST'])]
     #[Route(
         '/backoffice/elimination/{elimination}',
         name: 'tvdt_prepare_elimination_view',
         requirements: ['elimination' => Requirement::UUID],
+        methods: ['GET', 'POST'],
     )]
     public function viewElimination(Elimination $elimination, Request $request): Response
     {
-        if ('POST' === $request->getMethod()) {
+        if ($request->isMethod('POST')) {
             $elimination->updateFromInputBag($request->request);
             $this->em->flush();
 
@@ -48,6 +53,8 @@ final class PrepareEliminationController extends AbstractController
             }
 
             $this->addFlash('success', 'Elimination updated');
+
+            return $this->redirectToRoute('tvdt_prepare_elimination_view', ['elimination' => $elimination->id]);
         }
 
         return $this->render('backoffice/prepare_elimination/index.html.twig', [

src/Controller/Backoffice/QuestionBankController.php

@@ -0,0 +1,350 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Controller\Backoffice;
+
+use Doctrine\DBAL\Exception\UniqueConstraintViolationException;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Attribute\AsController;
+use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Routing\Requirement\Requirement;
+use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
+use Symfony\Component\Uid\Uuid;
+use Symfony\Contracts\Translation\TranslatorInterface;
+use Tvdt\Controller\AbstractController;
+use Tvdt\Entity\BankQuestion;
+use Tvdt\Entity\BankQuestionUsage;
+use Tvdt\Entity\QuestionLabel;
+use Tvdt\Entity\Quiz;
+use Tvdt\Entity\Season;
+use Tvdt\Enum\FlashType;
+use Tvdt\Exception\BankQuestionAlreadyUsedException;
+use Tvdt\Exception\QuizLockedException;
+use Tvdt\Form\BankQuestionFormType;
+use Tvdt\Repository\BankQuestionRepository;
+use Tvdt\Repository\QuizRepository;
+use Tvdt\Security\Voter\SeasonVoter;
+use Tvdt\Service\QuestionBankService;
+
+#[AsController]
+#[IsGranted('ROLE_USER')]
+class QuestionBankController extends AbstractController
+{
+    public function __construct(
+        private readonly TranslatorInterface $translator,
+        private readonly EntityManagerInterface $em,
+        private readonly BankQuestionRepository $bankQuestionRepository,
+        private readonly QuizRepository $quizRepository,
+        private readonly QuestionBankService $questionBankService,
+    ) {}
+
+    #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/question-bank',
+        name: 'tvdt_backoffice_question_bank',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX],
+        priority: 10,
+    )]
+    public function index(Season $season, Request $request): Response
+    {
+        $label = null;
+        $labelId = $request->query->getString('label');
+        if ('' !== $labelId && Uuid::isValid($labelId)) {
+            $label = $this->em->getRepository(QuestionLabel::class)->find($labelId);
+            if ($label instanceof QuestionLabel && $label->season !== $season) {
+                $label = null;
+            }
+        }
+
+        return $this->render('backoffice/season.html.twig', [
+            'season' => $season,
+            'bankQuestions' => $this->bankQuestionRepository->findBySeason($season, $label),
+            'assignableQuizzes' => $this->quizRepository->findAssignableForSeason($season),
+            'activeLabel' => $label,
+            'activeTab' => 'question-bank',
+            'template' => 'backoffice/season/tab_question_bank.html.twig',
+        ]);
+    }
+
+    #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/question-bank/new',
+        name: 'tvdt_backoffice_question_bank_new',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX],
+        priority: 10,
+    )]
+    public function new(Season $season, Request $request): Response
+    {
+        $bankQuestion = new BankQuestion();
+
+        $form = $this->createForm(BankQuestionFormType::class, $bankQuestion, ['season' => $season]);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            $this->applyAnswerOrdering($bankQuestion);
+            $season->addBankQuestion($bankQuestion);
+            $this->em->persist($bankQuestion);
+            $this->em->flush();
+
+            $this->addFlash(FlashType::Success, $this->translator->trans('Question added to the question bank'));
+
+            return $this->redirectToRoute('tvdt_backoffice_question_bank', ['seasonCode' => $season->seasonCode]);
+        }
+
+        return $this->render('backoffice/question_bank/form.html.twig', [
+            'season' => $season,
+            'form' => $form,
+            'bankQuestion' => null,
+        ]);
+    }
+
+    #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/question-bank/{bankQuestion}/edit',
+        name: 'tvdt_backoffice_question_bank_edit',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'bankQuestion' => Requirement::UUID],
+        priority: 10,
+    )]
+    public function edit(Season $season, BankQuestion $bankQuestion, Request $request): Response
+    {
+        $this->assertSameSeason($season, $bankQuestion->season);
+
+        $form = $this->createForm(BankQuestionFormType::class, $bankQuestion, ['season' => $season]);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            $this->applyAnswerOrdering($bankQuestion);
+            $this->em->flush();
+
+            $this->syncUsagesAfterEdit($bankQuestion);
+
+            $this->addFlash(FlashType::Success, $this->translator->trans('Question updated'));
+
+            return $this->redirectToRoute('tvdt_backoffice_question_bank', ['seasonCode' => $season->seasonCode]);
+        }
+
+        return $this->render('backoffice/question_bank/form.html.twig', [
+            'season' => $season,
+            'form' => $form,
+            'bankQuestion' => $bankQuestion,
+        ]);
+    }
+
+    #[IsCsrfTokenValid('delete_bank_question')]
+    #[IsGranted(SeasonVoter::DELETE, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/question-bank/{bankQuestion}/delete',
+        name: 'tvdt_backoffice_question_bank_delete',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'bankQuestion' => Requirement::UUID],
+        methods: ['POST'],
+        priority: 10,
+    )]
+    public function delete(Season $season, BankQuestion $bankQuestion): RedirectResponse
+    {
+        $this->assertSameSeason($season, $bankQuestion->season);
+
+        $this->em->remove($bankQuestion);
+        $this->em->flush();
+
+        $this->addFlash(FlashType::Success, $this->translator->trans('Question removed from the question bank'));
+
+        return $this->redirectToRoute('tvdt_backoffice_question_bank', ['seasonCode' => $season->seasonCode]);
+    }
+
+    #[IsCsrfTokenValid('assign_bank_question')]
+    #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/question-bank/{bankQuestion}/assign',
+        name: 'tvdt_backoffice_question_bank_assign',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'bankQuestion' => Requirement::UUID],
+        methods: ['POST'],
+        priority: 10,
+    )]
+    public function assign(Season $season, BankQuestion $bankQuestion, Request $request): RedirectResponse
+    {
+        $this->assertSameSeason($season, $bankQuestion->season);
+
+        $quizId = $request->request->getString('quiz');
+        if (!Uuid::isValid($quizId)) {
+            throw new BadRequestHttpException('Invalid quiz');
+        }
+
+        $quiz = $this->em->getRepository(Quiz::class)->find($quizId);
+        if (!$quiz instanceof Quiz || $quiz->season !== $season) {
+            throw new BadRequestHttpException('Invalid quiz');
+        }
+
+        $this->denyAccessUnlessGranted(SeasonVoter::MODIFY_QUIZ_CONTENT, $quiz);
+
+        try {
+            $this->questionBankService->assignToQuiz($bankQuestion, $quiz);
+            $this->addFlash(FlashType::Success, $this->translator->trans('Question added to quiz %quiz%', ['%quiz%' => $quiz->name]));
+        } catch (QuizLockedException) {
+            $this->addFlash(FlashType::Danger, $this->translator->trans('This quiz can no longer be altered'));
+        } catch (BankQuestionAlreadyUsedException) {
+            $this->addFlash(FlashType::Danger, $this->translator->trans('This question has already been used'));
+        }
+
+        return $this->redirectToRoute('tvdt_backoffice_question_bank', ['seasonCode' => $season->seasonCode]);
+    }
+
+    #[IsCsrfTokenValid('add_question_label')]
+    #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/question-bank/labels',
+        name: 'tvdt_backoffice_question_bank_labels',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX],
+        methods: ['POST'],
+        priority: 15,
+    )]
+    public function addLabel(Season $season, Request $request): RedirectResponse
+    {
+        $name = mb_trim($request->request->getString('name'));
+
+        if ('' === $name || mb_strlen($name) > 64) {
+            $this->addFlash(FlashType::Danger, $this->translator->trans('Invalid label name'));
+
+            return $this->redirectToRoute('tvdt_backoffice_question_bank', ['seasonCode' => $season->seasonCode]);
+        }
+
+        $exists = $season->questionLabels->exists(static fn (int $key, QuestionLabel $label): bool => $label->name === $name);
+        if (!$exists) {
+            try {
+                $season->addQuestionLabel(new QuestionLabel($name));
+                $this->em->flush();
+                $this->addFlash(FlashType::Success, $this->translator->trans('Label added'));
+            } catch (UniqueConstraintViolationException) {
+                // Concurrent request already inserted the same label; treat as a no-op
+            }
+        }
+
+        return $this->redirectToRoute('tvdt_backoffice_question_bank', ['seasonCode' => $season->seasonCode]);
+    }
+
+    #[IsCsrfTokenValid('delete_question_label')]
+    #[IsGranted(SeasonVoter::DELETE, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/question-bank/labels/{label}/delete',
+        name: 'tvdt_backoffice_question_bank_label_delete',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'label' => Requirement::UUID],
+        methods: ['POST'],
+        priority: 15,
+    )]
+    public function deleteLabel(Season $season, QuestionLabel $label): RedirectResponse
+    {
+        $this->assertSameSeason($season, $label->season);
+
+        foreach ($label->bankQuestions as $bankQuestion) {
+            $bankQuestion->removeLabel($label);
+        }
+
+        $this->em->remove($label);
+        $this->em->flush();
+
+        $this->addFlash(FlashType::Success, $this->translator->trans('Label removed'));
+
+        return $this->redirectToRoute('tvdt_backoffice_question_bank', ['seasonCode' => $season->seasonCode]);
+    }
+
+    #[IsCsrfTokenValid('unassign_bank_question')]
+    #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/question-bank/{bankQuestion}/unassign/{usage}',
+        name: 'tvdt_backoffice_question_bank_unassign',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'bankQuestion' => Requirement::UUID, 'usage' => Requirement::UUID],
+        methods: ['POST'],
+        priority: 10,
+    )]
+    public function unassign(Season $season, BankQuestion $bankQuestion, BankQuestionUsage $usage): RedirectResponse
+    {
+        $this->assertSameSeason($season, $bankQuestion->season);
+
+        if ($usage->bankQuestion !== $bankQuestion) {
+            throw new NotFoundHttpException();
+        }
+
+        if ($usage->quiz->isLocked()) {
+            $this->addFlash(FlashType::Danger, $this->translator->trans('This quiz can no longer be altered'));
+
+            return $this->redirectToRoute('tvdt_backoffice_question_bank', ['seasonCode' => $season->seasonCode]);
+        }
+
+        $this->questionBankService->unassignFromQuiz($usage);
+        $this->addFlash(FlashType::Success, $this->translator->trans('Question removed from quiz %quiz%', ['%quiz%' => $usage->quiz->name]));
+
+        return $this->redirectToRoute('tvdt_backoffice_question_bank', ['seasonCode' => $season->seasonCode]);
+    }
+
+    #[IsCsrfTokenValid('sync_bank_question')]
+    #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/question-bank/{bankQuestion}/sync/{usage}',
+        name: 'tvdt_backoffice_question_bank_sync',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'bankQuestion' => Requirement::UUID, 'usage' => Requirement::UUID],
+        methods: ['POST'],
+        priority: 10,
+    )]
+    public function syncToQuiz(Season $season, BankQuestion $bankQuestion, BankQuestionUsage $usage): RedirectResponse
+    {
+        $this->assertSameSeason($season, $bankQuestion->season);
+
+        if ($usage->bankQuestion !== $bankQuestion) {
+            throw new NotFoundHttpException();
+        }
+
+        if ($usage->quiz->hasStartedCandidates()) {
+            $this->addFlash(FlashType::Danger, $this->translator->trans('This quiz has already been filled in and can no longer be altered'));
+
+            return $this->redirectToRoute('tvdt_backoffice_question_bank', ['seasonCode' => $season->seasonCode]);
+        }
+
+        $this->questionBankService->syncToQuiz($bankQuestion, $usage);
+        $this->addFlash(FlashType::Success, $this->translator->trans('Question synced to quiz %quiz%', ['%quiz%' => $usage->quiz->name]));
+
+        return $this->redirectToRoute('tvdt_backoffice_question_bank', ['seasonCode' => $season->seasonCode]);
+    }
+
+    private function assertSameSeason(Season $season, Season $subjectSeason): void
+    {
+        if ($season !== $subjectSeason) {
+            throw new NotFoundHttpException();
+        }
+    }
+
+    private function applyAnswerOrdering(BankQuestion $bankQuestion): void
+    {
+        $ordering = 1;
+        foreach ($bankQuestion->answers as $answer) {
+            $answer->ordering = $ordering++;
+        }
+    }
+
+    private function syncUsagesAfterEdit(BankQuestion $bankQuestion): void
+    {
+        $pendingNames = [];
+        foreach ($bankQuestion->usages as $usage) {
+            if (!$usage->quiz->isFinalized()) {
+                $this->questionBankService->syncToQuiz($bankQuestion, $usage);
+            } elseif (!$usage->quiz->hasStartedCandidates()) {
+                $pendingNames[] = $usage->quiz->name;
+            }
+        }
+
+        if ([] !== $pendingNames) {
+            $this->addFlash(
+                FlashType::Warning,
+                $this->translator->trans(
+                    'The question was not synced to finalized quiz(zes): %quizzes%. Use the Sync button to update them.',
+                    ['%quizzes%' => implode(', ', $pendingNames)],
+                ),
+            );
+        }
+    }
+}

src/Controller/Backoffice/QuizController.php

@@ -5,14 +5,15 @@ declare(strict_types=1);
 namespace Tvdt\Controller\Backoffice;
 
 use Doctrine\ORM\EntityManagerInterface;
+use Safe\DateTimeImmutable;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Attribute\AsController;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
-use Symfony\Component\HttpKernel\Exception\MethodNotAllowedHttpException;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Routing\Requirement\Requirement;
+use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Contracts\Translation\TranslatorInterface;
 use Tvdt\Controller\AbstractController;
@@ -22,6 +23,7 @@ use Tvdt\Entity\Question;
 use Tvdt\Entity\Quiz;
 use Tvdt\Entity\QuizCandidate;
 use Tvdt\Entity\Season;
+use Tvdt\Enum\FlashType;
 use Tvdt\Exception\ErrorClearingQuizException;
 use Tvdt\Repository\QuizCandidateRepository;
 use Tvdt\Repository\QuizRepository;
@@ -154,7 +156,13 @@ class QuizController extends AbstractController
     public function answerMapping(Season $season, Quiz $quiz): Response
     {
         $fetchedQuiz = $this->quizRepository->fetchWithQuestions($quiz->id);
-        \assert($fetchedQuiz->questions->count() > 0);
+
+        if ($fetchedQuiz->questions->isEmpty()) {
+            $this->addFlash(FlashType::Warning, $this->translator->trans('This quiz has no questions yet'));
+
+            return $this->redirectToRoute('tvdt_backoffice_quiz_overview', ['seasonCode' => $season->seasonCode, 'quiz' => $quiz->id]);
+        }
+
         $firstQuestion = $fetchedQuiz->questions->first();
         \assert($firstQuestion instanceof Question);
 
@@ -184,6 +192,7 @@ class QuizController extends AbstractController
         ]);
     }
 
+    #[IsCsrfTokenValid('candidate_answer')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
     #[Route(
         '/backoffice/season/{seasonCode:season}/quiz/{quiz}/candidates/{question}',
@@ -232,7 +241,7 @@ class QuizController extends AbstractController
 
         $this->em->flush();
 
-        $this->addFlash('success', $this->translator->trans('Candidate answers saved'));
+        $this->addFlash(FlashType::Success, $this->translator->trans('Candidate answers saved'));
 
         return $this->redirectToRoute('tvdt_backoffice_quiz_candidates_question', [
             'seasonCode' => $season->seasonCode,
@@ -241,69 +250,134 @@ class QuizController extends AbstractController
         ]);
     }
 
+    #[IsCsrfTokenValid('enable_quiz')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
     #[Route(
         '/backoffice/season/{seasonCode:season}/quiz/{quiz}/enable',
         name: 'tvdt_backoffice_enable',
         requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'quiz' => Requirement::UUID.'|null'],
+        methods: ['POST'],
     )]
-    public function enableQuiz(Season $season, ?Quiz $quiz): RedirectResponse
+    public function enableQuiz(Season $season, ?Quiz $quiz, Request $request): RedirectResponse
     {
+        if ($quiz instanceof Quiz && !$quiz->isFinalized()) {
+            $this->addFlash(FlashType::Danger, $this->translator->trans('The quiz must be finalized before it can be activated'));
+
+            return $this->redirectToRoute('tvdt_backoffice_quiz_overview', ['seasonCode' => $season->seasonCode, 'quiz' => $quiz->id]);
+        }
+
         $season->activeQuiz = $quiz;
         $this->em->flush();
 
         if ($quiz instanceof Quiz) {
-            return $this->redirectToRoute('tvdt_backoffice_quiz', ['seasonCode' => $season->seasonCode, 'quiz' => $quiz->id]);
+            return $this->redirectToRoute('tvdt_backoffice_quiz_overview', ['seasonCode' => $season->seasonCode, 'quiz' => $quiz->id]);
+        }
+
+        // When deactivating, stay on the quiz page if one was passed
+        $previousQuizId = $request->request->getString('redirect_quiz');
+        if ('' !== $previousQuizId) {
+            $previousQuiz = $this->em->getRepository(Quiz::class)->find($previousQuizId);
+            if ($previousQuiz instanceof Quiz && $previousQuiz->season === $season) {
+                return $this->redirectToRoute('tvdt_backoffice_quiz_overview', ['seasonCode' => $season->seasonCode, 'quiz' => $previousQuiz->id]);
+            }
         }
 
         return $this->redirectToRoute('tvdt_backoffice_season', ['seasonCode' => $season->seasonCode]);
     }
 
+    #[IsCsrfTokenValid('clear_quiz')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/clear',
         name: 'tvdt_backoffice_quiz_clear',
         requirements: ['quiz' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function clearQuiz(Quiz $quiz): RedirectResponse
     {
         try {
             $this->quizRepository->clearQuiz($quiz);
-            $this->addFlash('success', $this->translator->trans('Quiz cleared'));
+            $quiz->finalizedAt = null;
+            $this->em->flush();
+            $this->addFlash(FlashType::Success, $this->translator->trans('Quiz cleared and no longer finalized'));
         } catch (ErrorClearingQuizException) {
-            $this->addFlash('error', $this->translator->trans('Error clearing quiz'));
+            $this->addFlash(FlashType::Danger, $this->translator->trans('Error clearing quiz'));
         }
 
         return $this->redirectToRoute('tvdt_backoffice_quiz', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
     }
 
+    #[IsCsrfTokenValid('finalize_quiz')]
+    #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
+    #[Route(
+        '/backoffice/quiz/{quiz}/finalize',
+        name: 'tvdt_backoffice_quiz_finalize',
+        requirements: ['quiz' => Requirement::UUID],
+        methods: ['POST'],
+    )]
+    public function finalizeQuiz(Quiz $quiz): RedirectResponse
+    {
+        if ($quiz->questions->isEmpty() || [] !== $quiz->getQuestionErrors()) {
+            $this->addFlash(FlashType::Warning, $this->translator->trans('The quiz cannot be finalized while it has errors'));
+        } elseif (!$quiz->isFinalized()) {
+            $quiz->finalizedAt = new DateTimeImmutable();
+            $this->em->flush();
+            $this->addFlash(FlashType::Success, $this->translator->trans('Quiz finalized'));
+        }
+
+        return $this->redirectToRoute('tvdt_backoffice_quiz', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
+    }
+
+    #[IsCsrfTokenValid('unfinalize_quiz')]
+    #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
+    #[Route(
+        '/backoffice/quiz/{quiz}/unfinalize',
+        name: 'tvdt_backoffice_quiz_unfinalize',
+        requirements: ['quiz' => Requirement::UUID],
+        methods: ['POST'],
+    )]
+    public function unfinalizeQuiz(Quiz $quiz): RedirectResponse
+    {
+        if ($quiz->hasStartedCandidates()) {
+            $this->addFlash(FlashType::Danger, $this->translator->trans('The quiz has already been filled in and can no longer be altered'));
+        } elseif ($quiz->season->activeQuiz === $quiz) {
+            $this->addFlash(FlashType::Danger, $this->translator->trans('Deactivate the quiz before undoing the finalization'));
+        } else {
+            $quiz->finalizedAt = null;
+            $this->em->flush();
+            $this->addFlash(FlashType::Success, $this->translator->trans('Quiz is no longer finalized'));
+        }
+
+        return $this->redirectToRoute('tvdt_backoffice_quiz', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
+    }
+
+    #[IsCsrfTokenValid('delete_quiz')]
     #[IsGranted(SeasonVoter::DELETE, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/delete',
         name: 'tvdt_backoffice_quiz_delete',
         requirements: ['quiz' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function deleteQuiz(Quiz $quiz): RedirectResponse
     {
         $this->quizRepository->deleteQuiz($quiz);
 
-        $this->addFlash('success', $this->translator->trans('Quiz deleted'));
+        $this->addFlash(FlashType::Success, $this->translator->trans('Quiz deleted'));
 
         return $this->redirectToRoute('tvdt_backoffice_season', ['seasonCode' => $quiz->season->seasonCode]);
     }
 
+    #[IsCsrfTokenValid('candidate_correction')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/candidate/{candidate}/modify_correction',
         name: 'tvdt_backoffice_modify_correction',
         requirements: ['quiz' => Requirement::UUID, 'candidate' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function modifyCorrection(Quiz $quiz, Candidate $candidate, Request $request): RedirectResponse
     {
-        if (!$request->isMethod('POST')) {
-            throw new MethodNotAllowedHttpException(['POST']);
-        }
-
         $corrections = (float) $request->request->get('corrections');
 
         $this->quizCandidateRepository->setCorrectionsForCandidate($quiz, $candidate, $corrections);
@@ -311,18 +385,16 @@ class QuizController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_quiz', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
     }
 
+    #[IsCsrfTokenValid('candidate_penalty')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/candidate/{candidate}/modify_penalty',
         name: 'tvdt_backoffice_modify_penalty',
         requirements: ['quiz' => Requirement::UUID, 'candidate' => Requirement::UUID],
+        methods: ['POST'],
     )]
     public function modifyPenalty(Quiz $quiz, Candidate $candidate, Request $request): RedirectResponse
     {
-        if (!$request->isMethod('POST')) {
-            throw new MethodNotAllowedHttpException(['POST']);
-        }
-
         $penalty = (int) $request->request->get('penalty');
 
         $this->quizCandidateRepository->setPenaltyForCandidate($quiz, $candidate, $penalty);
@@ -330,12 +402,13 @@ class QuizController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_quiz', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
     }
 
+    #[IsCsrfTokenValid('toggle_candidate')]
     #[IsGranted(SeasonVoter::EDIT, subject: 'quiz')]
     #[Route(
         '/backoffice/quiz/{quiz}/candidate/{candidate}/toggle',
         name: 'tvdt_backoffice_toggle_candidate',
         requirements: ['quiz' => Requirement::UUID, 'candidate' => Requirement::UUID],
-        methods: ['GET'],
+        methods: ['POST'],
     )]
     public function toggleCandidate(Quiz $quiz, Candidate $candidate): RedirectResponse
     {
@@ -355,7 +428,7 @@ class QuizController extends AbstractController
 
         $this->em->flush();
 
