test: expand coverage, dedupe data-driven tests, extract shared WebTestCase base

- Add #[CoversClass] to Base64Test and FilenameSanitizerTest
- Merge near-duplicate test methods into #[DataProvider] cases across
  ResetPasswordControllerTest, SettingsControllerTest, ClaimSeasonCommandTest,
  FilenameSanitizerTest, Base64Test, and SeasonRepositoryTest
- Add integration tests for previously untested controllers: public
  QuizController (quiz-taking flow), LoginController, RegistrationController,
  EliminationController, and PrepareEliminationController
- Add unit tests for Elimination and BankQuestion entity logic
- Extract shared WebTestCase setup/helpers (client, entityManager, login,
  entity lookups, CSRF token scraping) into AbstractControllerWebTestCase,
  removing duplicated boilerplate from all 14 WebTestCase files

composer.json

@@ -35,6 +35,7 @@
         "symfony/security-bundle": "8.1.*",
         "symfony/security-csrf": "8.1.*",
         "symfony/serializer": "8.1.*",
+        "symfony/string": "8.1.*",
         "symfony/translation": "8.1.*",
         "symfony/twig-bundle": "8.1.*",
         "symfony/uid": "8.1.*",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "010a4456ebc1a8ebaf73c6db051d3d09",
+    "content-hash": "ccae654dd9c952e8920d9cb9c0f35ff5",
     "packages": [
         {
             "name": "composer/pcre",

src/Controller/Backoffice/BackofficeController.php

@@ -14,10 +14,13 @@ use Symfony\Component\HttpKernel\Attribute\AsController;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Routing\Requirement\Requirement;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
+use Symfony\Contracts\Translation\TranslatorInterface;
 use Tvdt\Controller\AbstractController;
 use Tvdt\Entity\Quiz;
 use Tvdt\Entity\Season;
+use Tvdt\Enum\FlashType;
 use Tvdt\Form\CreateSeasonFormType;
+use Tvdt\Helpers\FilenameSanitizer;
 use Tvdt\Repository\SeasonRepository;
 use Tvdt\Security\Voter\SeasonVoter;
 use Tvdt\Service\QuizSpreadsheetService;
@@ -31,6 +34,7 @@ final class BackofficeController extends AbstractController
         private readonly Security $security,
         private readonly QuizSpreadsheetService $excel,
         private readonly EntityManagerInterface $em,
+        private readonly TranslatorInterface $translator,
     ) {}
 
     #[Route('/backoffice/', name: 'tvdt_backoffice_index')]
@@ -83,11 +87,17 @@ final class BackofficeController extends AbstractController
         requirements: ['quiz' => Requirement::UUID],
         methods: ['GET'],
     )]
-    public function exportQuiz(Quiz $quiz): StreamedResponse
+    public function exportQuiz(Quiz $quiz): Response
     {
+        if (!$this->authenticatedUser->isVerified) {
+            $this->addFlash(FlashType::Warning, $this->translator->trans('Please confirm your email address before exporting a quiz.'));
+
+            return $this->redirectToRoute('tvdt_backoffice_season', ['seasonCode' => $quiz->season->seasonCode]);
+        }
+
         $response = new StreamedResponse($this->excel->quizToXlsx($quiz));
         $response->headers->set('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet');
-        $response->headers->set('Content-Disposition', HeaderUtils::makeDisposition(HeaderUtils::DISPOSITION_ATTACHMENT, $quiz->name.'.xlsx'));
+        $response->headers->set('Content-Disposition', HeaderUtils::makeDisposition(HeaderUtils::DISPOSITION_ATTACHMENT, FilenameSanitizer::sanitize($quiz->name).'.xlsx'));
 
         return $response;
     }

src/Controller/Backoffice/SettingsController.php

@@ -6,9 +6,12 @@ namespace Tvdt\Controller\Backoffice;
 