-        $this->addFlash('success', $this->translator->trans('Candidate status updated'));
+        $this->addFlash(FlashType::Success, $this->translator->trans('Candidate status updated'));
 
         return $this->redirectToRoute('tvdt_backoffice_quiz_candidates_tab', ['seasonCode' => $quiz->season->seasonCode, 'quiz' => $quiz->id]);
     }

src/Controller/Backoffice/SeasonController.php

@@ -5,6 +5,8 @@ declare(strict_types=1);
 namespace Tvdt\Controller\Backoffice;
 
 use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Component\Form\Extension\Core\Type\SubmitType;
+use Symfony\Component\Form\Extension\Core\Type\TextType;
 use Symfony\Component\HttpFoundation\File\UploadedFile;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -39,7 +41,39 @@ class SeasonController extends AbstractController
         name: 'tvdt_backoffice_season',
         requirements: ['seasonCode' => self::SEASON_CODE_REGEX],
     )]
-    public function index(Season $season, Request $request): Response
+    public function index(Season $season): Response
+    {
+        return $this->render('backoffice/season.html.twig', [
+            'season' => $season,
+            'activeTab' => 'tests',
+            'template' => 'backoffice/season/tab_tests.html.twig',
+        ]);
+    }
+
+    #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/candidates',
+        name: 'tvdt_backoffice_season_candidates',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX],
+        priority: 10,
+    )]
+    public function candidatesTab(Season $season): Response
+    {
+        return $this->render('backoffice/season.html.twig', [
+            'season' => $season,
+            'activeTab' => 'candidates',
+            'template' => 'backoffice/season/tab_candidates.html.twig',
+        ]);
+    }
+
+    #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/settings',
+        name: 'tvdt_backoffice_season_settings',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX],
+        priority: 10,
+    )]
+    public function settingsTab(Season $season, Request $request): Response
     {
         $form = $this->createForm(SettingsForm::class, $season->settings);
 
@@ -47,11 +81,15 @@ class SeasonController extends AbstractController
 
         if ($form->isSubmitted() && $form->isValid()) {
             $this->em->flush();
+
+            return $this->redirectToRoute('tvdt_backoffice_season_settings', ['seasonCode' => $season->seasonCode]);
         }
 
         return $this->render('backoffice/season.html.twig', [
             'season' => $season,
             'form' => $form,
+            'activeTab' => 'settings',
+            'template' => 'backoffice/season/tab_settings.html.twig',
         ]);
     }
 
@@ -112,4 +150,38 @@ class SeasonController extends AbstractController
 
         return $this->render('/backoffice/quiz_add.html.twig', ['form' => $form, 'season' => $season]);
     }
+
+    #[IsGranted(SeasonVoter::EDIT, subject: 'season')]
+    #[Route(
+        '/backoffice/season/{seasonCode:season}/add-blank-quiz',
+        name: 'tvdt_backoffice_quiz_add_blank',
+        requirements: ['seasonCode' => self::SEASON_CODE_REGEX],
+        priority: 10,
+    )]
+    public function addBlankQuiz(Request $request, Season $season): Response
+    {
+        $form = $this->createFormBuilder(new Quiz())
+            ->add('name', TextType::class, ['label' => 'Quiz name'])
+            ->add('save', SubmitType::class, ['label' => 'Create'])
+            ->getForm();
+
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            /** @var Quiz $quiz */
+            $quiz = $form->getData();
+            $quiz->season = $season;
+            $this->em->persist($quiz);
+            $this->em->flush();
+
+            $this->addFlash(FlashType::Success, $this->translator->trans('Quiz Added!'));
+
+            return $this->redirectToRoute('tvdt_backoffice_quiz_overview', [
+                'seasonCode' => $season->seasonCode,
+                'quiz' => $quiz->id,
+            ]);
+        }
+
+        return $this->render('/backoffice/quiz_add_blank.html.twig', ['form' => $form, 'season' => $season]);
+    }
 }

src/Controller/EliminationController.php

@@ -55,7 +55,7 @@ final class EliminationController extends AbstractController
         $candidate = $this->candidateRepository->getCandidateByHash($elimination->quiz->season, $candidateHash);
         if (!$candidate instanceof Candidate) {
             $this->addFlash(FlashType::Warning,
-                t('Cound not find candidate with name %name%', ['%name%' => Base64::base64UrlDecode($candidateHash)])->trans($this->translator),
+                t('Could not find candidate with name {name}', ['name' => Base64::base64UrlDecode($candidateHash)])->trans($this->translator),
             );
 
             return $this->redirectToRoute('tvdt_elimination', ['elimination' => $elimination->id]);
@@ -64,7 +64,7 @@ final class EliminationController extends AbstractController
         $screenColour = $elimination->getScreenColour($candidate->name);
 
         if (null === $screenColour) {
-            $this->addFlash(FlashType::Warning, $this->translator->trans('Cound not find candidate with name %name% in elimination.', ['%name%' => $candidate->name]));
+            $this->addFlash(FlashType::Warning, $this->translator->trans('Could not find candidate with name {name} in elimination.', ['name' => $candidate->name]));
 
             return $this->redirectToRoute('tvdt_elimination', ['elimination' => $elimination->id]);
         }

src/Controller/QuizController.php

@@ -9,6 +9,7 @@ use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Attribute\AsController;
 use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsCsrfTokenValid;
 use Symfony\Contracts\Translation\TranslatorInterface;
 use Tvdt\Entity\Answer;
 use Tvdt\Entity\Candidate;
@@ -70,10 +71,12 @@ final class QuizController extends AbstractController
         return $this->render('quiz/enter_name.twig', ['season' => $season, 'form' => $form]);
     }
 
+    #[IsCsrfTokenValid('question', tokenKey: 'token', methods: ['POST'])]
     #[Route(
         path: '/{seasonCode:season}/{nameHash}',
         name: 'tvdt_quiz_quiz_page',
         requirements: ['seasonCode' => self::SEASON_CODE_REGEX, 'nameHash' => self::CANDIDATE_HASH_REGEX],
+        methods: ['GET', 'POST'],
     )]
     public function quizPage(
         Season $season,
@@ -96,7 +99,7 @@ final class QuizController extends AbstractController
             return $this->redirectToRoute('tvdt_quiz_enter_name', ['seasonCode' => $season->seasonCode]);
         }
 
-        if ('POST' === $request->getMethod()) {
+        if ($request->isMethod('POST')) {
             // TODO: Extract saving answer logic to a service
             // Check if candidate is inactive for this quiz
             $quizCandidate = $this->quizCandidateRepository->findOneBy(['quiz' => $quiz, 'candidate' => $candidate]);
@@ -114,6 +117,12 @@ final class QuizController extends AbstractController
                 return $this->redirectToRoute('tvdt_quiz_quiz_page', ['seasonCode' => $season->seasonCode, 'nameHash' => $nameHash]);
             }
 
+            if ($answer->question !== $this->questionRepository->findNextQuestionForCandidate($candidate)) {
+                $this->addFlash(FlashType::Danger, $this->translator->trans('You cannot answer this question'));
+
+                return $this->redirectToRoute('tvdt_quiz_quiz_page', ['seasonCode' => $season->seasonCode, 'nameHash' => $nameHash]);
+            }
+
             $givenAnswer = new GivenAnswer($candidate, $answer->question->quiz, $answer);
             $this->entityManager->persist($givenAnswer);
             $this->entityManager->flush();

src/DataFixtures/DevFixtures.php

@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\DataFixtures;
+
+use Doctrine\Bundle\FixturesBundle\Fixture;
+use Doctrine\Bundle\FixturesBundle\FixtureGroupInterface;
+use Doctrine\Persistence\ObjectManager;
+use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
+use Tvdt\Entity\User;
+
+final class DevFixtures extends Fixture implements FixtureGroupInterface
+{
+    public function __construct(
+        private readonly UserPasswordHasherInterface $passwordHasher,
+    ) {}
+
+    public static function getGroups(): array
+    {
+        return ['dev'];
+    }
+
+    public function load(ObjectManager $manager): void
+    {
+        $user = new User();
+        $user->email = 'admin@tijdvoordetest.nl';
+        $user->password = $this->passwordHasher->hashPassword($user, '12345678');
+        $user->roles = ['ROLE_ADMIN'];
+
+        $manager->persist($user);
+
+        $manager->flush();
+    }
+}

src/DataFixtures/KrtekFixtures.php

@@ -7,16 +7,32 @@ namespace Tvdt\DataFixtures;
 use Doctrine\Bundle\FixturesBundle\Fixture;
 use Doctrine\Bundle\FixturesBundle\FixtureGroupInterface;
 use Doctrine\Persistence\ObjectManager;
+use Safe\DateTimeImmutable;
 use Tvdt\Entity\Answer;
+use Tvdt\Entity\BankAnswer;
+use Tvdt\Entity\BankQuestion;
+use Tvdt\Entity\BankQuestionUsage;
 use Tvdt\Entity\Candidate;
 use Tvdt\Entity\Question;
+use Tvdt\Entity\QuestionLabel;
 use Tvdt\Entity\Quiz;
 use Tvdt\Entity\Season;
+use Tvdt\Entity\SeasonSettings;
 
 final class KrtekFixtures extends Fixture implements FixtureGroupInterface
 {
     public const string KRTEK_SEASON = 'krtek-seaspm';
 
+    public const string KRTEK_QUIZ_1 = 'krtek-quiz-1';
+
+    public const string KRTEK_QUIZ_2 = 'krtek-quiz-2';
+
+    public const string BANK_QUESTION_REUSABLE = 'bank-question-reusable';
+
+    public const string BANK_QUESTION_USED = 'bank-question-used';
+
+    public const string BANK_QUESTION_UNUSED = 'bank-question-unused';
+
     public static function getGroups(): array
     {
         return ['test', 'dev'];
@@ -46,11 +62,64 @@ final class KrtekFixtures extends Fixture implements FixtureGroupInterface
         $quiz1 = $this->createQuiz1($season);
         $season->addQuiz($quiz1);
         $season->activeQuiz = $quiz1;
-        $season->addQuiz($this->createQuiz2($season));
+
+        $quiz1->finalizedAt = new DateTimeImmutable();
+        $quiz2 = $this->createQuiz2($season);
+        $season->addQuiz($quiz2);
+
+        \assert($season->settings instanceof SeasonSettings);
+
+        $season->settings->confirmAnswers = true;
+        $season->settings->showNumbers = true;
+
+        $this->createQuestionBank($season, $quiz2);
 
         $manager->flush();
 
         $this->addReference(self::KRTEK_SEASON, $season);
+        $this->addReference(self::KRTEK_QUIZ_1, $quiz1);
+        $this->addReference(self::KRTEK_QUIZ_2, $quiz2);
+    }
+
+    private function createQuestionBank(Season $season, Quiz $usedInQuiz): void
+    {
+        $location = new QuestionLabel('Locatie');
+        $season->addQuestionLabel($location);
+        $finale = new QuestionLabel('Finale');
+        $season->addQuestionLabel($finale);
+
+        $reusable = new BankQuestion();
+        $reusable->question = 'Wie is de Krtek?';
+        $reusable->reusable = true;
+        $reusable->addLabel($finale);
+        $reusable->addAnswer(new BankAnswer('Claudia', true));
+        $reusable->addAnswer(new BankAnswer('Eelco'));
+        $reusable->addAnswer(new BankAnswer('Elise'));
+
+        $season->addBankQuestion($reusable);
+
+        $used = new BankQuestion();
+        $used->question = 'Waar sliep de Krtek?';
+        $used->addLabel($location);
+        $used->addAnswer(new BankAnswer('Boven', true));
+        $used->addAnswer(new BankAnswer('Beneden'));
+        $used->addUsage(new BankQuestionUsage($used, $usedInQuiz));
+
+        $season->addBankQuestion($used);
+
+        $unused = new BankQuestion();
+        $unused->question = 'Wat at de Krtek als ontbijt?';
+        $unused->addLabel($location);
+        $unused->addLabel($finale);
+        $unused->addAnswer(new BankAnswer('Brood', true));
+        $unused->addAnswer(new BankAnswer('Yoghurt'));
+        $unused->addAnswer(new BankAnswer('Niks'));
+
+        $season->addBankQuestion($unused);
+
+        $this->addReference(self::BANK_QUESTION_REUSABLE, $reusable);
+        $this->addReference(self::BANK_QUESTION_USED, $used);
+        $this->addReference(self::BANK_QUESTION_UNUSED, $unused);
     }
 
     private function createQuiz1(Season $season): Quiz

src/Entity/BankAnswer.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Entity;
+
+use Doctrine\DBAL\Types\Types;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Bridge\Doctrine\Types\UuidType;
+use Symfony\Component\ObjectMapper\Attribute\Map;
+use Symfony\Component\Uid\Uuid;
+
+#[ORM\Entity]
+class BankAnswer implements \Stringable
+{
+    #[Map(if: false)]
+    #[ORM\Column(type: UuidType::NAME)]
+    #[ORM\CustomIdGenerator(class: 'doctrine.uuid_generator')]
+    #[ORM\GeneratedValue(strategy: 'CUSTOM')]
+    #[ORM\Id]
+    public private(set) Uuid $id;
+
+    #[ORM\Column(type: Types::SMALLINT, options: ['default' => 0])]
+    public int $ordering = 0;
+
+    #[Map(if: false)]
+    #[ORM\JoinColumn(nullable: false)]
+    #[ORM\ManyToOne(inversedBy: 'answers')]
+    public BankQuestion $bankQuestion;
+
+    public function __construct(
+        #[ORM\Column(length: 255)]
+        public string $text,
+        #[ORM\Column]
+        public bool $isRightAnswer = false,
+    ) {}
+
+    public function __toString(): string
+    {
+        return $this->text;
+    }
+}

src/Entity/BankQuestion.php

@@ -0,0 +1,136 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Entity;
+
+use Doctrine\Common\Collections\ArrayCollection;
+use Doctrine\Common\Collections\Collection;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Bridge\Doctrine\Types\UuidType;
+use Symfony\Component\ObjectMapper\Attribute\Map;
+use Symfony\Component\Uid\Uuid;
+use Symfony\Component\Validator\Constraints as Assert;
+use Symfony\Component\Validator\Context\ExecutionContextInterface;
+use Tvdt\Repository\BankQuestionRepository;
+
+#[ORM\Entity(repositoryClass: BankQuestionRepository::class)]
+class BankQuestion implements \Stringable
+{
+    #[Map(if: false)]
+    #[ORM\Column(type: UuidType::NAME)]
+    #[ORM\CustomIdGenerator(class: 'doctrine.uuid_generator')]
+    #[ORM\GeneratedValue(strategy: 'CUSTOM')]
+    #[ORM\Id]
+    public private(set) Uuid $id;
+
+    #[ORM\Column(length: 255)]
+    public string $question;
+
+    #[Map(if: false)]
+    #[ORM\JoinColumn(nullable: false)]
+    #[ORM\ManyToOne(inversedBy: 'bankQuestions')]
+    public Season $season;
+
+    #[Map(if: false)]
+    #[ORM\Column(options: ['default' => false])]
+    public bool $reusable = false;
+
+    /** @var Collection<int, QuestionLabel> */
+    #[Map(if: false)]
+    #[ORM\ManyToMany(targetEntity: QuestionLabel::class, inversedBy: 'bankQuestions')]
+    public private(set) Collection $labels;
+
+    /** @var Collection<int, BankAnswer> */
+    #[Assert\Count(min: 2, minMessage: 'A question needs at least two answers')]
+    #[Map(if: false)]
+    #[ORM\OneToMany(targetEntity: BankAnswer::class, mappedBy: 'bankQuestion', cascade: ['persist'], orphanRemoval: true)]
+    #[ORM\OrderBy(['ordering' => 'ASC'])]
+    public private(set) Collection $answers;
+
+    /** @var Collection<int, BankQuestionUsage> */
+    #[Map(if: false)]
+    #[ORM\OneToMany(targetEntity: BankQuestionUsage::class, mappedBy: 'bankQuestion', cascade: ['persist'], orphanRemoval: true)]
+    public private(set) Collection $usages;
+
+    public function __construct()
+    {
+        $this->labels = new ArrayCollection();
+        $this->answers = new ArrayCollection();
+        $this->usages = new ArrayCollection();
+    }
+
+    public function addAnswer(BankAnswer $answer): static
+    {
+        if (!$this->answers->contains($answer)) {
+            $this->answers->add($answer);
+            $answer->bankQuestion = $this;
+        }
+
+        return $this;
+    }
+
+    public function removeAnswer(BankAnswer $answer): static
+    {
+        $this->answers->removeElement($answer);
+
+        return $this;
+    }
+
+    public function addLabel(QuestionLabel $label): static
+    {
+        if (!$this->labels->contains($label)) {
+            $this->labels->add($label);
+        }
+
+        return $this;
+    }
+
+    public function removeLabel(QuestionLabel $label): static
+    {
+        $this->labels->removeElement($label);
+
+        return $this;
+    }
+
+    public function addUsage(BankQuestionUsage $usage): static
+    {
+        if (!$this->usages->contains($usage)) {
+            $this->usages->add($usage);
+        }
+
+        return $this;
+    }
+
+    public function isUsed(): bool
+    {
+        return !$this->usages->isEmpty();
+    }
+
+    public function canBeAssigned(): bool
+    {
+        return $this->reusable || !$this->isUsed();
+    }
+
+    public function isUsedInQuiz(Quiz $quiz): bool
+    {
+        return $this->usages->exists(static fn (int $key, BankQuestionUsage $usage): bool => $usage->quiz === $quiz);
+    }
+
+    #[Assert\Callback]
+    public function validateAnswers(ExecutionContextInterface $context): void
+    {
+        $correctAnswers = $this->answers->filter(static fn (BankAnswer $answer): bool => $answer->isRightAnswer)->count();
+
+        if (1 !== $correctAnswers) {
+            $context->buildViolation('A question must have exactly one correct answer')
+                ->atPath('answers')
+                ->addViolation();
+        }
+    }
+
+    public function __toString(): string
+    {
+        return $this->question ?? '';
+    }
+}

src/Entity/BankQuestionUsage.php

@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Entity;
+
+use Doctrine\DBAL\Types\Types;
+use Doctrine\ORM\Mapping as ORM;
+use Gedmo\Mapping\Annotation as Gedmo;
+use Symfony\Bridge\Doctrine\Types\UuidType;
+use Symfony\Component\Uid\Uuid;
+
+#[ORM\Entity]
+#[ORM\UniqueConstraint(fields: ['bankQuestion', 'quiz'])]
+class BankQuestionUsage
+{
+    #[ORM\Column(type: UuidType::NAME)]
+    #[ORM\CustomIdGenerator(class: 'doctrine.uuid_generator')]
+    #[ORM\GeneratedValue(strategy: 'CUSTOM')]
+    #[ORM\Id]
+    public private(set) Uuid $id;
+
+    #[Gedmo\Timestampable(on: 'create')]
+    #[ORM\Column(type: Types::DATETIMETZ_IMMUTABLE, nullable: false)]
+    public private(set) \DateTimeImmutable $created;
+
+    #[ORM\JoinColumn(nullable: true, onDelete: 'SET NULL')]
+    #[ORM\ManyToOne]
+    public ?Question $question = null;
+
+    public function __construct(
+        #[ORM\JoinColumn(nullable: false)]
+        #[ORM\ManyToOne(inversedBy: 'usages')]
+        public private(set) BankQuestion $bankQuestion,
+
+        #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
+        #[ORM\ManyToOne]
+        public private(set) Quiz $quiz,
+    ) {}
+}

src/Entity/Elimination.php

@@ -7,15 +7,20 @@ namespace Tvdt\Entity;
 use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping as ORM;
 use Gedmo\Mapping\Annotation as Gedmo;
+use Gedmo\SoftDeleteable\Traits\SoftDeleteableEntity;
+use Gedmo\Timestampable\Traits\TimestampableEntity;
 use Symfony\Bridge\Doctrine\Types\UuidType;
 use Symfony\Component\HttpFoundation\InputBag;
 use Symfony\Component\Uid\Uuid;
 use Tvdt\Repository\EliminationRepository;
 
+#[Gedmo\SoftDeleteable]
 #[ORM\Entity(repositoryClass: EliminationRepository::class)]
-#[ORM\HasLifecycleCallbacks]
 class Elimination
 {
+    use SoftDeleteableEntity;
+    use TimestampableEntity;
+
     public const string SCREEN_GREEN = 'green';
 
     public const string SCREEN_RED = 'red';
@@ -30,10 +35,6 @@ class Elimination
     #[ORM\Column(type: Types::JSONB)]
     public array $data = [];
 
-    #[Gedmo\Timestampable(on: 'create')]
-    #[ORM\Column(type: Types::DATETIMETZ_IMMUTABLE, nullable: false)]
-    public private(set) \DateTimeImmutable $created;
-
     public function __construct(
         #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
         #[ORM\ManyToOne(inversedBy: 'eliminations')]

src/Entity/GivenAnswer.php

@@ -7,13 +7,17 @@ namespace Tvdt\Entity;
 use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping as ORM;
 use Gedmo\Mapping\Annotation as Gedmo;
+use Gedmo\SoftDeleteable\Traits\SoftDeleteableEntity;
 use Symfony\Bridge\Doctrine\Types\UuidType;
 use Symfony\Component\Uid\Uuid;
 use Tvdt\Repository\GivenAnswerRepository;
 
+#[Gedmo\SoftDeleteable]
 #[ORM\Entity(repositoryClass: GivenAnswerRepository::class)]
 class GivenAnswer
 {
+    use SoftDeleteableEntity;
+
     #[ORM\Column(type: UuidType::NAME, unique: true)]
     #[ORM\CustomIdGenerator(class: 'doctrine.uuid_generator')]
     #[ORM\GeneratedValue(strategy: 'CUSTOM')]
@@ -27,14 +31,14 @@ class GivenAnswer
     public function __construct(
         #[ORM\JoinColumn(nullable: false)]
         #[ORM\ManyToOne(inversedBy: 'givenAnswers')]
-        private(set) Candidate $candidate,
+        public private(set) Candidate $candidate,
 
         #[ORM\JoinColumn(nullable: false, onDelete: 'CASCADE')]
         #[ORM\ManyToOne]
-        private(set) Quiz $quiz,
+        public private(set) Quiz $quiz,
 
         #[ORM\JoinColumn(nullable: false)]
         #[ORM\ManyToOne(inversedBy: 'givenAnswers')]
-        private(set) Answer $answer,
+        public private(set) Answer $answer,
     ) {}
 }

src/Entity/QuestionLabel.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Entity;
+
+use Doctrine\Common\Collections\ArrayCollection;
+use Doctrine\Common\Collections\Collection;
+use Doctrine\ORM\Mapping as ORM;
+use Symfony\Bridge\Doctrine\Types\UuidType;
+use Symfony\Component\Uid\Uuid;
+use Tvdt\Repository\QuestionLabelRepository;
+
+#[ORM\Entity(repositoryClass: QuestionLabelRepository::class)]
+#[ORM\UniqueConstraint(fields: ['name', 'season'])]
+class QuestionLabel implements \Stringable
+{
+    #[ORM\Column(type: UuidType::NAME)]
+    #[ORM\CustomIdGenerator(class: 'doctrine.uuid_generator')]
+    #[ORM\GeneratedValue(strategy: 'CUSTOM')]
+    #[ORM\Id]
+    public private(set) Uuid $id;
+
+    #[ORM\JoinColumn(nullable: false)]
+    #[ORM\ManyToOne(inversedBy: 'questionLabels')]
+    public Season $season;
+
+    /** @var Collection<int, BankQuestion> */
+    #[ORM\ManyToMany(targetEntity: BankQuestion::class, mappedBy: 'labels')]
+    public private(set) Collection $bankQuestions;
+
+    public function __construct(
+        #[ORM\Column(length: 64)]
+        public string $name,
+    ) {
+        $this->bankQuestions = new ArrayCollection();
+    }
+
+    public function __toString(): string
+    {
+        return $this->name;
+    }
+}

src/Entity/Quiz.php

@@ -6,6 +6,7 @@ namespace Tvdt\Entity;
 
 use Doctrine\Common\Collections\ArrayCollection;
 use Doctrine\Common\Collections\Collection;
+use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping as ORM;
 use Symfony\Bridge\Doctrine\Types\UuidType;
 use Symfony\Component\Uid\Uuid;
@@ -40,9 +41,12 @@ class Quiz
     #[ORM\Column(nullable: false, options: ['default' => 1])]
     public int $dropouts = 1;
 