 use Doctrine\DBAL\Exception\UniqueConstraintViolationException;
 use Doctrine\ORM\EntityManagerInterface;
+use Safe\DateTimeImmutable;
 use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\Form\FormError;
 use Symfony\Component\Form\FormInterface;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+use Symfony\Component\HttpFoundation\HeaderUtils;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -21,8 +24,10 @@ use Tvdt\Entity\User;
 use Tvdt\Enum\FlashType;
 use Tvdt\Form\ChangeEmailFormType;
 use Tvdt\Form\ChangeUserPasswordFormType;
+use Tvdt\Helpers\FilenameSanitizer;
 use Tvdt\Repository\UserRepository;
 use Tvdt\Security\EmailVerifier;
+use Tvdt\Service\DataExportService;
 
 final class SettingsController extends AbstractController
 {
@@ -33,6 +38,7 @@ final class SettingsController extends AbstractController
         private readonly EmailVerifier $emailVerifier,
         private readonly Security $security,
         private readonly TranslatorInterface $translator,
+        private readonly DataExportService $dataExportService,
     ) {}
 
     #[Route('/backoffice/settings', name: 'tvdt_backoffice_settings', methods: ['GET'])]
@@ -148,6 +154,34 @@ final class SettingsController extends AbstractController
         return $this->redirectToRoute('tvdt_backoffice_settings');
     }
 
+    #[Route('/backoffice/settings/download-data', name: 'tvdt_backoffice_settings_download_data', methods: ['GET'])]
+    public function downloadData(): Response
+    {
+        if (!$this->authenticatedUser->isVerified) {
+            $this->addFlash(FlashType::Warning, $this->translator->trans('Please confirm your email address before downloading your data.'));
+
+            return $this->redirectToRoute('tvdt_backoffice_settings');
+        }
+
+        $zipPath = $this->dataExportService->exportForUser($this->authenticatedUser);
+
+        $filename = \sprintf(
+            'tijd-voor-de-test-data-%s-%s.zip',
+            FilenameSanitizer::sanitize($this->authenticatedUser->email),
+            new DateTimeImmutable()->format('Y-m-d_H-i-s'),
+        );
+
+        $response = new BinaryFileResponse($zipPath);
+        $response->deleteFileAfterSend(true);
+        $response->headers->set('Content-Type', 'application/zip');
+        $response->headers->set(
+            'Content-Disposition',
+            HeaderUtils::makeDisposition(HeaderUtils::DISPOSITION_ATTACHMENT, $filename),
+        );
+
+        return $response;
+    }
+
     #[IsCsrfTokenValid('delete_account')]
     #[Route('/backoffice/settings/delete', name: 'tvdt_backoffice_settings_delete', methods: ['POST'])]
     public function deleteAccount(Request $request): Response

src/Helpers/FilenameSanitizer.php

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Helpers;
+
+use Symfony\Component\String\Slugger\AsciiSlugger;
+
+class FilenameSanitizer
+{
+    /** Slugs user-supplied text (e.g. a season/quiz name) into a string safe to use as a zip entry path segment or a downloaded filename. */
+    public static function sanitize(string $value): string
+    {
+        $slug = new AsciiSlugger()->slug($value)->toString();
+
+        return '' === $slug ? 'unnamed' : $slug;
+    }
+}

src/Repository/UserRepository.php

@@ -5,9 +5,15 @@ declare(strict_types=1);
 namespace Tvdt\Repository;
 
 use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
+use Doctrine\ORM\EntityManagerInterface;
 use Doctrine\Persistence\ManagerRegistry;
 use Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface;
 use Symfony\Component\Security\Core\User\PasswordUpgraderInterface;
+use Tvdt\Entity\BankQuestion;
+use Tvdt\Entity\Elimination;
+use Tvdt\Entity\GivenAnswer;
+use Tvdt\Entity\QuizCandidate;
+use Tvdt\Entity\Season;
 use Tvdt\Entity\User;
 
 /** @extends ServiceEntityRepository<User> */
@@ -44,8 +50,11 @@ class UserRepository extends ServiceEntityRepository implements PasswordUpgrader
         $em->wrapInTransaction(function () use ($em, $user): void {
             $this->invalidateResetPasswordRequests($user);
 