+    #[ORM\Column(type: Types::DATETIMETZ_IMMUTABLE, nullable: true)]
+    public ?\DateTimeImmutable $finalizedAt = null;
+
     /** @var Collection<int, Elimination> */
     #[ORM\OneToMany(targetEntity: Elimination::class, mappedBy: 'quiz', cascade: ['persist'], orphanRemoval: true)]
-    #[ORM\OrderBy(['created' => 'DESC'])]
+    #[ORM\OrderBy(['createdAt' => 'DESC'])]
     public private(set) Collection $eliminations;
 
     public function __construct()
@@ -62,6 +66,29 @@ class Quiz
         return $this;
     }
 
+    public function isFinalized(): bool
+    {
+        return $this->finalizedAt instanceof \DateTimeImmutable;
+    }
+
+    public function hasStartedCandidates(): bool
+    {
+        return $this->candidateData->exists(static fn (int $key, QuizCandidate $quizCandidate): bool => $quizCandidate->started instanceof \DateTimeImmutable);
+    }
+
+    /**
+     * A locked quiz can no longer be altered: it is either explicitly
+     * finalized or a candidate has already started filling it in.
+     */
+    public function isLocked(): bool
+    {
+        if ($this->isFinalized()) {
+            return true;
+        }
+
+        return $this->hasStartedCandidates();
+    }
+
     public function addElimination(Elimination $elimination): self
     {
         $this->eliminations->add($elimination);

src/Entity/QuizCandidate.php

@@ -7,14 +7,18 @@ namespace Tvdt\Entity;
 use Doctrine\DBAL\Types\Types;
 use Doctrine\ORM\Mapping as ORM;
 use Gedmo\Mapping\Annotation as Gedmo;
+use Gedmo\SoftDeleteable\Traits\SoftDeleteableEntity;
 use Symfony\Bridge\Doctrine\Types\UuidType;
 use Symfony\Component\Uid\Uuid;
 use Tvdt\Repository\QuizCandidateRepository;
 
+#[Gedmo\SoftDeleteable]
 #[ORM\Entity(repositoryClass: QuizCandidateRepository::class)]
-#[ORM\UniqueConstraint(columns: ['candidate_id', 'quiz_id'])]
+#[ORM\UniqueConstraint(columns: ['candidate_id', 'quiz_id'], options: ['where' => '(deleted_at IS NULL)'])]
 class QuizCandidate
 {
+    use SoftDeleteableEntity;
+
     #[ORM\Column(type: UuidType::NAME, unique: true)]
     #[ORM\CustomIdGenerator(class: 'doctrine.uuid_generator')]
     #[ORM\GeneratedValue(strategy: 'CUSTOM')]

src/Entity/Season.php

@@ -51,12 +51,24 @@ class Season
     #[ORM\OneToOne(cascade: ['persist', 'remove'])]
     public ?SeasonSettings $settings = null;
 
+    /** @var Collection<int, BankQuestion> */
+    #[ORM\OneToMany(targetEntity: BankQuestion::class, mappedBy: 'season', cascade: ['persist'], orphanRemoval: true)]
+    #[ORM\OrderBy(['question' => 'ASC'])]
+    public private(set) Collection $bankQuestions;
+
+    /** @var Collection<int, QuestionLabel> */
+    #[ORM\OneToMany(targetEntity: QuestionLabel::class, mappedBy: 'season', cascade: ['persist'], orphanRemoval: true)]
+    #[ORM\OrderBy(['name' => 'ASC'])]
+    public private(set) Collection $questionLabels;
+
     public function __construct()
     {
         $this->settings = new SeasonSettings();
         $this->quizzes = new ArrayCollection();
         $this->candidates = new ArrayCollection();
         $this->owners = new ArrayCollection();
+        $this->bankQuestions = new ArrayCollection();
+        $this->questionLabels = new ArrayCollection();
     }
 
     public function addQuiz(Quiz $quiz): static
@@ -79,6 +91,26 @@ class Season
         return $this;
     }
 
+    public function addBankQuestion(BankQuestion $bankQuestion): static
+    {
+        if (!$this->bankQuestions->contains($bankQuestion)) {
+            $this->bankQuestions->add($bankQuestion);
+            $bankQuestion->season = $this;
+        }
+
+        return $this;
+    }
+
+    public function addQuestionLabel(QuestionLabel $questionLabel): static
+    {
+        if (!$this->questionLabels->contains($questionLabel)) {
+            $this->questionLabels->add($questionLabel);
+            $questionLabel->season = $this;
+        }
+
+        return $this;
+    }
+
     public function addOwner(User $owner): static
     {
         if (!$this->owners->contains($owner)) {

src/Entity/User.php

@@ -89,13 +89,6 @@ class User implements UserInterface, PasswordAuthenticatedUserInterface
         return $this->password;
     }
 
-    /** @see UserInterface */
-    public function eraseCredentials(): void
-    {
-        // If you store any temporary, sensitive data on the user, clear it here
-        // $this->plainPassword = null;
-    }
-
     public function addSeason(Season $season): static
     {
         if (!$this->seasons->contains($season)) {

src/Exception/BankQuestionAlreadyUsedException.php

@@ -0,0 +1,7 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Exception;
+
+class BankQuestionAlreadyUsedException extends \Exception {}

src/Exception/QuizLockedException.php

@@ -0,0 +1,7 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Exception;
+
+class QuizLockedException extends \Exception {}

src/Form/BankAnswerFormType.php

@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Form;
+
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\CheckboxType;
+use Symfony\Component\Form\Extension\Core\Type\TextType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use Tvdt\Entity\BankAnswer;
+
+/** @extends AbstractType<BankAnswer> */
+class BankAnswerFormType extends AbstractType
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        $builder
+            ->add('text', TextType::class, [
+                'label' => false,
+                'attr' => ['placeholder' => 'Answer', 'maxlength' => 255],
+            ])
+            ->add('isRightAnswer', CheckboxType::class, [
+                'label' => 'Correct',
+                'required' => false,
+            ])
+        ;
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+            'data_class' => BankAnswer::class,
+            'empty_data' => static fn (): BankAnswer => new BankAnswer(''),
+        ]);
+    }
+}

src/Form/BankQuestionFormType.php

@@ -0,0 +1,75 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Form;
+
+use Doctrine\ORM\QueryBuilder;
+use Symfony\Bridge\Doctrine\Form\Type\EntityType;
+use Symfony\Component\Form\AbstractType;
+use Symfony\Component\Form\Extension\Core\Type\CheckboxType;
+use Symfony\Component\Form\Extension\Core\Type\CollectionType;
+use Symfony\Component\Form\Extension\Core\Type\SubmitType;
+use Symfony\Component\Form\Extension\Core\Type\TextType;
+use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\OptionsResolver\OptionsResolver;
+use Tvdt\Entity\BankQuestion;
+use Tvdt\Entity\QuestionLabel;
+use Tvdt\Entity\Season;
+use Tvdt\Repository\QuestionLabelRepository;
+
+/** @extends AbstractType<BankQuestion> */
+class BankQuestionFormType extends AbstractType
+{
+    public function buildForm(FormBuilderInterface $builder, array $options): void
+    {
+        /** @var Season $season */
+        $season = $options['season'];
+
+        $builder
+            ->add('question', TextType::class, [
+                'label' => 'Question',
+                'attr' => ['maxlength' => 255],
+            ])
+            ->add('reusable', CheckboxType::class, [
+                'label' => 'Reusable',
+                'required' => false,
+                'label_attr' => ['class' => 'checkbox-switch'],
+                'attr' => ['role' => 'switch', 'switch' => null],
+            ])
+            ->add('labels', EntityType::class, [
+                'label' => 'Labels',
+                'class' => QuestionLabel::class,
+                'multiple' => true,
+                'expanded' => true,
+                'required' => false,
+                'query_builder' => static fn (QuestionLabelRepository $repository): QueryBuilder => $repository
+                    ->createQueryBuilder('l')
+                    ->where('l.season = :season')
+                    ->orderBy('l.name', 'ASC')
+                    ->setParameter('season', $season),
+            ])
+            ->add('answers', CollectionType::class, [
+                'label' => 'Answers',
+                'entry_type' => BankAnswerFormType::class,
+                'entry_options' => ['label' => false],
+                'allow_add' => true,
+                'allow_delete' => true,
+                'by_reference' => false,
+                'prototype' => true,
+            ])
+            ->add('save', SubmitType::class, [
+                'label' => 'Save',
+            ])
+        ;
+    }
+
+    public function configureOptions(OptionsResolver $resolver): void
+    {
+        $resolver->setDefaults([
+            'data_class' => BankQuestion::class,
+        ]);
+        $resolver->setRequired('season');
+        $resolver->setAllowedTypes('season', Season::class);
+    }
+}

src/Repository/BankQuestionRepository.php

@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Repository;
+
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+use Tvdt\Entity\BankQuestion;
+use Tvdt\Entity\QuestionLabel;
+use Tvdt\Entity\Season;
+
+/** @extends ServiceEntityRepository<BankQuestion> */
+class BankQuestionRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, BankQuestion::class);
+    }
+
+    /** @return list<BankQuestion> */
+    public function findBySeason(Season $season, ?QuestionLabel $label = null): array
+    {
+        $queryBuilder = $this->createQueryBuilder('bq')
+            ->select('bq', 'ba', 'l', 'u', 'uq')
+            ->leftJoin('bq.answers', 'ba')
+            ->leftJoin('bq.labels', 'l')
+            ->leftJoin('bq.usages', 'u')
+            ->leftJoin('u.quiz', 'uq')
+            ->where('bq.season = :season')
+            ->orderBy('bq.question', 'ASC')
+            ->setParameter('season', $season);
+
+        if ($label instanceof QuestionLabel) {
+            $queryBuilder
+                ->andWhere(':label member of bq.labels')
+                ->setParameter('label', $label);
+        }
+
+        /* @var list<BankQuestion> */
+        return $queryBuilder->getQuery()->getResult();
+    }
+}

src/Repository/QuestionLabelRepository.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Repository;
+
+use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\Persistence\ManagerRegistry;
+use Tvdt\Entity\QuestionLabel;
+
+/** @extends ServiceEntityRepository<QuestionLabel> */
+class QuestionLabelRepository extends ServiceEntityRepository
+{
+    public function __construct(ManagerRegistry $registry)
+    {
+        parent::__construct($registry, QuestionLabel::class);
+    }
+}

src/Repository/QuizRepository.php

@@ -12,6 +12,7 @@ use Safe\Exceptions\DatetimeException;
 use Symfony\Component\Uid\Uuid;
 use Tvdt\Dto\Result;
 use Tvdt\Entity\Quiz;
+use Tvdt\Entity\Season;
 use Tvdt\Exception\ErrorClearingQuizException;
 
 /** @extends ServiceEntityRepository<Quiz> */
@@ -22,6 +23,29 @@ class QuizRepository extends ServiceEntityRepository
         parent::__construct($registry, Quiz::class);
     }
 
+    /**
+     * Quizzes of the season that can still receive bank questions:
+     * not finalized and not started by any candidate.
+     *
+     * @return list<Quiz>
+     */
+    public function findAssignableForSeason(Season $season): array
+    {
+        /* @var list<Quiz> */
+        return $this->getEntityManager()->createQuery(<<<DQL
+            select q from Tvdt\Entity\Quiz q
+            where q.season = :season
+            and q.finalizedAt is null
+            and not exists (
+                select 1 from Tvdt\Entity\QuizCandidate qc
+                where qc.quiz = q and qc.started is not null
+            )
+            order by q.id asc
+            DQL)
+            ->setParameter('season', $season)
+            ->getResult();
+    }
+
     /** @throws ErrorClearingQuizException */
     public function clearQuiz(Quiz $quiz): void
     {
@@ -113,8 +137,8 @@ class QuizRepository extends ServiceEntityRepository
     {
         return $this->getEntityManager()->createQuery(<<<dql
             select q, qz, a from Tvdt\Entity\Quiz q
-            join q.questions qz
-            join qz.answers a
+            left join q.questions qz
+            left join qz.answers a
             where q.id = :id
             dql)->setParameter('id', $id)->getSingleResult();
     }
@@ -127,8 +151,8 @@ class QuizRepository extends ServiceEntityRepository
     {
         return $this->getEntityManager()->createQuery(<<<dql
             select q, qz, a, ac, s, sc, qc from Tvdt\Entity\Quiz q
-            join q.questions qz
-            join qz.answers a
+            left join q.questions qz
+            left join qz.answers a
             left join a.candidates ac
             join q.season s
             left join s.candidates sc

src/Security/Voter/SeasonVoter.php

@@ -8,14 +8,16 @@ use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Authorization\Voter\Vote;
 use Symfony\Component\Security\Core\Authorization\Voter\Voter;
 use Tvdt\Entity\Answer;
+use Tvdt\Entity\BankQuestion;
 use Tvdt\Entity\Candidate;
 use Tvdt\Entity\Elimination;
 use Tvdt\Entity\Question;
+use Tvdt\Entity\QuestionLabel;
 use Tvdt\Entity\Quiz;
 use Tvdt\Entity\Season;
 use Tvdt\Entity\User;
 
-/** @extends Voter<string, Season|Elimination|Quiz|Candidate|Answer|Question> */
+/** @extends Voter<string, Season|Elimination|Quiz|Candidate|Answer|Question|BankQuestion|QuestionLabel> */
 final class SeasonVoter extends Voter
 {
     public const string EDIT = 'SEASON_EDIT';
@@ -24,15 +26,19 @@ final class SeasonVoter extends Voter
 
     public const string DELETE = 'SEASON_DELETE';
 
+    public const string MODIFY_QUIZ_CONTENT = 'QUIZ_MODIFY_CONTENT';
+
     protected function supports(string $attribute, mixed $subject): bool
     {
-        return \in_array($attribute, [self::EDIT, self::DELETE, self::ELIMINATION], true)
+        return \in_array($attribute, [self::EDIT, self::DELETE, self::ELIMINATION, self::MODIFY_QUIZ_CONTENT], true)
                 && (
                     $subject instanceof Answer
+                    || $subject instanceof BankQuestion
                     || $subject instanceof Candidate
                     || $subject instanceof Elimination
                     || $subject instanceof Season
                     || $subject instanceof Question
+                    || $subject instanceof QuestionLabel
                     || $subject instanceof Quiz
                 );
     }
@@ -44,19 +50,36 @@ final class SeasonVoter extends Voter
             return false;
         }
 
-        if ($user->isAdmin) {
-            return true;
-        }
-
         $season = match (true) {
             $subject instanceof Answer => $subject->question->quiz->season,
             $subject instanceof Elimination,
             $subject instanceof Question => $subject->quiz->season,
+            $subject instanceof BankQuestion,
             $subject instanceof Candidate,
+            $subject instanceof QuestionLabel,
             $subject instanceof Quiz => $subject->season,
             $subject instanceof Season => $subject,
         };
 
+        if (self::MODIFY_QUIZ_CONTENT === $attribute) {
+            $quiz = match (true) {
+                $subject instanceof Answer => $subject->question->quiz,
+                $subject instanceof Question => $subject->quiz,
+                $subject instanceof Quiz => $subject,
+                default => null,
+            };
+
+            if (!$quiz instanceof Quiz || $quiz->isLocked()) {
+                return false;
+            }
+
+            return $user->isAdmin || $season->isOwner($user);
+        }
+
+        if ($user->isAdmin) {
+            return true;
+        }
+
         return match ($attribute) {
             self::EDIT, self::DELETE, self::ELIMINATION => $season->isOwner($user),
             default => false,

src/Service/QuestionBankService.php

@@ -0,0 +1,117 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Service;
+
+use Doctrine\DBAL\LockMode;
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Component\ObjectMapper\ObjectMapperInterface;
+use Tvdt\Entity\Answer;
+use Tvdt\Entity\BankQuestion;
+use Tvdt\Entity\BankQuestionUsage;
+use Tvdt\Entity\Question;
+use Tvdt\Entity\Quiz;
+use Tvdt\Exception\BankQuestionAlreadyUsedException;
+use Tvdt\Exception\QuizLockedException;
+
+final readonly class QuestionBankService
+{
+    public function __construct(
+        private EntityManagerInterface $entityManager,
+        private ObjectMapperInterface $objectMapper,
+    ) {}
+
+    /**
+     * Copy a bank question (with its answers) into a quiz and record the usage.
+     *
+     * @throws QuizLockedException              when the quiz is finalized or already filled in
+     * @throws BankQuestionAlreadyUsedException when the question is single-use and used, or already in this quiz
+     */
+    public function assignToQuiz(BankQuestion $bankQuestion, Quiz $quiz): void
+    {
+        if ($bankQuestion->season !== $quiz->season) {
+            throw new \InvalidArgumentException('Bank question and quiz belong to different seasons');
+        }
+
+        if ($quiz->isLocked()) {
+            throw new QuizLockedException();
+        }
+
+        $this->entityManager->wrapInTransaction(function () use ($bankQuestion, $quiz): void {
+            // Pessimistic write lock serialises concurrent assignment attempts for the same BankQuestion
+            $this->entityManager->lock($bankQuestion, LockMode::PESSIMISTIC_WRITE);
+
+            if (!$bankQuestion->canBeAssigned() || $bankQuestion->isUsedInQuiz($quiz)) {
+                throw new BankQuestionAlreadyUsedException();
+            }
+
+            $maxOrdering = 0;
+            foreach ($quiz->questions as $existingQuestion) {
+                $maxOrdering = max($maxOrdering, $existingQuestion->ordering);
+            }
+
+            /** @var Question $question */
+            $question = $this->objectMapper->map($bankQuestion, Question::class);
+            $question->ordering = $maxOrdering + 1;
+
+            foreach ($bankQuestion->answers as $bankAnswer) {
+                /** @var Answer $answer */
+                $answer = $this->objectMapper->map($bankAnswer, Answer::class);
+                $question->addAnswer($answer);
+            }
+
+            $quiz->addQuestion($question);
+
+            $usage = new BankQuestionUsage($bankQuestion, $quiz);
+            $usage->question = $question;
+
+            $bankQuestion->addUsage($usage);
+
+            $this->entityManager->persist($question);
+            $this->entityManager->flush();
+        });
+    }
+
+    /**
+     * Propagate bank question edits to a quiz copy.
+     * Only safe on quizzes where no candidate has started (no GivenAnswers exist yet).
+     */
+    public function syncToQuiz(BankQuestion $bankQuestion, BankQuestionUsage $usage): void
+    {
+        $question = $usage->question;
+        if (!$question instanceof Question) {
+            return;
+        }
+
+        $question->question = $bankQuestion->question;
+
+        // Replace answers (safe: no started candidates means no GivenAnswers)
+        foreach ($question->answers->toArray() as $existingAnswer) {
+            $question->answers->removeElement($existingAnswer);
+            $this->entityManager->remove($existingAnswer);
+        }
+
+        foreach ($bankQuestion->answers as $bankAnswer) {
+            /** @var Answer $answer */
+            $answer = $this->objectMapper->map($bankAnswer, Answer::class);
+            $question->addAnswer($answer);
+        }
+
+        $this->entityManager->flush();
+    }
+
+    /** Remove the quiz copy created by this usage and delete the usage record. */
+    public function unassignFromQuiz(BankQuestionUsage $usage): void
+    {
+        $question = $usage->question;
+        if ($question instanceof Question) {
+            $question->quiz->questions->removeElement($question);
+            $this->entityManager->remove($question);
+        }
+
+        $usage->bankQuestion->usages->removeElement($usage);
+        $this->entityManager->remove($usage);
+        $this->entityManager->flush();
+    }
+}

src/Service/QuizSpreadsheetService.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace Tvdt\Service;
 
+use PhpOffice\PhpSpreadsheet\Cell\Coordinate;
 use PhpOffice\PhpSpreadsheet\Reader;
 use PhpOffice\PhpSpreadsheet\Spreadsheet;
 use PhpOffice\PhpSpreadsheet\Writer;
@@ -17,39 +18,40 @@ class QuizSpreadsheetService
 {
     public function generateTemplate(bool $fillExample = true): \Closure
     {
-        $spreadsheet = new Spreadsheet();
-
-        $sheet = $spreadsheet->getActiveSheet();
-
-        $sheet->getStyle('1:1')->getFont()->setBold(true);
-
-        $sheet->setCellValue('A1', 'Question');
-        $sheet->getColumnDimension('A')->setWidth(30);
-        $sheet->getStyle('A:A')->getAlignment()->setWrapText(true);
-
-        $counter = 1;
-        foreach (range('B', 'L', 2) as $column) {
-            $sheet->setCellValue($column.'1', 'Answer '.$counter++);
-            $sheet->getColumnDimension($column)->setWidth(30);
-            $sheet->getStyle($column.':'.$column)->getAlignment()->setWrapText(true);
-        }
-
-        foreach (range('C', 'M', 2) as $column) {
-            $sheet->setCellValue($column.'1', 'Correct');
-            $sheet->getColumnDimension($column)->setAutoSize(true);
-        }
+        $quiz = new Quiz();
 
         if ($fillExample) {
-            $sheet->setCellValue('B2', 'Man');
-            $sheet->setCellValue('C2', true);
+            $geslacht = new Question();
+            $geslacht->question = 'Is de mol een man of een vrouw?';
+            $geslacht->ordering = 1;
+            $geslacht->addAnswer(new Answer('Man', true));
+            $geslacht->addAnswer(new Answer('Vrouw'));
+            $quiz->addQuestion($geslacht);
 
-            $sheet->setCellValue('D2', 'Vrouw');
-            $sheet->setCellValue('E2', false);
+            $identiteit = new Question();
+            $identiteit->question = 'Wie is de mol?';
+            $identiteit->ordering = 2;
+            foreach ([
+                ['Emma', false],
+                ['Jan', false],
+                ['Sara', false],
+                ['Piet', false],
+                ['Lisa', true],
+                ['Kees', false],
+                ['Anna', false],
+                ['Henk', false],
+                ['Nina', false],
+                ['Joost', false],
+            ] as $i => [$name, $correct]) {
+                $answer = new Answer($name, $correct);
+                $answer->ordering = $i + 1;
+                $identiteit->addAnswer($answer);
+            }
 
-            $sheet->setCellValue('A2', 'Is de mol een man of een vrouw?');
+            $quiz->addQuestion($identiteit);
         }
 
-        return $this->toXlsx($spreadsheet);
+        return $this->quizToXlsx($quiz);
     }
 
     /** @throws SpreadsheetDataException */
@@ -94,24 +96,16 @@ class QuizSpreadsheetService
             $answerCounter = 1;
             $arrCounter = 1;
 
-            while (true) {
-                try {
-                    if (null === $questionArr[$arrCounter]) {
-                        if (1 === $answerCounter) {
-                            $errors[] = \sprintf('Question %d has no answers', $answerCounter);
-                        }
-
-                        break;
-                    }
-                } catch (\ErrorException) {
-                    break;
-                }
-
+            while (\array_key_exists($arrCounter, $questionArr) && null !== $questionArr[$arrCounter]) {
                 $answer = new Answer((string) $questionArr[$arrCounter++], (bool) $questionArr[$arrCounter++]);
                 $answer->ordering = $answerCounter++;
                 $question->addAnswer($answer);
             }
 