+            $bankQuestionIds = [];
             foreach ($user->seasons->toArray() as $season) {
                 if (1 === $season->owners->count()) {
+                    $this->purgeSoftDeletableData($em, $season);
+                    array_push($bankQuestionIds, ...$this->bankQuestionIds($season));
                     $em->remove($season);
 
                     continue;
@@ -56,9 +65,63 @@ class UserRepository extends ServiceEntityRepository implements PasswordUpgrader
 
             $em->remove($user);
             $em->flush();
+
+            // Gedmo\Loggable writes its own "removed" log entry as part of the flush above, so the
+            // audit-log purge must happen after — purging first would just leave that final row behind.
+            $this->purgeBankQuestionAuditLog($em, $bankQuestionIds);
         });
     }
 
+    /**
+     * QuizCandidate, GivenAnswer, and Elimination are Gedmo\SoftDeleteable, so cascading their
+     * removal through the season/quiz/candidate relations only sets deletedAt — it never removes
+     * the row. That leaves personal data behind indefinitely and, since Candidate/Answer are hard
+     * deleted via orphanRemoval, it also breaks their foreign keys and rolls back the whole
+     * deletion. Bulk DQL deletes bypass the Gedmo listener and physically remove these rows first.
+     */
+    private function purgeSoftDeletableData(EntityManagerInterface $em, Season $season): void
+    {
+        foreach ([QuizCandidate::class, GivenAnswer::class, Elimination::class] as $class) {
+            $em->createQuery(<<<DQL
+                delete from {$class} e
+                where e.quiz in (select q from Tvdt\Entity\Quiz q where q.season = :season)
+                DQL)
+                ->setParameter('season', $season)
+                ->execute();
+        }
+    }
+
+    /** @return list<string> */
+    private function bankQuestionIds(Season $season): array
+    {
+        return array_values(array_map(
+            static fn (BankQuestion $bankQuestion): string => $bankQuestion->id->toString(),
+            $season->bankQuestions->toArray(),
+        ));
+    }
+
+    /**
+     * Gedmo\Loggable audit rows (ext_log_entries) aren't foreign-keyed to the entity they log —
+     * object_id is a plain string — so removing a BankQuestion never cleans up its history, and
+     * the editor's username/email would otherwise remain in those rows forever.
+     *
+     * @param list<string> $bankQuestionIds
+     */
+    private function purgeBankQuestionAuditLog(EntityManagerInterface $em, array $bankQuestionIds): void
+    {
+        if ([] === $bankQuestionIds) {
+            return;
+        }
+
+        $em->createQuery(<<<'DQL'
+            delete from Tvdt\Entity\LogEntry l
+            where l.objectClass = :class and l.objectId in (:ids)
+            DQL)
+            ->setParameter('class', BankQuestion::class)
+            ->setParameter('ids', $bankQuestionIds)
+            ->execute();
+    }
+
     public function makeAdmin(string $email): void
     {
         $user = $this->findOneBy(['email' => $email]);