+            if (1 === $answerCounter) {
+                $errors[] = \sprintf('Question %d has no answers', $question->ordering);
+            }
+
             $quiz->addQuestion($question);
         }
 
@@ -120,9 +114,47 @@ class QuizSpreadsheetService
         }
     }
 
-    public function quizToXlsx(Quiz $quiz): void
+    public function quizToXlsx(Quiz $quiz): \Closure
     {
-        throw new \Exception('Not implemented');
+        $spreadsheet = new Spreadsheet();
+        $sheet = $spreadsheet->getActiveSheet();
+
+        // Write data rows first so we know the maximum answer count.
+        $maxAnswers = 0;
+        $row = 2;
+        foreach ($quiz->questions as $question) {
+            $sheet->setCellValue('A'.$row, $question->question);
+
+            $col = 0;
+            foreach ($question->answers as $answer) {
+                $sheet->setCellValue(Coordinate::stringFromColumnIndex(2 + 2 * $col).$row, $answer->text);
+                $sheet->setCellValue(Coordinate::stringFromColumnIndex(3 + 2 * $col).$row, $answer->isRightAnswer);
+                ++$col;
+            }
+
+            $maxAnswers = max($maxAnswers, $col);
+            ++$row;
+        }
+
+        // Write headers last, sized to the widest question.
+        $sheet->getStyle('1:1')->getFont()->setBold(true);
+        $sheet->setCellValue('A1', 'Question');
+        $sheet->getColumnDimension('A')->setWidth(30);
+        $sheet->getStyle('A:A')->getAlignment()->setWrapText(true);
+
+        for ($i = 0; $i < $maxAnswers; ++$i) {
+            $answerCol = Coordinate::stringFromColumnIndex(2 + 2 * $i);
+            $correctCol = Coordinate::stringFromColumnIndex(3 + 2 * $i);
+
+            $sheet->setCellValue($answerCol.'1', 'Answer '.($i + 1));
+            $sheet->getColumnDimension($answerCol)->setWidth(30);
+            $sheet->getStyle($answerCol.':'.$answerCol)->getAlignment()->setWrapText(true);
+
+            $sheet->setCellValue($correctCol.'1', 'Correct');
+            $sheet->getColumnDimension($correctCol)->setAutoSize(true);
+        }
+
+        return $this->toXlsx($spreadsheet);
     }
 
     private function toXlsx(Spreadsheet $spreadsheet): \Closure

templates/backoffice/login/login.html.twig

@@ -3,39 +3,33 @@
 {% block title %}Log in{% endblock %}
 
 {% block body %}
-    {% if app.user %}
+    <form method="post">
+        <h1 class="py-2 h3 mb-3 font-weight-normal">{{ 'Please sign in'|trans }}</h1>
         <div class="mb-3">
-            You are logged in as {{ app.user.userIdentifier }}, <a href="{{ path('tvdt_login_logout') }}">Logout</a>
+            <label for="username" class="form-label">{{ 'Email'|trans }}</label>
+            <input type="email" value="{{ last_username }}" name="_username" id="username" class="form-control"
+                   autocomplete="email" required autofocus>
         </div>
-    {% else %}
-        <form method="post">
-            <h1 class="py-2 h3 mb-3 font-weight-normal">{{ 'Please sign in'|trans }}</h1>
-            <div class="mb-3">
-                <label for="username" class="form-label">{{ 'Email'|trans }}</label>
-                <input type="email" value="{{ last_username }}" name="_username" id="username" class="form-control"
-                       autocomplete="email" required autofocus>
-            </div>
 
-            <div class="mb-3">
-                <label for="password" class="form-label">{{ 'Password'|trans }}</label>
-                <input type="password" name="_password" id="password" class="form-control"
-                       autocomplete="current-password"
-                       required>
-            </div>
+        <div class="mb-3">
+            <label for="password" class="form-label">{{ 'Password'|trans }}</label>
+            <input type="password" name="_password" id="password" class="form-control"
+                   autocomplete="current-password"
+                   required>
+        </div>
 
-            <input type="hidden" name="_csrf_token" data-controller="csrf-protection"
-                   value="{{ csrf_token('authenticate') }}">
+        <input type="hidden" name="_csrf_token" data-controller="csrf-protection"
+               value="{{ csrf_token('authenticate') }}">
 
-            <div class="mb-3 form-check">
-                <input type="checkbox" name="_remember_me" id="_remember_me" class="form-check-input">
-                <label for="_remember_me" class="form-check-label">{{ 'Remember me'|trans }}</label>
-            </div>
+        <div class="mb-3 form-check">
+            <input type="checkbox" name="_remember_me" id="_remember_me" class="form-check-input" checked>
+            <label for="_remember_me" class="form-check-label">{{ 'Remember me'|trans }}</label>
+        </div>
 
-            <button class="btn btn-lg btn-primary" type="submit">
-                {{ 'Sign in'|trans }}
-            </button>
-            <a href="{{ path('tvdt_register') }}"
-               class="btn btn-link">{{ 'Create an account'|trans }}</a>
-        </form>
-    {% endif %}
+        <button class="btn btn-lg btn-primary" type="submit">
+            {{ 'Sign in'|trans }}
+        </button>
+        <a href="{{ path('tvdt_register') }}"
+           class="btn btn-link">{{ 'Create an account'|trans }}</a>
+    </form>
 {% endblock %}

templates/backoffice/prepare_elimination/index.html.twig

@@ -15,6 +15,7 @@
     <div class="row">
         <div class="col-12 col-md-6">
             <form method="post">
+                <input type="hidden" name="_token" value="{{ csrf_token('prepare_elimination') }}">
                 {%~ for candidate, colour in elimination.data %}
                     <div class="row mb-3">
                         <label for="colour-{{ candidate|lower }}" class="col-4 col-form-label">{{ candidate }}</label>

templates/backoffice/question_bank/form.html.twig

@@ -0,0 +1,55 @@
+{% extends 'backoffice/base.html.twig' %}
+
+{% macro answer_row(answerForm) %}
+    <div class="d-flex align-items-center gap-2 mb-2" data-collection-item>
+        <div class="flex-grow-1">{{ form_widget(answerForm.text) }}</div>
+        <div class="form-check">
+            {{ form_widget(answerForm.isRightAnswer, {attr: {class: 'form-check-input'}}) }}
+            {{ form_label(answerForm.isRightAnswer, null, {label_attr: {class: 'form-check-label'}}) }}
+        </div>
+        <button type="button" class="btn btn-sm btn-outline-danger"
+                data-action="bo--form-collection#removeItem">&times;</button>
+    </div>
+{% endmacro %}
+
+{% block title %}{{ parent() }}{{ 'Question bank'|trans }}{% endblock %}
+
+{% block breadcrumbs %}
+    <nav aria-label="breadcrumb" class="mb-3">
+        <ol class="breadcrumb">
+            <li class="breadcrumb-item"><a href="{{ path('tvdt_backoffice_index') }}">{{ 'Home'|trans }}</a></li>
+            <li class="breadcrumb-item"><a href="{{ path('tvdt_backoffice_season', {seasonCode: season.seasonCode}) }}">{{ season.name }}</a></li>
+            <li class="breadcrumb-item"><a href="{{ path('tvdt_backoffice_question_bank', {seasonCode: season.seasonCode}) }}">{{ 'Question bank'|trans }}</a></li>
+            <li class="breadcrumb-item active" aria-current="page">{{ bankQuestion is null ? 'Add question'|trans : 'Edit question'|trans }}</li>
+        </ol>
+    </nav>
+{% endblock %}
+
+{% block body %}
+    <div class="row">
+        <div class="col-md-6 col-12">
+            <h2 class="mb-3">{{ bankQuestion is null ? 'Add question'|trans : 'Edit question'|trans }}</h2>
+
+            {{ form_start(form) }}
+            {{ form_row(form.question) }}
+            {{ form_row(form.reusable) }}
+            {{ form_row(form.labels) }}
+
+            <div data-controller="bo--form-collection"
+                 data-bo--form-collection-prototype-value="{{ _self.answer_row(form.answers.vars.prototype)|e('html_attr') }}">
+                {{ form_label(form.answers) }}
+                {{ form_errors(form.answers) }}
+                <div data-bo--form-collection-target="collection">
+                    {% for answerForm in form.answers %}
+                        {{ _self.answer_row(answerForm) }}
+                    {% endfor %}
+                </div>
+                {% do form.answers.setRendered %}
+                <button type="button" class="btn btn-sm btn-outline-primary mb-3"
+                        data-action="bo--form-collection#addItem">{{ 'Add answer'|trans }}</button>
+            </div>
+
+            {{ form_end(form) }}
+        </div>
+    </div>
+{% endblock body %}

templates/backoffice/quiz/tab_candidates_list.html.twig

@@ -35,14 +35,16 @@
                     {% endif %}
                 </td>
                 <td>
-                    <a href="{{ path('tvdt_backoffice_toggle_candidate', {quiz: quiz.id, candidate: candidate.id}) }}"
-                       class="btn btn-sm btn-outline-secondary">
-                        {% if quizCandidate == null or quizCandidate.active %}
-                            {{ 'Deactivate'|trans }}
-                        {% else %}
-                            {{ 'Activate'|trans }}
-                        {% endif %}
-                    </a>
+                    <form action="{{ path('tvdt_backoffice_toggle_candidate', {quiz: quiz.id, candidate: candidate.id}) }}" method="POST">
+                        <input type="hidden" name="_token" value="{{ csrf_token('toggle_candidate') }}">
+                        <button type="submit" class="btn btn-sm btn-outline-secondary">
+                            {% if quizCandidate == null or quizCandidate.active %}
+                                {{ 'Deactivate'|trans }}
+                            {% else %}
+                                {{ 'Activate'|trans }}
+                            {% endif %}
+                        </button>
+                    </form>
                 </td>
             </tr>
         {% endfor %}

templates/backoffice/quiz/tab_overview.html.twig

@@ -1,22 +1,86 @@
+{% macro confirm_modal(id, target, body, formAction, csrfToken) %}
+    <div class="modal fade" id="{{ id }}" data-bs-backdrop="static"
+         tabindex="-1"
+         data-bo--quiz-target="{{ target }}"
+         aria-labelledby="{{ id }}Label" aria-hidden="true">
+        <div class="modal-dialog">
+            <div class="modal-content">
+                <div class="modal-header">
+                    <h1 class="modal-title fs-5" id="{{ id }}Label">{{ 'Please Confirm'|trans }}</h1>
+                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                </div>
+                <div class="modal-body">{{ body }}</div>
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'No'|trans }}</button>
+                    <form action="{{ formAction }}" method="POST">
+                        <input type="hidden" name="_token" value="{{ csrfToken }}">
+                        <button type="submit" class="btn btn-danger">{{ 'Yes'|trans }}</button>
+                    </form>
+                </div>
+            </div>
+        </div>
+    </div>
+{% endmacro %}
+
 <div data-controller="bo--quiz">
-    <h4 class="mb-3">Quick actions</h4>
+    <h4 class="mb-3">
+        {{ 'Quick actions'|trans }}
+        {% if quiz.isFinalized %}
+            <span class="badge text-bg-success">{{ 'Finalized'|trans }}</span>
+        {% elseif quiz.isLocked %}
+            <span class="badge text-bg-warning">{{ 'Locked (answers given)'|trans }}</span>
+        {% else %}
+            <span class="badge text-bg-secondary">{{ 'Draft'|trans }}</span>
+        {% endif %}
+    </h4>
     <div class="mb-3 btn-group">
 
         {% if quiz is same as (season.activeQuiz) %}
-            <a class="btn btn-secondary"
-               href="{{ path('tvdt_backoffice_enable', {seasonCode: season.seasonCode, quiz: 'null'}) }}">{{ 'Deactivate Quiz'|trans }}</a>
+            <form action="{{ path('tvdt_backoffice_enable', {seasonCode: season.seasonCode, quiz: 'null'}) }}" method="POST">
+                <input type="hidden" name="_token" value="{{ csrf_token('enable_quiz') }}">
+                <input type="hidden" name="redirect_quiz" value="{{ quiz.id }}">
+                <button type="submit" class="btn btn-secondary rounded-0 rounded-start">
+                    {{ 'Deactivate Quiz'|trans }}
+                </button>
+            </form>
         {% else %}
-            <a class="btn btn-primary"
-               href="{{ path('tvdt_backoffice_enable', {seasonCode: season.seasonCode, quiz: quiz.id}) }}">{{ 'Make active'|trans }}</a>
+            <form action="{{ path('tvdt_backoffice_enable', {seasonCode: season.seasonCode, quiz: quiz.id}) }}" method="POST">
+                <input type="hidden" name="_token" value="{{ csrf_token('enable_quiz') }}">
+                <button type="submit" class="btn btn-primary rounded-0 rounded-start"
+                        {% if not quiz.isFinalized %}disabled data-bs-toggle="tooltip"
+                        title="{{ 'The quiz must be finalized before it can be activated'|trans }}"{% endif %}>
+                    {{ 'Make active'|trans }}
+                </button>
+            </form>
+        {% endif %}
+        {% if not quiz.isFinalized %}
+            <form action="{{ path('tvdt_backoffice_quiz_finalize', {quiz: quiz.id}) }}" method="POST">
+                <input type="hidden" name="_token" value="{{ csrf_token('finalize_quiz') }}">
+                <button type="submit" class="btn btn-success rounded-0">
+                    {{ 'Finalize'|trans }}
+                </button>
+            </form>
+        {% elseif not quiz.hasStartedCandidates and quiz is not same as (season.activeQuiz) %}
+            <form action="{{ path('tvdt_backoffice_quiz_unfinalize', {quiz: quiz.id}) }}" method="POST">
+                <input type="hidden" name="_token" value="{{ csrf_token('unfinalize_quiz') }}">
+                <button type="submit" class="btn btn-outline-success rounded-0">
+                    {{ 'Undo finalization'|trans }}
+                </button>
+            </form>
         {% endif %}
         <button class="btn btn-danger" data-action="click->bo--quiz#clearQuiz">
             {{ 'Clear Quiz...'|trans }}
         </button>
-        <button class="btn btn-danger" data-action="click->bo--quiz#deleteQuiz">
+        <button class="btn btn-danger rounded-0 rounded-end" data-action="click->bo--quiz#deleteQuiz">
             {{ 'Delete Quiz...'|trans }}
         </button>
     </div>
 
+    <a class="btn btn-outline-secondary mb-3"
+       href="{{ path('tvdt_backoffice_quiz_export', {quiz: quiz.id}) }}">
+        {{ 'Export to XLSX'|trans }}
+    </a>
+
     <h4 class="mb-3">{{ 'Questions'|trans }}</h4>
     <div class="accordion">
         {%~ for question in quiz.questions ~%}
@@ -28,7 +92,8 @@
                             data-bs-target="#question-{{ loop.index0 }}"
                             aria-controls="question-{{ loop.index0 }}">
                         {% set questionError = questionErrors[question.id.toString] ?? null %}
-                        <span class="badge rounded-pill me-2{% if questionError %} text-bg-danger{% else %} invisible{% endif %}"{% if questionError %} data-bs-toggle="tooltip" title="{{ questionError }}"{% endif %}>!</span>
+                        <span
+                            class="badge rounded-pill me-2{% if questionError %} text-bg-danger{% else %} invisible{% endif %}"{% if questionError %} data-bs-toggle="tooltip" title="{{ questionError }}"{% endif %}>!</span>
                         {{~ loop.index -}}. {{ question.question -}}
                     </button>
                 </h2>
@@ -57,49 +122,19 @@
         {% endfor %}
     </div>
 
-    {# Modal Clear #}
-    <div class="modal fade" id="clearQuizModal" data-bs-backdrop="static"
-         tabindex="-1"
-         data-bo--quiz-target="clearModal"
-         aria-labelledby="staticBackdropLabel" aria-hidden="true">
-        <div class="modal-dialog">
-            <div class="modal-content">
-                <div class="modal-header">
-                    <h1 class="modal-title fs-5" id="staticBackdropLabel">{{ 'Please Confirm'|trans }}</h1>
-                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                </div>
-                <div class="modal-body">
-                    {{ 'Are you sure you want to clear all the results? This will also delete all the eliminations.'|trans }}
-                </div>
-                <div class="modal-footer">
-                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'No'|trans }}</button>
-                    <a href="{{ path('tvdt_backoffice_quiz_clear', {quiz: quiz.id}) }}"
-                       class="btn btn-danger">{{ 'Yes'|trans }}</a>
-                </div>
-            </div>
-        </div>
-    </div>
+    {{ _self.confirm_modal(
+        'clearQuizModal',
+        'clearModal',
+        'Are you sure you want to clear all the results? This will also delete all the eliminations.'|trans,
+        path('tvdt_backoffice_quiz_clear', {quiz: quiz.id}),
+        csrf_token('clear_quiz'),
+    ) }}
 
-    {# Modal Delete #}
-    <div class="modal fade" id="deleteQuizModal" data-bs-backdrop="static"
-         tabindex="-1"
-         data-bo--quiz-target="deleteModal"
-         aria-labelledby="staticBackdropLabel" aria-hidden="true">
-        <div class="modal-dialog">
-            <div class="modal-content">
-                <div class="modal-header">
-                    <h1 class="modal-title fs-5" id="staticBackdropLabel">{{ 'Please Confirm'|trans }}</h1>
-                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-                </div>
-                <div class="modal-body">
-                    {{ 'Are you sure you want to delete this quiz?'|trans }}
-                </div>
-                <div class="modal-footer">
-                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'No'|trans }}</button>
-                    <a href="{{ path('tvdt_backoffice_quiz_delete', {quiz: quiz.id}) }}"
-                       class="btn btn-danger">{{ 'Yes'|trans }}</a>
-                </div>
-            </div>
-        </div>
-    </div>
+    {{ _self.confirm_modal(
+        'deleteQuizModal',
+        'deleteModal',
+        'Are you sure you want to delete this quiz?'|trans,
+        path('tvdt_backoffice_quiz_delete', {quiz: quiz.id}),
+        csrf_token('delete_quiz'),
+    ) }}
 </div>

templates/backoffice/quiz/tab_result.html.twig

@@ -1,77 +1,71 @@
 <h4 class="mb-3">{{ 'Score'|trans }}</h4>
-    <div class="btn-toolbar mb-3" role="toolbar">
-        <div class="btn-group me-2">
-            {# <a class="btn btn-primary">{{ 'Start Elimination'|trans }}</a> #}
-            <a href="{{ path('tvdt_prepare_elimination', {seasonCode: season.seasonCode, quiz: quiz.id}) }}"
-               class="btn btn-secondary">{{ 'Prepare Custom Elimination'|trans }}</a>
-            {%~ if not quiz.eliminations.empty %}
-                <button class="btn btn-secondary dropdown-toggle"
-                        data-bs-toggle="dropdown">{{ 'Load Prepared Elimination'|trans }}</button>
-                <ul class="dropdown-menu">
-                    {%~ for elimination in quiz.eliminations %}
-                        <li><a class="dropdown-item"
-                               href="{{ path('tvdt_prepare_elimination_view', {elimination: elimination.id}) }}">{{ elimination.created|format_datetime() }}</a>
-                        </li>
-                    {%~ endfor %}
-                </ul>
-            {% endif %}
-        </div>
+<div class="btn-toolbar mb-3" role="toolbar">
+    <div class="btn-group me-2">
+        <form action="{{ path('tvdt_prepare_elimination', {seasonCode: season.seasonCode, quiz: quiz.id}) }}" method="POST">
+            <input type="hidden" name="_token" value="{{ csrf_token('prepare_elimination') }}">
+            <button type="submit" class="btn btn-secondary rounded-0 rounded-start">{{ 'Prepare Custom Elimination'|trans }}</button>
+        </form>
+        {%~ if not quiz.eliminations.empty %}
+            <button class="btn btn-secondary dropdown-toggle"
+                    data-bs-toggle="dropdown">{{ 'Load Prepared Elimination'|trans }}</button>
+            <ul class="dropdown-menu">
+                {%~ for elimination in quiz.eliminations %}
+                    <li><a class="dropdown-item"
+                           href="{{ path('tvdt_prepare_elimination_view', {elimination: elimination.id}) }}">{{ elimination.createdAt|format_datetime() }}</a>
+                    </li>
+                {%~ endfor %}
+            </ul>
+        {% endif %}
     </div>
-    <p class="mb-3">{{ 'Number of dropouts:'|trans }}  {{ quiz.dropouts }} </p>
-    <table class="table table-hover mb-3">
-        <thead>
-        <tr>
-            <th scope="col">{{ 'Candidate'|trans }}</th>
-            <th style="width: 15%" scope="col">{{ 'Correct Answers'|trans }}</th>
-            <th style="width: 20%" scope="col">{{ 'Corrections'|trans }}</th>
-            <th style="width: 20%" scope="col">{{ 'Penalty'|trans }}</th>
-            <th style="width: 10%" scope="col">{{ 'Score'|trans }}</th>
-            <th style="width: 20%" scope="col">{{ 'Time'|trans }}</th>
+</div>
+<p class="mb-3">{{ 'Number of dropouts:'|trans }}  {{ quiz.dropouts }} </p>
+<table class="table table-hover table-result mb-3">
+    <thead>
+    <tr>
+        <th scope="col">{{ 'Candidate'|trans }}</th>
+        <th class="col-result-sm" scope="col">{{ 'Correct Answers'|trans }}</th>
+        <th class="col-result-md" scope="col">{{ 'Corrections'|trans }}</th>
+        <th class="col-result-md" scope="col">{{ 'Penalty'|trans }}</th>
+        <th class="col-result-xs" scope="col">{{ 'Score'|trans }}</th>
+        <th class="col-result-md" scope="col">{{ 'Time'|trans }}</th>
+    </tr>
+    </thead>
+    <tbody>
+    {%~ for candidate in result ~%}
+        <tr class="table-{% if loop.revindex > quiz.dropouts %}success{% else %}danger{% endif %}">
+            <td>{{ candidate.name }}</td>
+            <td>{{ candidate.correct|default('0') }}</td>
+            <td>
+                <form method="post"
+                      action="{{ path('tvdt_backoffice_modify_correction', {quiz: quiz.id, candidate: candidate.id}) }}">
+                    <input type="hidden" name="_token" value="{{ csrf_token('candidate_correction') }}">
+                    <div class="d-flex gap-1">
+                        <input class="form-control form-control-sm" type="number"
+                               value="{{ candidate.corrections }}" step="0.5"
+                               name="corrections">
+                        <button class="btn btn-sm btn-primary" type="submit">{{ 'Save'|trans }}</button>
+                    </div>
+                </form>
+            </td>
+            <td>
+                <form method="post"
+                      action="{{ path('tvdt_backoffice_modify_penalty', {quiz: quiz.id, candidate: candidate.id}) }}">
+                    <input type="hidden" name="_token" value="{{ csrf_token('candidate_penalty') }}">
+                    <div class="d-flex gap-1">
+                        <input class="form-control form-control-sm" type="number"
+                               value="{{ candidate.penaltySeconds }}" step="1"
+                               name="penalty">
+                        <button class="btn btn-sm btn-primary" type="submit">{{ 'Save'|trans }}</button>
+                    </div>
+                </form>
+            </td>
+            <td>{{ candidate.score|default('x') }}</td>
+            <td>{{ candidate.time.format('%i:%S') }}</td>
         </tr>
-        </thead>
-        <tbody>
-        {%~ for candidate in result ~%}
-            <tr class="table-{% if loop.revindex > quiz.dropouts %}success{% else %}danger{% endif %}">
-                <td>{{ candidate.name }}</td>
-                <td>{{ candidate.correct|default('0') }}</td>
-                <td>
-                    <form method="post"
-                          action="{{ path('tvdt_backoffice_modify_correction', {quiz: quiz.id, candidate: candidate.id}) }}">
-                        <div class="row">
-                            <div class="col-8">
-                                <input class="form-control form-control-sm" type="number"
-                                       value="{{ candidate.corrections }}" step="0.5"
-                                       name="corrections">
-                            </div>
-                            <div class="col-2">
-                                <button class="btn btn-sm btn-primary" type="submit">{{ 'Save'|trans }}</button>
-                            </div>
-                        </div>
-                    </form>
-                </td>
-                <td>
-                    <form method="post"
-                          action="{{ path('tvdt_backoffice_modify_penalty', {quiz: quiz.id, candidate: candidate.id}) }}">
-                        <input type="hidden" name="_token" value="{{ csrf_token('candidate_answer') }}">
-                        <div class="row">
-                            <div class="col-8">
-                                <input class="form-control form-control-sm" type="number"
-                                       value="{{ candidate.penaltySeconds }}" step="1"
-                                       name="penalty">
-                            </div>
-                            <div class="col-2">
-                                <button class="btn btn-sm btn-primary" type="submit">{{ 'Save'|trans }}</button>
-                            </div>
-                        </div>
-                    </form>
-                </td>
-                <td>{{ candidate.score|default('x') }}</td>
-                <td>{{ candidate.time.format('%i:%S') }}</td>
-            </tr>
-        {% else %}
-            <tr>
-                <td colspan="5">{{ 'No results'|trans }}</td>
-            </tr>
-        {% endfor %}
-        </tbody>
-    </table>
+    {% else %}
+        <tr>
+            <td colspan="6">{{ 'No results'|trans }}</td>
+        </tr>
+    {% endfor %}
+    </tbody>
+</table>