src/Service/DataExportService.php

@@ -0,0 +1,444 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Service;
+
+use Doctrine\ORM\EntityManagerInterface;
+use PhpOffice\PhpSpreadsheet\Cell\Coordinate;
+use PhpOffice\PhpSpreadsheet\Spreadsheet;
+use PhpOffice\PhpSpreadsheet\Worksheet\Worksheet;
+use PhpOffice\PhpSpreadsheet\Writer;
+use Safe\Exceptions\FilesystemException;
+use Tvdt\Dto\Result;
+use Tvdt\Entity\BankQuestionUsage;
+use Tvdt\Entity\Candidate;
+use Tvdt\Entity\Question;
+use Tvdt\Entity\QuestionLabel;
+use Tvdt\Entity\Quiz;
+use Tvdt\Entity\Season;
+use Tvdt\Entity\User;
+use Tvdt\Helpers\FilenameSanitizer;
+use Tvdt\Repository\QuizRepository;
+
+use function Safe\tempnam;
+use function Safe\unlink;
+
+/** Builds a GDPR data-portability export (a zip of xlsx files) for everything owned by a single user. */
+class DataExportService
+{
+    public function __construct(
+        private readonly EntityManagerInterface $entityManager,
+        private readonly QuizSpreadsheetService $quizSpreadsheetService,
+        private readonly QuizRepository $quizRepository,
+    ) {}
+
+    /** @throws FilesystemException @return string path to a temp zip file; caller is responsible for removing it */
+    public function exportForUser(User $user): string
+    {
+        $filter = $this->entityManager->getFilters();
+        $filter->disable('softdeleteable');
+
+        try {
+            return $this->buildZip($user);
+        } finally {
+            $filter->enable('softdeleteable');
+        }
+    }
+
+    private function buildZip(User $user): string
+    {
+        $zipPath = tempnam(sys_get_temp_dir(), 'tvdt_export_');
+        $tempXlsxFiles = [];
+
+        $zip = new \ZipArchive();
+        if (true !== $zip->open($zipPath, \ZipArchive::OVERWRITE)) {
+            unlink($zipPath);
+
+            throw new \RuntimeException('Could not create the export zip archive.');
+        }
+
+        try {
+            $profilePath = $this->writeToTempFile($this->buildProfileWorkbook($user));
+            $tempXlsxFiles[] = $profilePath;
+            $zip->addFile($profilePath, 'profile.xlsx');
+
+            foreach ($user->seasons as $season) {
+                $folder = FilenameSanitizer::sanitize($season->seasonCode.'-'.$season->name).'/';
+
+                foreach ($season->quizzes as $quiz) {
+                    $quizPath = $this->writeToTempFile($this->buildQuizWorkbook($quiz));
+                    $tempXlsxFiles[] = $quizPath;
+                    $zip->addFile($quizPath, $folder.FilenameSanitizer::sanitize($quiz->name).'.xlsx');
+                }
+
+                $candidatesPath = $this->writeToTempFile($this->buildCandidatesWorkbook($season));
+                $tempXlsxFiles[] = $candidatesPath;
+                $zip->addFile($candidatesPath, $folder.'candidates.xlsx');
+
+                $questionBankPath = $this->writeToTempFile($this->buildQuestionBankWorkbook($season));
+                $tempXlsxFiles[] = $questionBankPath;
+                $zip->addFile($questionBankPath, $folder.'question-bank.xlsx');
+            }
+
+            if (!$zip->close()) {
+                throw new \RuntimeException('Could not finalize the export zip archive.');
+            }
+        } catch (\Throwable $throwable) {
+            unlink($zipPath);
+
+            throw $throwable;
+        } finally {
+            foreach ($tempXlsxFiles as $tempXlsxFile) {
+                unlink($tempXlsxFile);
+            }
+        }
+
+        return $zipPath;
+    }
+
+    private function buildProfileWorkbook(User $user): Spreadsheet
+    {
+        $spreadsheet = new Spreadsheet();
+
+        $account = $spreadsheet->getActiveSheet();
+        $account->setTitle('Account');
+        $account->getStyle('A:A')->getFont()->setBold(true);
+        $account->fromArray([
+            ['Email', $user->email],
+            ['Roles', implode(', ', $user->getRoles())],
+            ['Email verified', $user->isVerified ? 'Yes' : 'No'],