templates/backoffice/quiz_add.html.twig

@@ -13,7 +13,7 @@
 {% block body %}
     <div class="row">
         <div class="col-md-6 col-12">
-            <h2 class="mb-3">{{ t('Add a quiz to %name%', {'%name%': season.name})|trans }} </h2>
+            <h2 class="mb-3">{{ t('Add a quiz to {name}', {name: season.name})|trans }} </h2>
             {{ form_start(form) }}
             {{ form_row(form.name) }}
             {{ form_row(form.sheet) }}

templates/backoffice/quiz_add_blank.html.twig

@@ -0,0 +1,28 @@
+{% extends 'backoffice/base.html.twig' %}
+
+{% block breadcrumbs %}
+    <nav aria-label="breadcrumb" class="mb-3">
+        <ol class="breadcrumb">
+            <li class="breadcrumb-item"><a href="{{ path('tvdt_backoffice_index') }}">{{ 'Home'|trans }}</a></li>
+            <li class="breadcrumb-item"><a href="{{ path('tvdt_backoffice_season', {seasonCode: season.seasonCode}) }}">{{ season.name }}</a></li>
+            <li class="breadcrumb-item active" aria-current="page">{{ 'Add blank quiz'|trans }}</li>
+        </ol>
+    </nav>
+{% endblock %}
+
+{% block body %}
+    <div class="row">
+        <div class="col-md-6 col-12">
+            <h2 class="mb-3">{{ t('Add a quiz to {name}', {name: season.name})|trans }}</h2>
+            {{ form_start(form) }}
+            {{ form_row(form.name) }}
+            {{ form_widget(form.save, {attr: {class: 'btn btn-primary'}}) }}
+            {{ form_end(form) }}
+        </div>
+        <div class="col-md-6 col-12">
+            <p class="mb-3">{{ 'Create an empty quiz and add questions from the question bank.'|trans }}</p>
+        </div>
+    </div>
+{% endblock %}
+
+{% block title %}{{ parent() }}Backoffice{% endblock %}

templates/backoffice/season.html.twig

@@ -11,40 +11,24 @@
 {% endblock %}
 
 {% block body %}
-    <h2 class="mb-3">{{ 'Season'|trans }}: {{ season.name }}</h2>
-    <div class="row">
-        <div class="col-md-6 col-12">
-            <div class="d-flex flex-row align-items-center mb-3">
-                <h4 class="mb-0 pe-2">{{ 'Quizzes'|trans }}</h4>
-                <a class="link"
-                   href="{{ path('tvdt_backoffice_quiz_add', {seasonCode: season.seasonCode}) }}">{{ 'Add'|trans }}</a>
-            </div>
-            <div class="list-group mb-3">
-                {% for quiz in season.quizzes %}
-                    <a class="list-group-item list-group-item-action{% if season.activeQuiz == quiz %} active{% endif %}"
-                       href="{{ path('tvdt_backoffice_quiz', {seasonCode: season.seasonCode, quiz: quiz.id}) }}">{{ quiz.name }}</a>
-                {% else %}
-                    {{ 'No quizzes'|trans }}
-                {% endfor %}
-            </div>
-        </div>
-        <div class="col-md-3 col-12">
-            <div class="d-flex flex-row align-items-center mb-3">
-                <h4 class="mb-0 pe-2">{{ 'Candidates'|trans }}</h4>
-                <a class="link"
-                   href="{{ path('tvdt_backoffice_add_candidates', {seasonCode: season.seasonCode}) }}">{{ 'Add Candidate'|trans }}
-                </a>
-            </div>
-            <ul class="mb-3">
-                {% for candidate in season.candidates %}
-                    <li>{{ candidate.name }}</li>{% endfor %}
-            </ul>
+    {% set tabs = [
+        {id: 'tests', label: 'Quizzes'|trans, route: 'tvdt_backoffice_season'},
+        {id: 'question-bank', label: 'Question bank'|trans, route: 'tvdt_backoffice_question_bank'},
+        {id: 'candidates', label: 'Candidates'|trans, route: 'tvdt_backoffice_season_candidates'},
+        {id: 'settings', label: 'Settings'|trans, route: 'tvdt_backoffice_season_settings'},
+    ] %}
 
-            <div class="d-flex flex-row align-items-center mb-3">
-                <h4 class="mb-0 pe-2">{{ 'Settings'|trans }}</h4>
-            </div>
-            {{ form(form) }}
-        </div>
-        <div class="col-12 col-md-3"></div>
+    <h2 class="mb-3">{{ 'Season'|trans }}: {{ season.name }}</h2>
+    <ul class="nav nav-tabs mb-3">
+        {% for tab in tabs %}
+            <li class="nav-item">
+                <a class="nav-link{{ activeTab == tab.id ? ' active' }}" href="{{ path(tab.route, {seasonCode: season.seasonCode}) }}">
+                    {{ tab.label }}
+                </a>
+            </li>
+        {% endfor %}
+    </ul>
+    <div class="pt-3">
+        {{ include(template) }}
     </div>
 {% endblock body %}

templates/backoffice/season/tab_candidates.html.twig

@@ -0,0 +1,15 @@
+<div class="row">
+    <div class="col-md-6 col-12">
+        <div class="mb-3">
+            <a class="btn btn-sm btn-outline-primary"
+               href="{{ path('tvdt_backoffice_add_candidates', {seasonCode: season.seasonCode}) }}">{{ 'Add Candidate'|trans }}</a>
+        </div>
+        <ul class="mb-3">
+            {% for candidate in season.candidates %}
+                <li>{{ candidate.name }}</li>
+            {% else %}
+                {{ 'No candidates'|trans }}
+            {% endfor %}
+        </ul>
+    </div>
+</div>

templates/backoffice/season/tab_question_bank.html.twig

@@ -0,0 +1,124 @@
+<div class="mb-3">
+    <a class="btn btn-sm btn-outline-primary" href="{{ path('tvdt_backoffice_question_bank_new', {seasonCode: season.seasonCode}) }}">{{ 'Add question'|trans }}</a>
+</div>
+
+    <div class="d-flex align-items-center flex-wrap gap-2 mb-3">
+        <a class="badge rounded-pill text-decoration-none{% if activeLabel is null %} text-bg-primary{% else %} text-bg-secondary{% endif %}"
+           href="{{ path('tvdt_backoffice_question_bank', {seasonCode: season.seasonCode}) }}">{{ 'All'|trans }}</a>
+        {% for label in season.questionLabels %}
+            <span class="d-inline-flex align-items-center gap-1">
+                <a class="badge rounded-pill text-decoration-none{% if activeLabel is same as (label) %} text-bg-primary{% else %} text-bg-secondary{% endif %}"
+                   href="{{ path('tvdt_backoffice_question_bank', {seasonCode: season.seasonCode, label: label.id}) }}">{{ label.name }}</a>
+                <form action="{{ path('tvdt_backoffice_question_bank_label_delete', {seasonCode: season.seasonCode, label: label.id}) }}"
+                      method="POST" class="d-inline">
+                    <input type="hidden" name="_token" value="{{ csrf_token('delete_question_label') }}">
+                    <button type="submit" class="btn btn-sm btn-link p-0 text-danger" aria-label="{{ 'Remove label'|trans }}">&times;</button>
+                </form>
+            </span>
+        {% endfor %}
+        <form action="{{ path('tvdt_backoffice_question_bank_labels', {seasonCode: season.seasonCode}) }}"
+              method="POST" class="d-inline-flex align-items-center gap-1">
+            <input type="hidden" name="_token" value="{{ csrf_token('add_question_label') }}">
+            <input type="text" class="form-control form-control-sm" name="name" maxlength="64"
+                   placeholder="{{ 'New label'|trans }}" required>
+            <button type="submit" class="btn btn-sm btn-outline-primary">{{ 'Add label'|trans }}</button>
+        </form>
+    </div>
+
+        <table class="table align-middle">
+        <thead>
+        <tr>
+            <th>{{ 'Question'|trans }}</th>
+            <th>{{ 'Labels'|trans }}</th>
+            <th>{{ 'Reusable'|trans }}</th>
+            <th>{{ 'Used in'|trans }}</th>
+            <th></th>
+        </tr>
+        </thead>
+        <tbody>
+        {% for bankQuestion in bankQuestions %}
+            <tr>
+                <td>{{ bankQuestion.question }}</td>
+                <td>
+                    {% for label in bankQuestion.labels %}
+                        <span class="badge rounded-pill text-bg-secondary">{{ label.name }}</span>
+                    {% endfor %}
+                </td>
+                <td>
+                    {% if bankQuestion.reusable %}
+                        <span class="badge text-bg-info">{{ 'Reusable'|trans }}</span>
+                    {% endif %}
+                </td>
+                <td>
+                    {% for usage in bankQuestion.usages %}
+                        <div class="d-flex align-items-center gap-1">
+                            <span>{{ usage.quiz.name }}</span>
+                            <form action="{{ path('tvdt_backoffice_question_bank_unassign', {seasonCode: season.seasonCode, bankQuestion: bankQuestion.id, usage: usage.id}) }}"
+                                  method="POST" class="d-inline">
+                                <input type="hidden" name="_token" value="{{ csrf_token('unassign_bank_question') }}">
+                                <button type="submit" class="btn btn-sm btn-link p-0 text-danger" title="{{ 'Unassign'|trans }}">&times;</button>
+                            </form>
+                            {% if usage.quiz.isFinalized %}
+                                <form action="{{ path('tvdt_backoffice_question_bank_sync', {seasonCode: season.seasonCode, bankQuestion: bankQuestion.id, usage: usage.id}) }}"
+                                      method="POST" class="d-inline">
+                                    <input type="hidden" name="_token" value="{{ csrf_token('sync_bank_question') }}">
+                                    <button type="submit" class="btn btn-sm btn-link p-0 text-primary" title="{{ 'Sync latest changes to this quiz'|trans }}">&#8635;</button>
+                                </form>
+                            {% endif %}
+                        </div>
+                    {% endfor %}
+                </td>
+                <td class="text-end">
+                    <div class="d-inline-flex align-items-center gap-2">
+                        {% if bankQuestion.canBeAssigned and assignableQuizzes|length > 0 %}
+                            <form action="{{ path('tvdt_backoffice_question_bank_assign', {seasonCode: season.seasonCode, bankQuestion: bankQuestion.id}) }}"
+                                  method="POST" class="d-inline-flex align-items-center gap-1">
+                                <input type="hidden" name="_token" value="{{ csrf_token('assign_bank_question') }}">
+                                <select class="form-select form-select-sm" name="quiz" required>
+                                    {% for quiz in assignableQuizzes %}
+                                        <option value="{{ quiz.id }}">{{ quiz.name }}</option>
+                                    {% endfor %}
+                                </select>
+                                <button type="submit" class="btn btn-sm btn-outline-primary">{{ 'Assign'|trans }}</button>
+                            </form>
+                        {% endif %}
+                        <a class="btn btn-sm btn-outline-secondary"
+                           href="{{ path('tvdt_backoffice_question_bank_edit', {seasonCode: season.seasonCode, bankQuestion: bankQuestion.id}) }}">{{ 'Edit'|trans }}</a>
+                        <button type="button" class="btn btn-sm btn-outline-danger" data-bs-toggle="modal"
+                                data-bs-target="#deleteBankQuestion-{{ bankQuestion.id }}">{{ 'Delete'|trans }}</button>
+                    </div>
+
+                    <div class="modal fade" id="deleteBankQuestion-{{ bankQuestion.id }}" data-bs-backdrop="static"
+                         tabindex="-1" aria-labelledby="deleteBankQuestion-{{ bankQuestion.id }}Label" aria-hidden="true">
+                        <div class="modal-dialog">
+                            <div class="modal-content">
+                                <div class="modal-header">
+                                    <h1 class="modal-title fs-5" id="deleteBankQuestion-{{ bankQuestion.id }}Label">{{ 'Please Confirm'|trans }}</h1>
+                                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                                </div>
+                                <div class="modal-body text-start">
+                                    {{ 'Are you sure you want to delete this question from the question bank?'|trans }}
+                                    {% if bankQuestion.isUsed %}
+                                        <br><strong>{{ 'This question has been used in a quiz. The copy in the quiz will not be affected.'|trans }}</strong>
+                                    {% endif %}
+                                </div>
+                                <div class="modal-footer">
+                                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">{{ 'No'|trans }}</button>
+                                    <form action="{{ path('tvdt_backoffice_question_bank_delete', {seasonCode: season.seasonCode, bankQuestion: bankQuestion.id}) }}"
+                                          method="POST">
+                                        <input type="hidden" name="_token" value="{{ csrf_token('delete_bank_question') }}">
+                                        <button type="submit" class="btn btn-danger">{{ 'Yes'|trans }}</button>
+                                    </form>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </td>
+            </tr>
+        {% else %}
+            <tr>
+                <td colspan="5">{{ 'No questions in the question bank yet'|trans }}</td>
+            </tr>
+        {% endfor %}
+        </tbody>
+    </table>

templates/backoffice/season/tab_settings.html.twig

@@ -0,0 +1,5 @@
+<div class="row">
+    <div class="col-md-6 col-12">
+        {{ form(form) }}
+    </div>
+</div>

templates/backoffice/season/tab_tests.html.twig

@@ -0,0 +1,23 @@
+<div class="row">
+    <div class="col-md-6 col-12">
+        <div class="d-flex align-items-center gap-2 mb-3">
+            <a class="btn btn-sm btn-outline-primary"
+               href="{{ path('tvdt_backoffice_quiz_add', {seasonCode: season.seasonCode}) }}">{{ 'Add from XLSX'|trans }}</a>
+            <a class="btn btn-sm btn-outline-secondary"
+               href="{{ path('tvdt_backoffice_quiz_add_blank', {seasonCode: season.seasonCode}) }}">{{ 'Add blank'|trans }}</a>
+        </div>
+        <div class="list-group mb-3">
+            {% for quiz in season.quizzes %}
+                <a class="list-group-item list-group-item-action{% if season.activeQuiz == quiz %} active{% endif %}"
+                   href="{{ path('tvdt_backoffice_quiz', {seasonCode: season.seasonCode, quiz: quiz.id}) }}">
+                    {{ quiz.name }}
+                    {% if quiz.isFinalized %}
+                        <span class="badge text-bg-success">{{ 'Finalized'|trans }}</span>
+                    {% endif %}
+                </a>
+            {% else %}
+                {{ 'No quizzes'|trans }}
+            {% endfor %}
+        </div>
+    </div>
+</div>

templates/flashes.html.twig

@@ -4,7 +4,7 @@
         {% for label, messages in flashes %}
             {% for message in messages %}
                 <div class="alert alert-{{ label }} alert-dismissible " role="alert">
-                    {{ message }}
+                    {{ message|trans }}
                     <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
                 </div>
             {% endfor %}

templates/quiz/base.html.twig

@@ -1,2 +1,3 @@
 {% extends 'base.html.twig' %}
 {% block importmap %}{{ importmap('quiz') }}{% endblock %}
+{% block nav %}{{ include('quiz/nav.html.twig') }}{% endblock %}

templates/quiz/enter_name.twig

@@ -1,4 +1,6 @@
 {% extends 'quiz/base.html.twig' %}
 {% block body %}
-    {{ form(form) }}
+    <div class="quiz-form-narrow">
+        {{ form(form) }}
+    </div>
 {% endblock body %}

templates/quiz/nav.html.twig

@@ -0,0 +1,16 @@
+{% if is_granted('IS_AUTHENTICATED') or app.current_route() == 'tvdt_quiz_select_season' %}
+    <div class="quiz-topbar">
+        {% if is_granted('IS_AUTHENTICATED') %}
+            <a href="{{ path('tvdt_backoffice_index') }}" class="btn btn-outline-secondary btn-sm">
+                {{ 'Backoffice'|trans }}
+            </a>
+            <a href="{{ path('tvdt_login_logout') }}" class="btn btn-outline-secondary btn-sm">
+                {{ 'Logout'|trans }}
+            </a>
+        {% else %}
+            <a href="{{ path('tvdt_backoffice_index') }}" class="btn btn-outline-secondary btn-sm">
+                {{ 'Manage Quiz'|trans }}
+            </a>
+        {% endif %}
+    </div>
+{% endif %}

templates/quiz/question.twig

@@ -1,36 +1,43 @@
 {% extends 'quiz/base.html.twig' %}
 {% block body %}
-    <h4>
-        {% if season.settings.showNumbers %}
-            ({{ question.ordering }}/{{ question.quiz.questions.count }})
-        {% endif %}{{ question.question }}<br/>
-    </h4>
-    <form method="post">
-        <input type="hidden" name="token" value="{{ csrf_token('question') }}">
-        {% if season.settings.confirmAnswers == false %}
-            {% for answer in question.answers %}
+    <div class="quiz-content">
+        <h4>
+            {% if season.settings.showNumbers %}
+                ({{ question.ordering }}/{{ question.quiz.questions.count }})
+            {% endif %}{{ question.question }}<br/>
+        </h4>
+        <form method="post">
+            <input type="hidden" name="token" value="{{ csrf_token('question') }}">
+            {% set twoCol = question.answers|length >= 6 %}
+            {% if season.settings.confirmAnswers == false %}
+                <div class="{{ twoCol ? 'quiz-answers-grid' : '' }}">
+                    {% for answer in question.answers %}
+                        <div class="py-2">
+                            <button class="answer-btn"
+                                    type="submit"
+                                    name="answer"
+                                    value="{{ answer.id }}">{{ answer.text }}</button>
+                        </div>
+                    {% endfor %}
+                </div>
+            {% else %}
+                <div class="{{ twoCol ? 'quiz-answers-grid' : '' }}">
+                    {% for answer in question.answers %}
+                        <div class="py-1">
+                            <input required="required" type="radio" class="btn-check" name="answer"
+                                   id="answer-{{ loop.index0 }}" autocomplete="off"
+                                   value="{{ answer.id }}">
+                            <label class="answer-btn" for="answer-{{ loop.index0 }}">{{ answer.text }}</label>
+                        </div>
+                    {% endfor %}
+                </div>
                 <div class="py-2">
-                    <button class="btn btn-outline-success"
+                    <button class="btn btn-success"
                             type="submit"
-                            name="answer"
-                            value="{{ answer.id }}">{{ answer.text }}</button>
+                    >{{ 'Next'|trans }}</button>
                 </div>
-            {% endfor %}
-        {% else %}
-            {% for answer in question.answers %}
-                <div class="py-1">
-                    <input required="required" type="radio" class="btn-check" name="answer"
-                           id="answer-{{ loop.index0 }}" autocomplete="off"
-                           value="{{ answer.id }}">
-                    <label class="btn btn-outline-secondary" for="answer-{{ loop.index0 }}">{{ answer.text }}</label>
-                </div>
-            {% endfor %}
-            <div class="py-2">
-                <button class="btn btn-success"
-                        type="submit"
-                >{{ 'Next'|trans }}</button>
-            </div>
 