+            ['Account ID', $user->id->toString()],
+        ], null, 'A1');
+        $account->getColumnDimension('A')->setAutoSize(true);
+        $account->getColumnDimension('B')->setAutoSize(true);
+
+        $seasons = $spreadsheet->createSheet();
+        $seasons->setTitle('Seasons');
+        $seasons->fromArray(['Season', 'Season code', 'Quizzes', 'Candidates', 'Shared with other owners'], null, 'A1');
+        $seasons->getStyle('1:1')->getFont()->setBold(true);
+
+        $row = 2;
+        foreach ($user->seasons as $season) {
+            $seasons->fromArray([
+                $season->name,
+                $season->seasonCode,
+                $season->quizzes->count(),
+                $season->candidates->count(),
+                $season->owners->count() > 1 ? 'Yes' : 'No',
+            ], null, 'A'.$row);
+            ++$row;
+        }
+
+        foreach (['A', 'B', 'C', 'D', 'E'] as $column) {
+            $seasons->getColumnDimension($column)->setAutoSize(true);
+        }
+
+        $spreadsheet->setActiveSheetIndex(0);
+
+        return $spreadsheet;
+    }
+
+    private function buildQuizWorkbook(Quiz $quiz): Spreadsheet
+    {
+        $spreadsheet = new Spreadsheet();
+
+        $info = $spreadsheet->getActiveSheet();
+        $info->setTitle('Quiz info');
+        $this->fillQuizInfoSheet($info, $quiz);
+
+        $questions = $spreadsheet->createSheet();
+        $questions->setTitle('Questions');
+
+        $this->quizSpreadsheetService->fillQuestionsSheet($questions, $quiz);
+
+        $rawAnswers = $spreadsheet->createSheet();
+        $rawAnswers->setTitle('Raw answers');
+        $this->fillRawAnswersSheet($rawAnswers, $quiz);
+
+        $results = $spreadsheet->createSheet();
+        $results->setTitle('Results');
+        $this->fillResultsSheet($results, $quiz);
+
+        $eliminations = $spreadsheet->createSheet();
+        $eliminations->setTitle('Eliminations');
+        $this->fillEliminationsSheet($eliminations, $quiz);
+
+        $spreadsheet->setActiveSheetIndex(0);
+
+        return $spreadsheet;
+    }
+
+    private function fillQuizInfoSheet(Worksheet $sheet, Quiz $quiz): void
+    {
+        $disabledQuestions = $quiz->questions
+            ->filter(static fn (Question $question): bool => !$question->enabled)
+            ->map(static fn (Question $question): string => $question->question)
+            ->toArray();
+
+        $sheet->getStyle('A:A')->getFont()->setBold(true);
+        $sheet->fromArray([
+            ['Quiz name', $quiz->name],
+            ['Number of dropouts', $quiz->dropouts],
+            ['Finalized', $quiz->isFinalized ? 'Yes' : 'No'],
+            ['Finalized at', $quiz->finalizedAt?->format(\DateTimeInterface::ATOM) ?? ''],
+            ['Disabled questions', implode(', ', $disabledQuestions)],
+        ], null, 'A1');
+        $sheet->getColumnDimension('A')->setAutoSize(true);
+        $sheet->getColumnDimension('B')->setAutoSize(true);
+    }
+
+    private function fillResultsSheet(Worksheet $sheet, Quiz $quiz): void
+    {
+        $sheet->fromArray(['Candidate', 'Correct answers', 'Corrections', 'Penalty (s)', 'Score', 'Time', 'Started', 'Active', 'Deleted'], null, 'A1');
+        $sheet->getStyle('1:1')->getFont()->setBold(true);
+
+        /** @var array<string, Result> $scoresByCandidateId */
+        $scoresByCandidateId = [];
+        foreach ($this->quizRepository->getScores($quiz) as $result) {
+            $scoresByCandidateId[$result->id->toString()] = $result;
+        }
+
+        $row = 2;
+        foreach ($quiz->candidateData as $quizCandidate) {
+            $candidate = $quizCandidate->candidate;
+            $result = $scoresByCandidateId[$candidate->id->toString()] ?? null;
+
+            $sheet->fromArray([
+                $candidate->name,
+                $result?->correct,
+                $result?->corrections,
+                $result?->penaltySeconds,
+                $result?->score,