-        {% endif %}
-    </form>
+            {% endif %}
+        </form>
+    </div>
 {% endblock body %}

templates/quiz/select_season.html.twig

@@ -1,5 +1,6 @@
 {% extends 'quiz/base.html.twig' %}
 {% block body %}
-    {{ form(form) }}
-    <a href="{{ path('tvdt_backoffice_index') }}" class="btn btn-outline-secondary">{{ 'Manage Quiz'|trans }}</a>
+    <div class="quiz-form-narrow">
+        {{ form(form) }}
+    </div>
 {% endblock body %}

tests/Controller/Backoffice/QuestionBankControllerTest.php

@@ -0,0 +1,326 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Controller\Backoffice;
+
+use Doctrine\ORM\EntityManagerInterface;
+use PHPUnit\Framework\Attributes\CoversClass;
+use Symfony\Bundle\FrameworkBundle\KernelBrowser;
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Tvdt\Controller\Backoffice\QuestionBankController;
+use Tvdt\Entity\BankQuestion;
+use Tvdt\Entity\Question;
+use Tvdt\Entity\QuestionLabel;
+use Tvdt\Entity\Quiz;
+use Tvdt\Entity\User;
+
+#[CoversClass(QuestionBankController::class)]
+final class QuestionBankControllerTest extends WebTestCase
+{
+    private KernelBrowser $client;
+
+    private EntityManagerInterface $entityManager;
+
+    protected function setUp(): void
+    {
+        $this->client = self::createClient();
+        $this->entityManager = self::getContainer()->get(EntityManagerInterface::class);
+    }
+
+    private function loginAsOwner(): void
+    {
+        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'krtek-admin@example.org']);
+        $this->assertInstanceOf(User::class, $user);
+        $this->client->loginUser($user);
+    }
+
+    private function getBankQuestion(string $question): BankQuestion
+    {
+        $bankQuestion = $this->entityManager->getRepository(BankQuestion::class)->findOneBy(['question' => $question]);
+        $this->assertInstanceOf(BankQuestion::class, $bankQuestion);
+
+        return $bankQuestion;
+    }
+
+    private function getQuizByName(string $name): Quiz
+    {
+        $quiz = $this->entityManager->getRepository(Quiz::class)->findOneBy(['name' => $name]);
+        $this->assertInstanceOf(Quiz::class, $quiz);
+
+        return $quiz;
+    }
+
+    private function getCsrfToken(string $formActionContains): string
+    {
+        $crawler = $this->client->getCrawler();
+        $input = $crawler->filter(\sprintf('form[action*="%s"] input[name="_token"]', $formActionContains));
+        $this->assertGreaterThan(0, $input->count(), \sprintf('No form found with action containing "%s"', $formActionContains));
+
+        return (string) $input->first()->attr('value');
+    }
+
+    public function testIndexListsBankQuestions(): void
+    {
+        $this->loginAsOwner();
+        $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
+
+        $this->assertResponseIsSuccessful();
+        $this->assertSelectorTextContains('body', 'Wie is de Krtek?');
+        $this->assertSelectorTextContains('body', 'Waar sliep de Krtek?');
+        $this->assertSelectorTextContains('body', 'Wat at de Krtek als ontbijt?');
+    }
+
+    public function testIndexFiltersByLabel(): void
+    {
+        $this->loginAsOwner();
+        $label = $this->entityManager->getRepository(QuestionLabel::class)->findOneBy(['name' => 'Locatie']);
+        $this->assertInstanceOf(QuestionLabel::class, $label);
+
+        $crawler = $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank?label='.$label->id);
+
+        $this->assertResponseIsSuccessful();
+        $body = $crawler->filter('tbody')->text();
+        $this->assertStringContainsString('Waar sliep de Krtek?', $body);
+        $this->assertStringNotContainsString('Wie is de Krtek?', $body);
+    }
+
+    public function testNonOwnerIsDenied(): void
+    {
+        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'test@example.org']);
+        $this->assertInstanceOf(User::class, $user);
+        $this->client->loginUser($user);
+
+        $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testCreateBankQuestion(): void
+    {
+        $this->loginAsOwner();
+        $crawler = $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank/new');
+        $this->assertResponseIsSuccessful();
+
+        $token = (string) $crawler->filter('input[name="bank_question_form[_token]"]')->attr('value');
+
+        $this->client->request(Request::METHOD_POST, '/backoffice/season/krtek/question-bank/new', [
+            'bank_question_form' => [
+                'question' => 'Wat is de lievelingskleur van de Krtek?',
+                'reusable' => '1',
+                'answers' => [
+                    ['text' => 'Rood', 'isRightAnswer' => '1'],
+                    ['text' => 'Blauw'],
+                ],
+                '_token' => $token,
+            ],
+        ]);
+
+        $this->assertResponseRedirects('/backoffice/season/krtek/question-bank');
+
+        $this->entityManager->clear();
+        $bankQuestion = $this->getBankQuestion('Wat is de lievelingskleur van de Krtek?');
+        $this->assertTrue($bankQuestion->reusable);
+        $this->assertCount(2, $bankQuestion->answers);
+        $this->assertSame('Rood', (string) $bankQuestion->answers->first());
+    }
+
+    public function testCreateRefusedWithoutCorrectAnswer(): void
+    {
+        $this->loginAsOwner();
+        $crawler = $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank/new');
+        $token = (string) $crawler->filter('input[name="bank_question_form[_token]"]')->attr('value');
+
+        $this->client->request(Request::METHOD_POST, '/backoffice/season/krtek/question-bank/new', [
+            'bank_question_form' => [
+                'question' => 'Vraag zonder goed antwoord',
+                'answers' => [
+                    ['text' => 'Een'],
+                    ['text' => 'Twee'],
+                ],
+                '_token' => $token,
+            ],
+        ]);
+
+        $this->assertResponseIsUnprocessable();
+        $this->assertNotInstanceOf(BankQuestion::class, $this->entityManager->getRepository(BankQuestion::class)->findOneBy(['question' => 'Vraag zonder goed antwoord']));
+    }
+
+    public function testEditBankQuestion(): void
+    {
+        $this->loginAsOwner();
+        $bankQuestion = $this->getBankQuestion('Wat at de Krtek als ontbijt?');
+
+        $url = \sprintf('/backoffice/season/krtek/question-bank/%s/edit', $bankQuestion->id);
+        $crawler = $this->client->request(Request::METHOD_GET, $url);
+        $this->assertResponseIsSuccessful();
+        $token = (string) $crawler->filter('input[name="bank_question_form[_token]"]')->attr('value');
+
+        $this->client->request(Request::METHOD_POST, $url, [
+            'bank_question_form' => [
+                'question' => 'Wat dronk de Krtek als ontbijt?',
+                'answers' => [
+                    ['text' => 'Koffie', 'isRightAnswer' => '1'],
+                    ['text' => 'Thee'],
+                ],
+                '_token' => $token,
+            ],
+        ]);
+
+        $this->assertResponseRedirects('/backoffice/season/krtek/question-bank');
+
+        $this->entityManager->clear();
+        $bankQuestion = $this->getBankQuestion('Wat dronk de Krtek als ontbijt?');
+        $this->assertFalse($bankQuestion->reusable);
+        $this->assertCount(2, $bankQuestion->answers);
+    }
+
+    public function testDeleteUsedBankQuestionLeavesQuizIntact(): void
+    {
+        $this->loginAsOwner();
+        $bankQuestion = $this->getBankQuestion('Waar sliep de Krtek?');
+        $quiz2QuestionCount = $this->getQuizByName('Quiz 2')->questions->count();
+
+        $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
+        $token = $this->getCsrfToken(\sprintf('%s/delete', $bankQuestion->id));
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/question-bank/%s/delete', $bankQuestion->id), [
+            '_token' => $token,
+        ]);
+
+        $this->assertResponseRedirects('/backoffice/season/krtek/question-bank');
+
+        $this->entityManager->clear();
+        $this->assertNotInstanceOf(BankQuestion::class, $this->entityManager->getRepository(BankQuestion::class)->findOneBy(['question' => 'Waar sliep de Krtek?']));
+        $this->assertCount($quiz2QuestionCount, $this->getQuizByName('Quiz 2')->questions);
+    }
+
+    public function testAssignCopiesQuestionIntoQuiz(): void
+    {
+        $this->loginAsOwner();
+        $bankQuestion = $this->getBankQuestion('Wat at de Krtek als ontbijt?');
+        $quiz = $this->getQuizByName('Quiz 2');
+        $questionCount = $quiz->questions->count();
+
+        $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
+        $token = $this->getCsrfToken(\sprintf('%s/assign', $bankQuestion->id));
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/question-bank/%s/assign', $bankQuestion->id), [
+            '_token' => $token,
+            'quiz' => (string) $quiz->id,
+        ]);
+
+        $this->assertResponseRedirects('/backoffice/season/krtek/question-bank');
+
+        $this->entityManager->clear();
+        $quiz = $this->getQuizByName('Quiz 2');
+        $this->assertCount($questionCount + 1, $quiz->questions);
+
+        $copiedQuestion = null;
+        $maxOrdering = 0;
+        foreach ($quiz->questions as $question) {
+            $maxOrdering = max($maxOrdering, $question->ordering);
+            if ('Wat at de Krtek als ontbijt?' === $question->question) {
+                $copiedQuestion = $question;
+            }
+        }
+
+        $this->assertInstanceOf(Question::class, $copiedQuestion);
+        $this->assertSame($maxOrdering, $copiedQuestion->ordering);
+        $this->assertCount(3, $copiedQuestion->answers);
+
+        $bankQuestion = $this->getBankQuestion('Wat at de Krtek als ontbijt?');
+        $this->assertTrue($bankQuestion->isUsed());
+        $this->assertFalse($bankQuestion->canBeAssigned());
+    }
+
+    public function testAssignUsedNonReusableQuestionIsRefused(): void
+    {
+        $this->loginAsOwner();
+        $bankQuestion = $this->getBankQuestion('Waar sliep de Krtek?');
+        $quiz = $this->getQuizByName('Quiz 2');
+        $questionCount = $quiz->questions->count();
+
+        $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
+
+        // The assign form is not rendered for used questions, so post with another form's token
+        $token = $this->getCsrfToken('/assign');
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/question-bank/%s/assign', $bankQuestion->id), [
+            '_token' => $token,
+            'quiz' => (string) $quiz->id,
+        ]);
+
+        $this->assertResponseRedirects('/backoffice/season/krtek/question-bank');
+
+        $this->entityManager->clear();
+        $this->assertCount($questionCount, $this->getQuizByName('Quiz 2')->questions);
+    }
+
+    public function testAssignSameReusableQuestionTwiceToSameQuizIsRefused(): void
+    {
+        $this->loginAsOwner();
+        $bankQuestion = $this->getBankQuestion('Wie is de Krtek?');
+        $quiz = $this->getQuizByName('Quiz 2');
+        $questionCount = $quiz->questions->count();
+
+        $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
+        $token = $this->getCsrfToken(\sprintf('%s/assign', $bankQuestion->id));
+
+        $url = \sprintf('/backoffice/season/krtek/question-bank/%s/assign', $bankQuestion->id);
+        $this->client->request(Request::METHOD_POST, $url, ['_token' => $token, 'quiz' => (string) $quiz->id]);
+        $this->assertResponseRedirects('/backoffice/season/krtek/question-bank');
+
+        $this->client->request(Request::METHOD_POST, $url, ['_token' => $token, 'quiz' => (string) $quiz->id]);
+        $this->assertResponseRedirects('/backoffice/season/krtek/question-bank');
+
+        $this->entityManager->clear();
+        $this->assertCount($questionCount + 1, $this->getQuizByName('Quiz 2')->questions);
+    }
+
+    public function testAssignIntoFinalizedQuizIsDenied(): void
+    {
+        $this->loginAsOwner();
+        $bankQuestion = $this->getBankQuestion('Wie is de Krtek?');
+        $finalizedQuiz = $this->getQuizByName('Quiz 1');
+        $this->assertTrue($finalizedQuiz->isFinalized());
+
+        $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
+        $token = $this->getCsrfToken(\sprintf('%s/assign', $bankQuestion->id));
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/question-bank/%s/assign', $bankQuestion->id), [
+            '_token' => $token,
+            'quiz' => (string) $finalizedQuiz->id,
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testAddAndDeleteLabel(): void
+    {
+        $this->loginAsOwner();
+        $crawler = $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
+        $token = (string) $crawler->filter('form[action$="/question-bank/labels"] input[name="_token"]')->attr('value');
+
+        $this->client->request(Request::METHOD_POST, '/backoffice/season/krtek/question-bank/labels', [
+            '_token' => $token,
+            'name' => 'Opdracht',
+        ]);
+        $this->assertResponseRedirects('/backoffice/season/krtek/question-bank');
+
+        $this->entityManager->clear();
+        $label = $this->entityManager->getRepository(QuestionLabel::class)->findOneBy(['name' => 'Opdracht']);
+        $this->assertInstanceOf(QuestionLabel::class, $label);
+
+        $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
+        $deleteToken = $this->getCsrfToken(\sprintf('labels/%s/delete', $label->id));
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/question-bank/labels/%s/delete', $label->id), [
+            '_token' => $deleteToken,
+        ]);
+        $this->assertResponseRedirects('/backoffice/season/krtek/question-bank');
+
+        $this->entityManager->clear();
+        $this->assertNotInstanceOf(QuestionLabel::class, $this->entityManager->getRepository(QuestionLabel::class)->findOneBy(['name' => 'Opdracht']));
+    }
+}

tests/Controller/Backoffice/QuizControllerTest.php

@@ -0,0 +1,345 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Controller\Backoffice;
+
+use Doctrine\ORM\EntityManagerInterface;
+use PHPUnit\Framework\Attributes\CoversClass;
+use Safe\DateTimeImmutable;
+use Symfony\Bundle\FrameworkBundle\KernelBrowser;
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Tvdt\Controller\Backoffice\QuizController;
+use Tvdt\Entity\Answer;
+use Tvdt\Entity\Candidate;
+use Tvdt\Entity\GivenAnswer;
+use Tvdt\Entity\Question;
+use Tvdt\Entity\Quiz;
+use Tvdt\Entity\QuizCandidate;
+use Tvdt\Entity\Season;
+use Tvdt\Entity\User;
+
+#[CoversClass(QuizController::class)]
+final class QuizControllerTest extends WebTestCase
+{
+    private KernelBrowser $client;
+
+    private EntityManagerInterface $entityManager;
+
+    protected function setUp(): void
+    {
+        $this->client = self::createClient();
+        $this->entityManager = self::getContainer()->get(EntityManagerInterface::class);
+
+        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'krtek-admin@example.org']);
+        $this->assertInstanceOf(User::class, $user);
+        $this->client->loginUser($user);
+    }
+
+    private function getQuizByName(string $name): Quiz
+    {
+        $quiz = $this->entityManager->getRepository(Quiz::class)->findOneBy(['name' => $name]);
+        $this->assertInstanceOf(Quiz::class, $quiz);
+
+        return $quiz;
+    }
+
+    private function getCandidate(string $name): Candidate
+    {
+        $candidate = $this->entityManager->getRepository(Candidate::class)->findOneBy(['name' => $name]);
+        $this->assertInstanceOf(Candidate::class, $candidate);
+
+        return $candidate;
+    }
+
+    private function getCsrfTokenFromOverview(Quiz $quiz, string $formActionContains): string
+    {
+        $crawler = $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/overview', $quiz->id));
+        self::assertResponseIsSuccessful();
+
+        $input = $crawler->filter(\sprintf('form[action*="%s"] input[name="_token"]', $formActionContains));
+        $this->assertGreaterThan(0, $input->count(), \sprintf('No form found with action containing "%s"', $formActionContains));
+
+        return (string) $input->first()->attr('value');
+    }
+
+    public function testIndexRedirectsToOverview(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s', $quiz->id));
+
+        self::assertResponseRedirects(\sprintf('/backoffice/season/krtek/quiz/%s/overview', $quiz->id));
+    }
+
+    public function testOverviewLoadsSuccessfully(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/overview', $quiz->id));
+
+        self::assertResponseIsSuccessful();
+        self::assertSelectorTextContains('body', 'Quiz 1');
+    }
+
+    public function testResultTabLoadsSuccessfully(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/result', $quiz->id));
+
+        self::assertResponseIsSuccessful();
+    }
+
+    public function testCandidatesTabLoadsSuccessfully(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/candidates-list', $quiz->id));
+
+        self::assertResponseIsSuccessful();
+    }
+
+    public function testAnswerMappingRedirectsToFirstQuestion(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/answer-mapping', $quiz->id));
+
+        self::assertResponseRedirects();
+        $this->assertStringContainsString('/candidates/', (string) $this->client->getResponse()->headers->get('Location'));
+    }
+
+    public function testCandidatesQuestionTabLoadsSuccessfully(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $question = $quiz->questions->first();
+        $this->assertInstanceOf(Question::class, $question);
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/candidates/%s', $quiz->id, $question->id));
+
+        self::assertResponseIsSuccessful();
+    }
+
+    public function testSaveCandidateAnswersPersistsSelection(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $question = $quiz->questions->first();
+        $this->assertInstanceOf(Question::class, $question);
+        $answer = $question->answers->first();
+        $this->assertInstanceOf(Answer::class, $answer);
+        $candidate = $this->getCandidate('Tom');
+
+        $url = \sprintf('/backoffice/season/krtek/quiz/%s/candidates/%s', $quiz->id, $question->id);
+        $crawler = $this->client->request(Request::METHOD_GET, $url);
+        self::assertResponseIsSuccessful();
+        $token = (string) $crawler->filter('input[name="_token"]')->first()->attr('value');
+
+        $this->client->request(Request::METHOD_POST, $url, [
+            '_token' => $token,
+            'candidate_answer' => [
+                (string) $candidate->id => [(string) $answer->id],
+            ],
+        ]);
+
+        $this->assertResponseRedirects($url);
+        $this->entityManager->clear();
+
+        $savedAnswer = $this->entityManager->getRepository(Answer::class)->find($answer->id);
+        $this->assertInstanceOf(Answer::class, $savedAnswer);
+        $this->assertTrue($savedAnswer->candidates->exists(
+            static fn (int $key, Candidate $c): bool => $c->id->equals($candidate->id),
+        ));
+    }
+
+    public function testToggleCandidateCreatesInactiveQuizCandidate(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $candidate = $this->getCandidate('Tom');
+
+        $crawler = $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/candidates-list', $quiz->id));
+        self::assertResponseIsSuccessful();
+        $token = (string) $crawler->filter(\sprintf('form[action*="/%s/toggle"] input[name="_token"]', $candidate->id))->first()->attr('value');
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/quiz/%s/candidate/%s/toggle', $quiz->id, $candidate->id), [
+            '_token' => $token,
+        ]);
+
+        self::assertResponseRedirects();
+        $this->entityManager->clear();
+
+        $quizCandidate = $this->entityManager->getRepository(QuizCandidate::class)->findOneBy([
+            'quiz' => $this->getQuizByName('Quiz 1'),
+            'candidate' => $this->getCandidate('Tom'),
+        ]);
+        $this->assertInstanceOf(QuizCandidate::class, $quizCandidate);
+        $this->assertFalse($quizCandidate->active);
+    }
+
+    public function testToggleCandidateTogglesActiveState(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $candidate = $this->getCandidate('Tom');
+
+        $quizCandidate = new QuizCandidate($quiz, $candidate);
+        $quizCandidate->active = false;
+
+        $this->entityManager->persist($quizCandidate);
+        $this->entityManager->flush();
+
+        $crawler = $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/candidates-list', $quiz->id));
+        $token = (string) $crawler->filter(\sprintf('form[action*="/%s/toggle"] input[name="_token"]', $candidate->id))->first()->attr('value');
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/quiz/%s/candidate/%s/toggle', $quiz->id, $candidate->id), [
+            '_token' => $token,
+        ]);
+
+        self::assertResponseRedirects();
+        $this->entityManager->clear();
+
+        $updated = $this->entityManager->getRepository(QuizCandidate::class)->findOneBy([
+            'quiz' => $this->getQuizByName('Quiz 1'),
+            'candidate' => $this->getCandidate('Tom'),
+        ]);
+        $this->assertInstanceOf(QuizCandidate::class, $updated);
+        $this->assertTrue($updated->active);
+    }
+
+    public function testModifyCorrection(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $candidate = $this->getCandidate('Tom');
+
+        // getScores() requires started IS NOT NULL and at least one GivenAnswer
+        $quizCandidate = new QuizCandidate($quiz, $candidate);
+        $quizCandidate->started = new DateTimeImmutable();
+
+        $this->entityManager->persist($quizCandidate);
+        $firstQuestion = $quiz->questions->first();
+        $this->assertInstanceOf(Question::class, $firstQuestion);
+        $answer = $firstQuestion->answers->first();
+        $this->assertInstanceOf(Answer::class, $answer);
+        $this->entityManager->persist(new GivenAnswer($candidate, $quiz, $answer));
+        $this->entityManager->flush();
+
+        $crawler = $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/result', $quiz->id));
+        self::assertResponseIsSuccessful();
+        $token = (string) $crawler->filter(\sprintf('form[action*="%s/modify_correction"] input[name="_token"]', $candidate->id))->first()->attr('value');
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/quiz/%s/candidate/%s/modify_correction', $quiz->id, $candidate->id), [
+            '_token' => $token,
+            'corrections' => '1.5',
+        ]);
+
+        self::assertResponseRedirects();
+        $this->entityManager->clear();
+
+        $updated = $this->entityManager->getRepository(QuizCandidate::class)->findOneBy([
+            'quiz' => $this->getQuizByName('Quiz 1'),
+            'candidate' => $this->getCandidate('Tom'),
+        ]);
+        $this->assertInstanceOf(QuizCandidate::class, $updated);
+        $this->assertEqualsWithDelta(1.5, $updated->corrections, \PHP_FLOAT_EPSILON);
+    }
+
+    public function testModifyPenalty(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $candidate = $this->getCandidate('Claudia');
+
+        $quizCandidate = new QuizCandidate($quiz, $candidate);
+        $quizCandidate->started = new DateTimeImmutable();
+
+        $this->entityManager->persist($quizCandidate);
+        $firstQuestion = $quiz->questions->first();
+        $this->assertInstanceOf(Question::class, $firstQuestion);
+        $answer = $firstQuestion->answers->first();
+        $this->assertInstanceOf(Answer::class, $answer);
+        $this->entityManager->persist(new GivenAnswer($candidate, $quiz, $answer));
+        $this->entityManager->flush();
+
+        $crawler = $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/result', $quiz->id));
+        self::assertResponseIsSuccessful();
+        $token = (string) $crawler->filter(\sprintf('form[action*="%s/modify_penalty"] input[name="_token"]', $candidate->id))->first()->attr('value');
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/quiz/%s/candidate/%s/modify_penalty', $quiz->id, $candidate->id), [
+            '_token' => $token,
+            'penalty' => '30',
+        ]);
+
+        self::assertResponseRedirects();
+        $this->entityManager->clear();
+
+        $updated = $this->entityManager->getRepository(QuizCandidate::class)->findOneBy([
+            'quiz' => $this->getQuizByName('Quiz 1'),
+            'candidate' => $this->getCandidate('Claudia'),
+        ]);
+        $this->assertInstanceOf(QuizCandidate::class, $updated);
+        $this->assertSame(30, $updated->penaltySeconds);
+    }
+
+    public function testDeleteQuiz(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 2');
+        $quizId = $quiz->id;
+        $token = $this->getCsrfTokenFromOverview($quiz, '/delete');
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/quiz/%s/delete', $quiz->id), [
+            '_token' => $token,
+        ]);
+
+        self::assertResponseRedirects('/backoffice/season/krtek');
+        $this->entityManager->clear();
+        $this->assertNotInstanceOf(Quiz::class, $this->entityManager->getRepository(Quiz::class)->find($quizId));
+    }
+
+    public function testNonOwnerIsDenied(): void
+    {
+        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'test@example.org']);
+        $this->assertInstanceOf(User::class, $user);
+        $this->client->loginUser($user);
+
+        $quiz = $this->getQuizByName('Quiz 1');
+        $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/overview', $quiz->id));
+
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    public function testOverviewLoadsForEmptyQuiz(): void
+    {
+        $season = $this->entityManager->getRepository(Season::class)->findOneBy(['seasonCode' => 'krtek']);
+        $this->assertInstanceOf(Season::class, $season);
+
+        $emptyQuiz = new Quiz();
+        $emptyQuiz->name = 'Empty Quiz';
+
+        $season->addQuiz($emptyQuiz);
+        $this->entityManager->persist($emptyQuiz);
+        $this->entityManager->flush();
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/overview', $emptyQuiz->id));
+
+        self::assertResponseIsSuccessful();
+        self::assertSelectorTextContains('body', 'Empty Quiz');
+    }
+
+    public function testAnswerMappingRedirectsWithFlashWhenNoQuestions(): void
+    {
+        $season = $this->entityManager->getRepository(Season::class)->findOneBy(['seasonCode' => 'krtek']);
+        $this->assertInstanceOf(Season::class, $season);
+
+        $emptyQuiz = new Quiz();
+        $emptyQuiz->name = 'Empty Quiz';
+
+        $season->addQuiz($emptyQuiz);
+        $this->entityManager->persist($emptyQuiz);
+        $this->entityManager->flush();
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/answer-mapping', $emptyQuiz->id));
+
+        self::assertResponseRedirects(\sprintf('/backoffice/season/krtek/quiz/%s/overview', $emptyQuiz->id));
+        $this->client->followRedirect();
+        self::assertSelectorTextContains('body', 'Deze test heeft nog geen vragen');
+    }
+}

tests/Controller/Backoffice/QuizFinalizeTest.php

@@ -0,0 +1,215 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Controller\Backoffice;
+
+use Doctrine\ORM\EntityManagerInterface;
+use PHPUnit\Framework\Attributes\CoversClass;
+use Safe\DateTimeImmutable;
+use Symfony\Bundle\FrameworkBundle\KernelBrowser;
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Tvdt\Controller\Backoffice\QuizController;
+use Tvdt\Entity\Answer;
+use Tvdt\Entity\Candidate;
+use Tvdt\Entity\Question;
+use Tvdt\Entity\Quiz;
+use Tvdt\Entity\QuizCandidate;
+use Tvdt\Entity\Season;
+use Tvdt\Entity\User;
+
+#[CoversClass(QuizController::class)]
+final class QuizFinalizeTest extends WebTestCase
+{
+    private KernelBrowser $client;
+
+    private EntityManagerInterface $entityManager;
+
+    protected function setUp(): void
+    {
+        $this->client = self::createClient();
+        $this->entityManager = self::getContainer()->get(EntityManagerInterface::class);
+
+        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'krtek-admin@example.org']);
+        $this->assertInstanceOf(User::class, $user);
+        $this->client->loginUser($user);
+    }
+
+    private function getQuizByName(string $name): Quiz
+    {
+        $quiz = $this->entityManager->getRepository(Quiz::class)->findOneBy(['name' => $name]);
+        $this->assertInstanceOf(Quiz::class, $quiz);
+
+        return $quiz;
+    }
+
+    private function getKrtekSeason(): Season
+    {
+        $season = $this->entityManager->getRepository(Season::class)->findOneBy(['seasonCode' => 'krtek']);
+        $this->assertInstanceOf(Season::class, $season);
+
+        return $season;
+    }
+
+    private function getCsrfTokenFromOverview(Quiz $quiz, string $formActionContains): string
+    {
+        $crawler = $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/overview', $quiz->id));
+        $this->assertResponseIsSuccessful();
+
+        $input = $crawler->filter(\sprintf('form[action*="%s"] input[name="_token"]', $formActionContains));
+        $this->assertGreaterThan(0, $input->count(), \sprintf('No form found with action containing "%s"', $formActionContains));
+
+        return (string) $input->first()->attr('value');
+    }
+
+    public function testFinalizeSetsFinalizedAt(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 2');
+        $this->assertFalse($quiz->isFinalized());
+
+        $token = $this->getCsrfTokenFromOverview($quiz, '/finalize');
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/quiz/%s/finalize', $quiz->id), ['_token' => $token]);
+
+        $this->assertResponseRedirects();
+
+        $this->entityManager->clear();
+        $this->assertTrue($this->getQuizByName('Quiz 2')->isFinalized());
+    }
+
+    public function testFinalizeRefusedWhenQuizHasErrors(): void
+    {
+        $season = $this->getKrtekSeason();
+
+        $invalidQuiz = new Quiz();
+        $invalidQuiz->name = 'Invalid Quiz';
+
+        $question = new Question();
+        $question->question = 'Vraag zonder goed antwoord';
+        $question->ordering = 1;
+        $question->addAnswer(new Answer('Fout'));
+        $question->addAnswer(new Answer('Ook fout'));
+
+        $invalidQuiz->addQuestion($question);
+        $season->addQuiz($invalidQuiz);
+        $this->entityManager->persist($invalidQuiz);
+        $this->entityManager->flush();
+
+        // Token intention is shared, so any quiz overview provides it
+        $token = $this->getCsrfTokenFromOverview($invalidQuiz, '/finalize');
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/quiz/%s/finalize', $invalidQuiz->id), ['_token' => $token]);
+
+        $this->assertResponseRedirects();
+
+        $this->entityManager->clear();
+        $this->assertFalse($this->getQuizByName('Invalid Quiz')->isFinalized());
+    }
+
+    public function testEnableRefusedWhenNotFinalized(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 2');
+        $this->assertFalse($quiz->isFinalized());
+
+        $token = $this->getCsrfTokenFromOverview($quiz, '/enable');
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/quiz/%s/enable', $quiz->id), ['_token' => $token]);
+
+        $this->assertResponseRedirects();
+
+        $this->entityManager->clear();
+        $season = $this->getKrtekSeason();
+        $this->assertInstanceOf(Quiz::class, $season->activeQuiz);
+        $this->assertSame('Quiz 1', $season->activeQuiz->name);
+    }
+
+    public function testEnableAllowedWhenFinalized(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 2');
+        $quiz->finalizedAt = new DateTimeImmutable();
+
+        $this->entityManager->flush();
+
+        $token = $this->getCsrfTokenFromOverview($quiz, '/enable');
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/quiz/%s/enable', $quiz->id), ['_token' => $token]);
+
+        $this->assertResponseRedirects();
+
+        $this->entityManager->clear();
+        $season = $this->getKrtekSeason();
+        $this->assertInstanceOf(Quiz::class, $season->activeQuiz);
+        $this->assertSame('Quiz 2', $season->activeQuiz->name);
+    }
+
+    public function testUnfinalize(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 2');
+        $quiz->finalizedAt = new DateTimeImmutable();
+
+        $this->entityManager->flush();
+
+        $token = $this->getCsrfTokenFromOverview($quiz, '/unfinalize');
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/quiz/%s/unfinalize', $quiz->id), ['_token' => $token]);
+
+        $this->assertResponseRedirects();
+
+        $this->entityManager->clear();
+        $this->assertFalse($this->getQuizByName('Quiz 2')->isFinalized());
+    }
+
+    public function testUnfinalizeRefusedWhenQuizIsActive(): void
+    {
+        // Quiz 1 is finalized and active in the fixtures; scrape a token from Quiz 2 (same intention)
+        $quiz2 = $this->getQuizByName('Quiz 2');
+        $quiz2->finalizedAt = new DateTimeImmutable();
+
+        $this->entityManager->flush();
+        $token = $this->getCsrfTokenFromOverview($quiz2, '/unfinalize');
+
+        $quiz1 = $this->getQuizByName('Quiz 1');
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/quiz/%s/unfinalize', $quiz1->id), ['_token' => $token]);
+
+        $this->assertResponseRedirects();
+
+        $this->entityManager->clear();
+        $this->assertTrue($this->getQuizByName('Quiz 1')->isFinalized());
+    }
+
+    public function testUnfinalizeRefusedWhenCandidatesStarted(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 2');
+        $quiz->finalizedAt = new DateTimeImmutable();
+
+        $this->entityManager->flush();
+
+        // Scrape the token before a candidate starts, since the button disappears afterwards
+        $token = $this->getCsrfTokenFromOverview($quiz, '/unfinalize');
+
+        $candidate = $this->entityManager->getRepository(Candidate::class)->findOneBy(['name' => 'Tom']);
+        $this->assertInstanceOf(Candidate::class, $candidate);
+        $quizCandidate = new QuizCandidate($quiz, $candidate);
+        $quizCandidate->started = new DateTimeImmutable();
+
+        $this->entityManager->persist($quizCandidate);
+        $this->entityManager->flush();
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/quiz/%s/unfinalize', $quiz->id), ['_token' => $token]);
+
+        $this->assertResponseRedirects();
+
+        $this->entityManager->clear();
+        $this->assertTrue($this->getQuizByName('Quiz 2')->isFinalized());
+    }
+
+    public function testClearQuizResetsFinalization(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $this->assertTrue($quiz->isFinalized());
+
+        $token = $this->getCsrfTokenFromOverview($quiz, '/clear');
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/quiz/%s/clear', $quiz->id), ['_token' => $token]);
+
+        $this->assertResponseRedirects();
+
+        $this->entityManager->clear();
+        $this->assertFalse($this->getQuizByName('Quiz 1')->isFinalized());
+    }
+}

tests/Repository/BankQuestionRepositoryTest.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Repository;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use Tvdt\Entity\QuestionLabel;
+use Tvdt\Repository\BankQuestionRepository;
+
+#[CoversClass(BankQuestionRepository::class)]
+final class BankQuestionRepositoryTest extends DatabaseTestCase
+{
+    private BankQuestionRepository $bankQuestionRepository;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->bankQuestionRepository = self::getContainer()->get(BankQuestionRepository::class);
+    }
+
+    public function testFindBySeasonReturnsAllQuestions(): void
+    {
+        $season = $this->getSeasonByCode('krtek');
+
+        $bankQuestions = $this->bankQuestionRepository->findBySeason($season);
+
+        $this->assertCount(3, $bankQuestions);
+    }
+
+    public function testFindBySeasonFiltersByLabel(): void
+    {
+        $season = $this->getSeasonByCode('krtek');
+        $label = $this->entityManager->getRepository(QuestionLabel::class)
+            ->findOneBy(['season' => $season, 'name' => 'Locatie']);
+        $this->assertInstanceOf(QuestionLabel::class, $label);
+
+        $bankQuestions = $this->bankQuestionRepository->findBySeason($season, $label);
+
+        $this->assertCount(2, $bankQuestions);
+        foreach ($bankQuestions as $bankQuestion) {
+            $this->assertTrue($bankQuestion->labels->contains($label));
+        }
+    }
+
+    public function testFindBySeasonIgnoresOtherSeasons(): void
+    {
+        $season = $this->getSeasonByCode('bbbbb');
+
+        $this->assertCount(0, $this->bankQuestionRepository->findBySeason($season));
+    }
+}

tests/Security/Voter/SeasonVoterTest.php

@@ -12,9 +12,11 @@ use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
 use Symfony\Component\Security\Core\User\UserInterface;
 use Tvdt\Entity\Answer;
+use Tvdt\Entity\BankQuestion;
 use Tvdt\Entity\Candidate;
 use Tvdt\Entity\Elimination;
 use Tvdt\Entity\Question;
+use Tvdt\Entity\QuestionLabel;
 use Tvdt\Entity\Quiz;
 use Tvdt\Entity\Season;
 use Tvdt\Entity\User;
@@ -75,6 +77,61 @@ final class SeasonVoterTest extends TestCase
         $answer = self::createStub(Answer::class);
         $answer->question = $question;
         yield 'Answer' => [$answer];
+
+        $bankQuestion = self::createStub(BankQuestion::class);
+        $bankQuestion->season = $season;
+        yield 'BankQuestion' => [$bankQuestion];
+
+        $questionLabel = self::createStub(QuestionLabel::class);
+        $questionLabel->season = $season;
+        yield 'QuestionLabel' => [$questionLabel];
+    }
+
+    public function testModifyQuizContentGrantedOnUnlockedQuiz(): void
+    {
+        $season = self::createStub(Season::class);
+        $season->method('isOwner')->willReturn(true);
+
+        $quiz = self::createStub(Quiz::class);
+        $quiz->season = $season;
+        $quiz->method('isLocked')->willReturn(false);
+
+        $this->assertSame(VoterInterface::ACCESS_GRANTED, $this->seasonVoter->vote($this->token, $quiz, [SeasonVoter::MODIFY_QUIZ_CONTENT]));
+    }
+
+    public function testModifyQuizContentDeniedOnLockedQuiz(): void
+    {
+        $season = self::createStub(Season::class);
+        $season->method('isOwner')->willReturn(true);
+
+        $quiz = self::createStub(Quiz::class);
+        $quiz->season = $season;
+        $quiz->method('isLocked')->willReturn(true);
+
+        $this->assertSame(VoterInterface::ACCESS_DENIED, $this->seasonVoter->vote($this->token, $quiz, [SeasonVoter::MODIFY_QUIZ_CONTENT]));
+    }
+
+    public function testModifyQuizContentDeniedOnLockedQuizForAdmin(): void
+    {
+        $user = new User();
+        $user->roles = ['ROLE_ADMIN'];
+
+        $token = $this->createStub(TokenInterface::class);
+        $token->method('getUser')->willReturn($user);
+
+        $quiz = self::createStub(Quiz::class);
+        $quiz->season = self::createStub(Season::class);
+        $quiz->method('isLocked')->willReturn(true);
+
+        $this->assertSame(VoterInterface::ACCESS_DENIED, $this->seasonVoter->vote($token, $quiz, [SeasonVoter::MODIFY_QUIZ_CONTENT]));
+    }
+
+    public function testModifyQuizContentDeniedOnNonQuizSubject(): void
+    {
+        $season = self::createStub(Season::class);
+        $season->method('isOwner')->willReturn(true);
+
+        $this->assertSame(VoterInterface::ACCESS_DENIED, $this->seasonVoter->vote($this->token, $season, [SeasonVoter::MODIFY_QUIZ_CONTENT]));
     }
 
     public function testWrongUserTypeReturnFalse(): void

tests/Service/QuizSpreadsheetServiceTest.php

@@ -0,0 +1,308 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Service;
+
+use PhpOffice\PhpSpreadsheet\Reader;
+use PhpOffice\PhpSpreadsheet\Spreadsheet;
+use PhpOffice\PhpSpreadsheet\Writer;
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpFoundation\File\File;
+use Tvdt\Entity\Answer;
+use Tvdt\Entity\Question;
+use Tvdt\Entity\Quiz;
+use Tvdt\Exception\SpreadsheetDataException;
+use Tvdt\Service\QuizSpreadsheetService;
+
+use function Safe\file_put_contents;
+use function Safe\ob_get_clean;
+use function Safe\ob_start;
+use function Safe\unlink;
+
+#[CoversClass(QuizSpreadsheetService::class)]
+final class QuizSpreadsheetServiceTest extends TestCase
+{
+    private QuizSpreadsheetService $subject;
+
+    /** @var list<string> */
+    private array $tempFiles = [];
+
+    protected function setUp(): void
+    {
+        $this->subject = new QuizSpreadsheetService();
+    }
+
+    protected function tearDown(): void
+    {
+        foreach ($this->tempFiles as $path) {
+            if (file_exists($path)) {
+                unlink($path);
+            }
+        }
+    }
+
+    public function testGenerateTemplateProducesValidXlsx(): void
+    {
+        $path = $this->captureXlsx($this->subject->generateTemplate());
+
+        $this->assertSame(
+            'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+            new File($path)->getMimeType(),
+        );
+    }
+
+    public function testGenerateTemplateWithoutExampleHasNoQuestions(): void
+    {
+        $path = $this->captureXlsx($this->subject->generateTemplate(fillExample: false));
+
+        $quiz = new Quiz();
+        $this->subject->xlsxToQuiz($quiz, new File($path));
+
+        $this->assertCount(0, $quiz->questions);
+    }
+
+    public function testGenerateTemplateExampleCanBeReimported(): void
+    {
+        $path = $this->captureXlsx($this->subject->generateTemplate(fillExample: true));
+
+        $quiz = new Quiz();
+        $this->subject->xlsxToQuiz($quiz, new File($path));
+
+        $this->assertCount(2, $quiz->questions);
+
+        /** @var Question $first */
+        $first = $quiz->questions->first();
+        $this->assertSame('Is de mol een man of een vrouw?', $first->question);
+        $this->assertCount(2, $first->answers);
+
+        /** @var Question $second */
+        $second = $quiz->questions->last();
+        $this->assertSame('Wie is de mol?', $second->question);
+        $this->assertCount(10, $second->answers);
+    }
+
+    public function testQuizToXlsxEmptyQuizImportsWithNoQuestions(): void
+    {
+        $path = $this->captureXlsx($this->subject->quizToXlsx(new Quiz()));
+
+        $imported = new Quiz();
+        $this->subject->xlsxToQuiz($imported, new File($path));
+
+        $this->assertCount(0, $imported->questions);
+    }
+
+    public function testQuizToXlsxRoundTrip(): void
+    {
+        $original = $this->makeQuiz();
+        $path = $this->captureXlsx($this->subject->quizToXlsx($original));
+
+        $imported = new Quiz();
+        $this->subject->xlsxToQuiz($imported, new File($path));
+
+        $this->assertCount(2, $imported->questions);
+
+        /** @var Question $first */
+        $first = $imported->questions->first();
+        $this->assertSame('Who is de Mol?', $first->question);
+        $this->assertCount(2, $first->answers);
+
+        $answers = $first->answers->toArray();
+        $this->assertSame('Alice', $answers[0]->text);
+        $this->assertFalse($answers[0]->isRightAnswer);
+        $this->assertSame('Bob', $answers[1]->text);
+        $this->assertTrue($answers[1]->isRightAnswer);
+
+        /** @var Question $second */
+        $second = $imported->questions->last();
+        $this->assertSame('What did de Mol sabotage?', $second->question);
+        $this->assertCount(3, $second->answers);
+    }
+
+    public function testXlsxToQuizThrowsOnInvalidMimeType(): void
+    {
+        $path = $this->createTempPath('.txt');
+        file_put_contents($path, 'not a spreadsheet');
+
+        $this->expectException(\InvalidArgumentException::class);
+        $this->subject->xlsxToQuiz(new Quiz(), new File($path));
+    }
+
+    public function testXlsxToQuizThrowsOnQuestionWithNoAnswers(): void
+    {
+        $quiz = new Quiz();
+        $question = new Question();
+        $question->question = 'Unanswered question';
+        $question->ordering = 1;
+
+        $quiz->addQuestion($question);
+
+        $path = $this->captureXlsx($this->subject->quizToXlsx($quiz));
+
+        try {
+            $this->subject->xlsxToQuiz(new Quiz(), new File($path));
+            $this->fail('Expected SpreadsheetDataException to be thrown');
+        } catch (SpreadsheetDataException $spreadsheetDataException) {
+            $this->assertNotEmpty($spreadsheetDataException->errors);
+        }
+    }
+
+    public function testXlsxToQuizStopsAtBlankRow(): void
+    {
+        $spreadsheet = new Spreadsheet();
+        $sheet = $spreadsheet->getActiveSheet();
+        $sheet->setCellValue('A1', 'Question');
+        $sheet->setCellValue('B1', 'Answer 1');
+        $sheet->setCellValue('C1', 'Correct');
+        $sheet->setCellValue('A2', 'First question');
+        $sheet->setCellValue('B2', 'Yes');
+        $sheet->setCellValue('C2', true);
+        // Row 3 intentionally blank — should halt parsing
+        $sheet->setCellValue('A4', 'Second question');
+        $sheet->setCellValue('B4', 'No');
+        $sheet->setCellValue('C4', false);
+
+        $path = $this->createTempPath('.xlsx');
+        ob_start();
+        new Writer\Xlsx($spreadsheet)->save('php://output');
+        file_put_contents($path, ob_get_clean());
+
+        $quiz = new Quiz();
+        $this->subject->xlsxToQuiz($quiz, new File($path));
+
+        $this->assertCount(1, $quiz->questions);
+        /** @var Question $first */
+        $first = $quiz->questions->first();
+        $this->assertSame('First question', $first->question);
+    }
+
+    /** @return \Iterator<string, array{int, string, int, string, int, int}> */
+    public static function answerCountHeaderProvider(): \Iterator
+    {
+        // Columns (0-based): Question=0, Answer1=1, Correct=2, Answer2=3, Correct=4, …
+        // Answer N is at index 1+2*(N-1) = 2N-1, Correct N at 2+2*(N-1) = 2N.
+        yield '2 answers → 2 header pairs' => [2,  'Answer 2',  3,  'Correct', 4,  5];
+        yield '6 answers → 6 header pairs' => [6,  'Answer 6',  11, 'Correct', 12, 13];
+        yield '7 answers → 7 header pairs' => [7,  'Answer 7',  13, 'Correct', 14, 15];
+        yield '10 answers → 10 header pairs' => [10, 'Answer 10', 19, 'Correct', 20, 21];
+    }
+
+    #[DataProvider('answerCountHeaderProvider')]
+    public function testQuizToXlsxHeaderCountMatchesAnswerCount(
+        int $answerCount,
+        string $lastAnswerHeader,
+        int $lastAnswerIndex,
+        string $lastCorrectHeader,
+        int $lastCorrectIndex,
+        int $absentIndex,
+    ): void {
+        $path = $this->captureXlsx($this->subject->quizToXlsx($this->makeQuizWithAnswerCounts($answerCount)));
+        $headers = $this->readFirstRow($path);
+
+        $this->assertSame($lastAnswerHeader, $headers[$lastAnswerIndex]);
+        $this->assertSame($lastCorrectHeader, $headers[$lastCorrectIndex]);
+        $this->assertArrayNotHasKey($absentIndex, $headers);
+    }
+
+    public function testQuizToXlsxHeadersMatchMaxAnswersAcrossQuestions(): void
+    {
+        $quiz = new Quiz();
+        $quiz->addQuestion($this->makeQuestion('Short', 3));
+        $quiz->addQuestion($this->makeQuestion('Long', 7));
+        $quiz->addQuestion($this->makeQuestion('Medium', 5));
+
+        $path = $this->captureXlsx($this->subject->quizToXlsx($quiz));
+        $headers = $this->readFirstRow($path);
+
+        $this->assertSame('Answer 7', $headers[13]);
+        $this->assertSame('Correct', $headers[14]);
+        $this->assertArrayNotHasKey(15, $headers);
+    }
+
+    public function testQuizToXlsxRoundTripWithSevenAnswers(): void
+    {
+        $original = $this->makeQuizWithAnswerCounts(7);
+        $path = $this->captureXlsx($this->subject->quizToXlsx($original));
+
+        $imported = new Quiz();
+        $this->subject->xlsxToQuiz($imported, new File($path));
+
+        $this->assertCount(1, $imported->questions);
+        /** @var Question $question */
+        $question = $imported->questions->first();
+        $this->assertCount(7, $question->answers);
+    }
+
+    private function makeQuiz(): Quiz
+    {
+        $quiz = new Quiz();
+
+        $q1 = new Question();
+        $q1->question = 'Who is de Mol?';
+        $q1->ordering = 1;
+        $q1->addAnswer(new Answer('Alice', isRightAnswer: false));
+        $q1->addAnswer(new Answer('Bob', isRightAnswer: true));
+
+        $q2 = new Question();
+        $q2->question = 'What did de Mol sabotage?';
+        $q2->ordering = 2;
+        $q2->addAnswer(new Answer('The boat', isRightAnswer: true));
+        $q2->addAnswer(new Answer('The car', isRightAnswer: false));
+        $q2->addAnswer(new Answer('Nothing', isRightAnswer: false));
+
+        $quiz->addQuestion($q1);
+        $quiz->addQuestion($q2);
+
+        return $quiz;
+    }
+
+    private function makeQuizWithAnswerCounts(int ...$counts): Quiz
+    {
+        $quiz = new Quiz();
+        foreach ($counts as $i => $count) {
+            $quiz->addQuestion($this->makeQuestion('Question '.$i, $count));
+        }
+
+        return $quiz;
+    }
+
+    private function makeQuestion(string $text, int $answerCount): Question
+    {
+        $question = new Question();
+        $question->question = $text;
+        $question->ordering = 1;
+        for ($i = 1; $i <= $answerCount; ++$i) {
+            $question->addAnswer(new Answer('Answer '.$i, isRightAnswer: false));
+        }
+
+        return $question;
+    }
+
+    /** @return array<int, string|null> */
+    private function readFirstRow(string $path): array
+    {
+        $rows = new Reader\Xlsx()->setReadDataOnly(true)->load($path)->getActiveSheet()->toArray(formatData: false);
+
+        return $rows[0] ?? [];
+    }
+
+    private function captureXlsx(\Closure $closure): string
+    {
+        $path = $this->createTempPath('.xlsx');
+        ob_start();
+        $closure();
+        file_put_contents($path, ob_get_clean());
+
+        return $path;
+    }
+
+    private function createTempPath(string $suffix): string
+    {
+        $path = sys_get_temp_dir().\DIRECTORY_SEPARATOR.uniqid('tvdt_test_', more_entropy: true).$suffix;
+        $this->tempFiles[] = $path;
+
+        return $path;
+    }
+}

tests/Twig/TemplateReferencesTest.php

@@ -0,0 +1,63 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Twig;
+
+use PHPUnit\Framework\Assert;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+use function Safe\file_get_contents;
+use function Safe\preg_match_all;
+
+final class TemplateReferencesTest extends TestCase
+{
+    private static string $templatesDir;
+
+    public static function setUpBeforeClass(): void
+    {
+        self::$templatesDir = \dirname(__DIR__, 2).'/templates';
+    }
+
+    /** @return iterable<string, array{string, string}> */
+    public static function templateReferenceProvider(): iterable
+    {
+        $templatesDir = \dirname(__DIR__, 2).'/templates';
+        $iterator = new \RecursiveIteratorIterator(
+            new \RecursiveDirectoryIterator($templatesDir, \RecursiveDirectoryIterator::SKIP_DOTS),
+        );
+
+        foreach ($iterator as $file) {
+            Assert::assertInstanceOf(\SplFileInfo::class, $file);
+            if ('twig' !== $file->getExtension()) {
+                continue;
+            }
+
+            $content = file_get_contents($file->getPathname());
+            $sourceFile = str_replace($templatesDir.'/', '', $file->getPathname());
+
+            // Match extends, include(), and embed tags — capture the quoted template name
+            preg_match_all(
+                '/(?:extends|include|embed)\s*\(?[\'"]([^\'"]+)[\'"]\)?/',
+                $content,
+                $matches,
+            );
+
+            foreach ($matches[1] as $referencedTemplate) {
+                yield \sprintf('%s → %s', $sourceFile, $referencedTemplate) => [$sourceFile, $referencedTemplate];
+            }
+        }
+    }
+
+    #[DataProvider('templateReferenceProvider')]
+    public function testReferencedTemplateExists(string $sourceFile, string $referencedTemplate): void
+    {
+        $absolutePath = self::$templatesDir.'/'.$referencedTemplate;
+
+        $this->assertFileExists(
+            $absolutePath,
+            \sprintf("Template '%s' references '%s' which does not exist at '%s'.", $sourceFile, $referencedTemplate, $absolutePath),
+        );
+    }
+}

translations/messages+intl-icu.nl.xliff

@@ -37,9 +37,37 @@
         <source>Add Quiz</source>
         <target>Test toevoegen</target>
       </trans-unit>
-      <trans-unit id="ehB6pAw" resname="Add a quiz to %name%">
-        <source>Add a quiz to %name%</source>
-        <target>Voeg een test toe aan %name%</target>
+      <trans-unit id="apgpM9w" resname="Add a quiz to {name}">
+        <source>Add a quiz to {name}</source>
+        <target>Voeg een test toe aan {name}</target>
+      </trans-unit>
+      <trans-unit id="3AXboIn" resname="Add answer">
+        <source>Add answer</source>
+        <target>Antwoord toevoegen</target>
+      </trans-unit>
+      <trans-unit id="hUN3NTt" resname="Add blank">
+        <source>Add blank</source>
+        <target>Leeg toevoegen</target>
+      </trans-unit>
+      <trans-unit id="nl03zPX" resname="Add blank quiz">
+        <source>Add blank quiz</source>
+        <target>Lege quiz toevoegen</target>
+      </trans-unit>
+      <trans-unit id="2Qmgp4S" resname="Add from XLSX">
+        <source>Add from XLSX</source>
+        <target>Toevoegen vanuit XLSX</target>
+      </trans-unit>
+      <trans-unit id="MJD3m3Q" resname="Add label">
+        <source>Add label</source>
+        <target>Label toevoegen</target>
+      </trans-unit>
+      <trans-unit id="gjGGGsg" resname="Add question">
+        <source>Add question</source>
+        <target>Vraag toevoegen</target>
+      </trans-unit>
+      <trans-unit id="tHdA52O" resname="All">
+        <source>All</source>
+        <target>Alle</target>
       </trans-unit>
       <trans-unit id="qiXD5ve" resname="All Seasons">
         <source>All Seasons</source>
@@ -57,14 +85,26 @@
         <source>Are you sure you want to clear all the results? This will also delete all the eliminations.</source>
         <target>Weet je zeker dat je de resultaten wilt leegmaken? Dit gooit ook alle eliminaties weg.</target>
       </trans-unit>
+      <trans-unit id="8HZ5s3T" resname="Are you sure you want to delete this question from the question bank?">
+        <source>Are you sure you want to delete this question from the question bank?</source>
+        <target>Weet je zeker dat je deze vraag uit de vragenbank wilt verwijderen?</target>
+      </trans-unit>
       <trans-unit id="Ec4twG8" resname="Are you sure you want to delete this quiz?">
         <source>Are you sure you want to delete this quiz?</source>
         <target>Weet je zeker dat je deze test wilt verwijderen?</target>
       </trans-unit>
+      <trans-unit id="4bcq6sL" resname="Assign">
+        <source>Assign</source>
+        <target>Toewijzen</target>
+      </trans-unit>
       <trans-unit id=".QFPbFe" resname="Back">
         <source>Back</source>
         <target>Terug</target>
       </trans-unit>
+      <trans-unit id="JUdglpF" resname="Backoffice">
+        <source>Backoffice</source>
+        <target>Backoffice</target>
+      </trans-unit>
       <trans-unit id="T6TIfj7" resname="Candidate">
         <source>Candidate</source>
         <target>Kandidaat</target>
@@ -109,13 +149,13 @@
         <source>Corrections</source>
         <target>Jokers</target>
       </trans-unit>
-      <trans-unit id="Lu7u8U2" resname="Cound not find candidate with name %name%">
-        <source>Cound not find candidate with name %name%</source>
-        <target>Kon kandidaat met naam %name% niet vinden</target>
+      <trans-unit id="9JHLsoe" resname="Could not find candidate with name {name}">
+        <source>Could not find candidate with name {name}</source>
+        <target>Kon kandidaat met naam {name} niet vinden</target>
       </trans-unit>
-      <trans-unit id="YQUiB4T" resname="Cound not find candidate with name %name% in elimination.">
-        <source>Cound not find candidate with name %name% in elimination.</source>
-        <target>Kon geen kandidaat vinden met de naam %name% in de eliminatie</target>
+      <trans-unit id="h589jDz" resname="Could not find candidate with name {name} in elimination.">
+        <source>Could not find candidate with name {name} in elimination.</source>
+        <target>Kon geen kandidaat vinden met de naam {name} in de eliminatie</target>
       </trans-unit>
       <trans-unit id="0DvmToq" resname="Create a season">
         <source>Create a season</source>
@@ -125,6 +165,10 @@
         <source>Create an account</source>
         <target>Maak een account aan</target>
       </trans-unit>
+      <trans-unit id="yBgKisV" resname="Create an empty quiz and add questions from the question bank.">
+        <source>Create an empty quiz and add questions from the question bank.</source>
+        <target>Maak een lege quiz aan en voeg vragen toe vanuit de vragenbank.</target>
+      </trans-unit>
       <trans-unit id="S5P7nQd" resname="Deactivate">
         <source>Deactivate</source>
         <target>Deactiveren</target>
@@ -133,6 +177,14 @@
         <source>Deactivate Quiz</source>
         <target>Deactiveer test</target>
       </trans-unit>
+      <trans-unit id="tOdAxXK" resname="Deactivate the quiz before undoing the finalization">
+        <source>Deactivate the quiz before undoing the finalization</source>
+        <target>Deactiveer de test voordat je de finalisatie ongedaan maakt</target>
+      </trans-unit>
+      <trans-unit id="Z_crX_u" resname="Delete">
+        <source>Delete</source>
+        <target>Verwijderen</target>
+      </trans-unit>
       <trans-unit id="p9GNNI3" resname="Delete Quiz...">
         <source>Delete Quiz...</source>
         <target>Test verwijderen...</target>
@@ -141,10 +193,22 @@
         <source>Download Template</source>
         <target>Download sjabloon</target>
       </trans-unit>
+      <trans-unit id="dwUtS3b" resname="Draft">
+        <source>Draft</source>
+        <target>Concept</target>
+      </trans-unit>
       <trans-unit id="FfYlwX8" resname="EMPTY">
         <source>EMPTY</source>
         <target>LEEG</target>
       </trans-unit>
+      <trans-unit id="M.l1CPU" resname="Edit">
+        <source>Edit</source>
+        <target>Bewerken</target>
+      </trans-unit>
+      <trans-unit id="6RmXg4t" resname="Edit question">
+        <source>Edit question</source>
+        <target>Vraag bewerken</target>
+      </trans-unit>
       <trans-unit id="JZi_tm0" resname="Email">
         <source>Email</source>
         <target>E-mail</target>
@@ -161,6 +225,18 @@
         <source>Error clearing quiz</source>
         <target>Fout bij het leegmaken van de test</target>
       </trans-unit>
+      <trans-unit id="bgWPQMg" resname="Export to XLSX">
+        <source>Export to XLSX</source>
+        <target>Exporteren naar XLSX</target>
+      </trans-unit>
+      <trans-unit id="6rPqY9p" resname="Finalize">
+        <source>Finalize</source>
+        <target>Finaliseren</target>
+      </trans-unit>
+      <trans-unit id="c_5RxsX" resname="Finalized">
+        <source>Finalized</source>
+        <target>Definitief</target>
+      </trans-unit>
       <trans-unit id="OGiIhMH" resname="Green">
         <source>Green</source>
         <target>Groen</target>
@@ -193,14 +269,34 @@
         <source>Inactive</source>
         <target>Inactief</target>
       </trans-unit>
+      <trans-unit id="0GRwjA_" resname="Invalid label name">
+        <source>Invalid label name</source>
+        <target>Ongeldige labelnaam</target>
+      </trans-unit>
       <trans-unit id="k1X7w12" resname="Invalid season code">
         <source>Invalid season code</source>
         <target>Ongeldige seizoencode</target>
       </trans-unit>
+      <trans-unit id="OoJeYtt" resname="Label added">
+        <source>Label added</source>
+        <target>Label toegevoegd</target>
+      </trans-unit>
+      <trans-unit id="HWV7sHP" resname="Label removed">
+        <source>Label removed</source>
+        <target>Label verwijderd</target>
+      </trans-unit>
+      <trans-unit id="YqI5TFM" resname="Labels">
+        <source>Labels</source>
+        <target>Labels</target>
+      </trans-unit>
       <trans-unit id="q0FeoCr" resname="Load Prepared Elimination">
         <source>Load Prepared Elimination</source>
         <target>Laad voorbereide eliminatie</target>
       </trans-unit>
+      <trans-unit id="M2ELPzt" resname="Locked (answers given)">
+        <source>Locked (answers given)</source>
+        <target>Vergrendeld (antwoorden gegeven)</target>
+      </trans-unit>
       <trans-unit id="JKl2Twv" resname="Logout">
         <source>Logout</source>
         <target>Uitloggen</target>
@@ -221,6 +317,10 @@
         <source>Name</source>
         <target>Naam</target>
       </trans-unit>
+      <trans-unit id="lqTjJ4a" resname="New label">
+        <source>New label</source>
+        <target>Nieuw label</target>
+      </trans-unit>
       <trans-unit id="gefhnBC" resname="Next">
         <source>Next</source>
         <target>Volgende</target>
@@ -233,6 +333,14 @@
         <source>No active quiz</source>
         <target>Geen actieve test</target>
       </trans-unit>
+      <trans-unit id="lwoek_H" resname="No candidates">
+        <source>No candidates</source>
+        <target>Geen kandidaten</target>
+      </trans-unit>
+      <trans-unit id="IsJa5UL" resname="No questions in the question bank yet">
+        <source>No questions in the question bank yet</source>
+        <target>Nog geen vragen in de vragenbank</target>
+      </trans-unit>
       <trans-unit id="oNXT2zu" resname="No quizzes">
         <source>No quizzes</source>
         <target>Geen tests</target>
@@ -249,6 +357,10 @@
         <source>Number of dropouts:</source>
         <target>Aantal afvallers:</target>
       </trans-unit>
+      <trans-unit id="_SqArFZ" resname="Open">
+        <source>Open</source>
+        <target>Openen</target>
+      </trans-unit>
       <trans-unit id="HmgPmMV" resname="Overview">
         <source>Overview</source>
         <target>Overzicht</target>
@@ -297,10 +409,46 @@
         <source>Previous</source>
         <target>Vorige</target>
       </trans-unit>
+      <trans-unit id="W1WJHfF" resname="Question">
+        <source>Question</source>
+        <target>Vraag</target>
+      </trans-unit>
+      <trans-unit id="lxvgioH" resname="Question added to quiz %quiz%">
+        <source>Question added to quiz %quiz%</source>
+        <target>Vraag toegevoegd aan test %quiz%</target>
+      </trans-unit>
+      <trans-unit id="hMGFgEZ" resname="Question added to the question bank">
+        <source>Question added to the question bank</source>
+        <target>Vraag toegevoegd aan de vragenbank</target>
+      </trans-unit>
+      <trans-unit id="katmLq0" resname="Question bank">
+        <source>Question bank</source>
+        <target>Vragenbank</target>
+      </trans-unit>
+      <trans-unit id="htaUa1k" resname="Question removed from quiz %quiz%">
+        <source>Question removed from quiz %quiz%</source>
+        <target>Vraag verwijderd uit quiz %quiz%</target>
+      </trans-unit>
+      <trans-unit id="KApairC" resname="Question removed from the question bank">
+        <source>Question removed from the question bank</source>
+        <target>Vraag verwijderd uit de vragenbank</target>
+      </trans-unit>
+      <trans-unit id="6rkejYf" resname="Question synced to quiz %quiz%">
+        <source>Question synced to quiz %quiz%</source>
+        <target>Vraag gesynchroniseerd naar quiz %quiz%</target>
+      </trans-unit>
+      <trans-unit id="MNSmL.W" resname="Question updated">
+        <source>Question updated</source>
+        <target>Vraag bijgewerkt</target>
+      </trans-unit>
       <trans-unit id="Rx5irUP" resname="Questions">
         <source>Questions</source>
         <target>Vragen</target>
       </trans-unit>
+      <trans-unit id="1jiUI_8" resname="Quick actions">
+        <source>Quick actions</source>
+        <target>Snelle acties</target>
+      </trans-unit>
       <trans-unit id="0tv0gq." resname="Quiz">
         <source>Quiz</source>
         <target>Test</target>
@@ -321,6 +469,10 @@
         <source>Quiz cleared</source>
         <target>Test leeggemaakt</target>
       </trans-unit>
+      <trans-unit id="cyXkBo4" resname="Quiz cleared and no longer finalized">
+        <source>Quiz cleared and no longer finalized</source>
+        <target>Test leeggemaakt en niet langer gefinaliseerd</target>
+      </trans-unit>
       <trans-unit id="LbVe.2c" resname="Quiz completed">
         <source>Quiz completed</source>
         <target>Test voltooid</target>
@@ -329,6 +481,14 @@
         <source>Quiz deleted</source>
         <target>Test verwijderd</target>
       </trans-unit>
+      <trans-unit id="GPFvyrm" resname="Quiz finalized">
+        <source>Quiz finalized</source>
+        <target>Test gefinaliseerd</target>
+      </trans-unit>
+      <trans-unit id="BAp8lIR" resname="Quiz is no longer finalized">
+        <source>Quiz is no longer finalized</source>
+        <target>Test is niet langer gefinaliseerd</target>
+      </trans-unit>
       <trans-unit id="frxoIkW" resname="Quiz name">
         <source>Quiz name</source>
         <target>Testnaam</target>
@@ -349,6 +509,10 @@
         <source>Remember me</source>
         <target>Onthoud mij</target>
       </trans-unit>
+      <trans-unit id="zy7f1zh" resname="Remove label">
+        <source>Remove label</source>
+        <target>Label verwijderen</target>
+      </trans-unit>
       <trans-unit id="Z9CSKpk" resname="Repeat Password">
         <source>Repeat Password</source>
         <target>Herhaal wachtwoord</target>
@@ -357,6 +521,10 @@
         <source>Results &amp; Elimination</source>
         <target><![CDATA[Resultaat & Eliminatie]]></target>
       </trans-unit>
+      <trans-unit id="uFRq6ud" resname="Reusable">
+        <source>Reusable</source>
+        <target>Herbruikbaar</target>
+      </trans-unit>
       <trans-unit id="z9OKodR" resname="Save">
         <source>Save</source>
         <target>Opslaan</target>
@@ -405,10 +573,30 @@
         <source>Submit</source>
         <target>Verstuur</target>
       </trans-unit>
+      <trans-unit id="yqJbSKu" resname="Sync latest changes to this quiz">
+        <source>Sync latest changes to this quiz</source>
+        <target>Laatste wijzigingen synchroniseren naar deze quiz</target>
+      </trans-unit>
       <trans-unit id="_z4el3Z" resname="The password fields must match.">
         <source>The password fields must match.</source>
         <target>De wachtwoorden moeten overeen komen.</target>
       </trans-unit>
+      <trans-unit id="1jF4vJ8" resname="The question was not synced to finalized quiz(zes): %quizzes%. Use the Sync button to update them.">
+        <source>The question was not synced to finalized quiz(zes): %quizzes%. Use the Sync button to update them.</source>
+        <target>De vraag is niet gesynchroniseerd naar gefinaliseerde quiz(zes): %quizzes%. Gebruik de Synchroniseren-knop om ze bij te werken.</target>
+      </trans-unit>
+      <trans-unit id="K3e_SRJ" resname="The quiz cannot be finalized while it has errors">
+        <source>The quiz cannot be finalized while it has errors</source>
+        <target>De test kan niet gefinaliseerd worden zolang er fouten zijn</target>
+      </trans-unit>
+      <trans-unit id="B7wNGHP" resname="The quiz has already been filled in and can no longer be altered">
+        <source>The quiz has already been filled in and can no longer be altered</source>
+        <target>De test is al ingevuld en kan niet meer aangepast worden</target>
+      </trans-unit>
+      <trans-unit id="Z3xaLuk" resname="The quiz must be finalized before it can be activated">
+        <source>The quiz must be finalized before it can be activated</source>
+        <target>De test moet gefinaliseerd zijn voordat deze geactiveerd kan worden</target>
+      </trans-unit>
       <trans-unit id="HuzRgeN" resname="There are no answers for this question">
         <source>There are no answers for this question</source>
         <target>Er zijn geen antwoorden voor deze vraag</target>
@@ -417,10 +605,42 @@
         <source>There is no active quiz</source>
         <target>Er is geen test actief</target>
       </trans-unit>
+      <trans-unit id=".WkwBH8" resname="This question has already been used">
+        <source>This question has already been used</source>
+        <target>Deze vraag is al gebruikt</target>
+      </trans-unit>
+      <trans-unit id="zkt9PBS" resname="This question has been used in a quiz. The copy in the quiz will not be affected.">
+        <source>This question has been used in a quiz. The copy in the quiz will not be affected.</source>
+        <target>Deze vraag is gebruikt in een test. De kopie in de test blijft ongewijzigd.</target>
+      </trans-unit>
+      <trans-unit id="nFSq59J" resname="This quiz can no longer be altered">
+        <source>This quiz can no longer be altered</source>
+        <target>Deze test kan niet meer aangepast worden</target>
+      </trans-unit>
+      <trans-unit id="uAJQGot" resname="This quiz has already been filled in and can no longer be altered">
+        <source>This quiz has already been filled in and can no longer be altered</source>
+        <target>Deze quiz is al ingevuld en kan niet meer worden gewijzigd</target>
+      </trans-unit>
+      <trans-unit id="Xq9rT2p" resname="This quiz has no questions yet">
+        <source>This quiz has no questions yet</source>
+        <target>Deze test heeft nog geen vragen</target>
+      </trans-unit>
       <trans-unit id="Dptvysv" resname="Time">
         <source>Time</source>
         <target>Tijd</target>
       </trans-unit>
+      <trans-unit id="XLYBGca" resname="Unassign">
+        <source>Unassign</source>
+        <target>Ontkoppelen</target>
+      </trans-unit>
+      <trans-unit id="A_XdODo" resname="Undo finalization">
+        <source>Undo finalization</source>
+        <target>Finalisatie ongedaan maken</target>
+      </trans-unit>
+      <trans-unit id="Bdt8q.S" resname="Used in">
+        <source>Used in</source>
+        <target>Gebruikt in</target>
+      </trans-unit>
       <trans-unit id="pRCwpOT" resname="Yes">
         <source>Yes</source>
         <target>Ja</target>
@@ -429,6 +649,10 @@
         <source>You are not allowed to answer this quiz</source>
         <target>Je mag deze test niet beantwoorden</target>
       </trans-unit>
+      <trans-unit id="78moQnF" resname="You cannot answer this question">
+        <source>You cannot answer this question</source>
+        <target>Je kan deze vraag niet beantwoorden</target>
+      </trans-unit>
       <trans-unit id="0afY1NF" resname="You have no seasons yet.">
         <source>You have no seasons yet.</source>
         <target>Je hebt nog geen seizoenen.</target>

translations/validators.nl.xliff

@@ -9,6 +9,14 @@
         <source>A PHP extension caused the upload to fail.</source>
         <target>De upload is mislukt vanwege een PHP-extensie.</target>
       </trans-unit>
+      <trans-unit id="H5aPWKx" resname="A question must have exactly one correct answer">
+        <source>A question must have exactly one correct answer</source>
+        <target>Een vraag moet precies één goed antwoord hebben</target>
+      </trans-unit>
+      <trans-unit id="urKst95" resname="A question needs at least two answers">
+        <source>A question needs at least two answers</source>
+        <target>Een vraag heeft minstens twee antwoorden nodig</target>
+      </trans-unit>
       <trans-unit id="L9tKe2y" resname="An empty file is not allowed.">
         <source>An empty file is not allowed.</source>
         <target>Lege bestanden zijn niet toegestaan.</target>
@@ -65,6 +73,10 @@
         <source>Please enter a valid URL.</source>
         <target>Vul een geldige URL in.</target>
       </trans-unit>
+      <trans-unit id="_vG7Dae" resname="Please enter a valid UUID.">
+        <source>Please enter a valid UUID.</source>
+        <target state="needs-review-translation">Vul een geldige UUID in.</target>
+      </trans-unit>
       <trans-unit id="e_2ZUCK" resname="Please enter a valid birthdate.">
         <source>Please enter a valid birthdate.</source>
         <target>Vul een geldige geboortedatum in.</target>
@@ -361,6 +373,10 @@
         <source>This URL is missing a top-level domain.</source>
         <target>Deze URL mist een top-level domein.</target>
       </trans-unit>
+      <trans-unit id="1yeK8aU" resname="This XML payload is too large ({{ size }} bytes): it exceeds the limit of {{ limit }} bytes.">
+        <source>This XML payload is too large ({{ size }} bytes): it exceeds the limit of {{ limit }} bytes.</source>
+        <target state="needs-review-translation">Deze XML-payload is te groot ({{ size }} bytes): deze overschrijdt de limiet van {{ limit }} bytes.</target>
+      </trans-unit>
       <trans-unit id="d4HuxpA" resname="This collection should contain exactly {{ limit }} element.|This collection should contain exactly {{ limit }} elements.">
         <source>This collection should contain exactly {{ limit }} element.|This collection should contain exactly {{ limit }} elements.</source>
         <target>Deze collectie moet exact één element bevatten.|Deze collectie moet exact {{ limit }} elementen bevatten.</target>
@@ -425,6 +441,10 @@
         <source>This value contains characters that are not allowed by the current restriction-level.</source>
         <target>Deze waarde bevat tekens die niet zijn toegestaan volgens het huidige beperkingsniveau.</target>
       </trans-unit>
+      <trans-unit id="hueZAUr" resname="This value does not conform to the expected XSD schema.">
+        <source>This value does not conform to the expected XSD schema.</source>
+        <target state="needs-review-translation">Deze waarde voldoet niet aan het verwachte XSD-schema.</target>
+      </trans-unit>
       <trans-unit id="tD.RkRe" resname="This value does not match the expected {{ charset }} charset.">
         <source>This value does not match the expected {{ charset }} charset.</source>
         <target>Deze waarde is niet in de verwachte tekencodering {{ charset }}.</target>
@@ -485,6 +505,10 @@
         <source>This value is not a valid country.</source>
         <target>Deze waarde is geen geldig land.</target>
       </trans-unit>
+      <trans-unit id="ZXF_Jfm" resname="This value is not a valid cron expression.">
+        <source>This value is not a valid cron expression.</source>
+        <target state="needs-review-translation">Deze waarde is geen geldige cron-expressie.</target>
+      </trans-unit>
       <trans-unit id="OeFZFII" resname="This value is not a valid currency.">
         <source>This value is not a valid currency.</source>
         <target>Deze waarde is geen geldige valuta.</target>
@@ -525,6 +549,10 @@
         <source>This value is not a valid week.</source>
         <target>Deze waarde is geen geldige week.</target>
       </trans-unit>
+      <trans-unit id="iTwuWRs" resname="This value is not valid XML.">
+        <source>This value is not valid XML.</source>
+        <target state="needs-review-translation">Deze waarde is geen geldige XML.</target>
+      </trans-unit>
       <trans-unit id="TZg2uqx" resname="This value is not valid.">
         <source>This value is not valid.</source>
         <target>Deze waarde is niet geldig.</target>