+                $result instanceof Result ? $result->time->format('%i:%S') : null,
+                $quizCandidate->started?->format(\DateTimeInterface::ATOM),
+                $quizCandidate->active ? 'Yes' : 'No',
+                $quizCandidate->getDeletedAt()?->format(\DateTimeInterface::ATOM) ?? '',
+            ], null, 'A'.$row);
+            ++$row;
+        }
+
+        foreach (range('A', 'I') as $column) {
+            $sheet->getColumnDimension($column)->setAutoSize(true);
+        }
+    }
+
+    /** Raw crosstab: one row per candidate, one column per question, cell = the answer text they gave. */
+    private function fillRawAnswersSheet(Worksheet $sheet, Quiz $quiz): void
+    {
+        /** @var list<Question> $questions */
+        $questions = $quiz->questions->toArray();
+
+        $header = ['Candidate'];
+        foreach ($questions as $question) {
+            $header[] = $question->question;
+        }
+
+        $sheet->fromArray($header, null, 'A1');
+        $sheet->getStyle('1:1')->getFont()->setBold(true);
+        $sheet->getStyle('1:1')->getAlignment()->setWrapText(true);
+
+        /** @var array<string, array<string, string>> $answersByCandidateAndQuestion */
+        $answersByCandidateAndQuestion = [];
+        foreach ($questions as $question) {
+            foreach ($question->answers as $answer) {
+                foreach ($answer->givenAnswers as $givenAnswer) {
+                    $candidateId = $givenAnswer->candidate->id->toString();
+                    $answersByCandidateAndQuestion[$candidateId][$question->id->toString()] = $answer->text;
+                }
+            }
+        }
+
+        $row = 2;
+        foreach ($quiz->candidateData as $quizCandidate) {
+            $candidate = $quizCandidate->candidate;
+
+            $line = [$candidate->name];
+            foreach ($questions as $question) {
+                $line[] = $answersByCandidateAndQuestion[$candidate->id->toString()][$question->id->toString()] ?? '';
+            }
+
+            $sheet->fromArray($line, null, 'A'.$row);
+            ++$row;
+        }
+
+        $lastColumnIndex = 1 + \count($questions);
+        foreach (range('A', Coordinate::stringFromColumnIndex($lastColumnIndex)) as $column) {
+            $sheet->getColumnDimension($column)->setWidth(30);
+            $sheet->getStyle($column.':'.$column)->getAlignment()->setWrapText(true);
+        }
+    }
+
+    private function fillEliminationsSheet(Worksheet $sheet, Quiz $quiz): void
+    {
+        /** @var list<Candidate> $candidates */
+        $candidates = $quiz->season->candidates->toArray();
+
+        $header = ['Prepared at', 'Deleted'];
+        foreach ($candidates as $candidate) {
+            $header[] = $candidate->name;
+        }
+
+        $sheet->fromArray($header, null, 'A1');
+        $sheet->getStyle('1:1')->getFont()->setBold(true);
+
+        $row = 2;
+        foreach ($quiz->eliminations as $elimination) {
+            $line = [
+                $elimination->getCreatedAt()?->format(\DateTimeInterface::ATOM) ?? '',
+                $elimination->getDeletedAt()?->format(\DateTimeInterface::ATOM) ?? '',
+            ];
+
+            foreach ($candidates as $candidate) {
+                $line[] = $elimination->getScreenColour($candidate->name) ?? '';
+            }
+
+            $sheet->fromArray($line, null, 'A'.$row);
+            ++$row;
+        }
+
+        foreach (range('A', Coordinate::stringFromColumnIndex(2 + \count($candidates))) as $column) {
+            $sheet->getColumnDimension($column)->setAutoSize(true);
+        }
+    }
+
+    private function buildCandidatesWorkbook(Season $season): Spreadsheet
+    {
+        $spreadsheet = new Spreadsheet();
+
+        $candidatesSheet = $spreadsheet->getActiveSheet();
+        $candidatesSheet->setTitle('Candidates');
+        $candidatesSheet->fromArray(['Name'], null, 'A1');
+        $candidatesSheet->getStyle('1:1')->getFont()->setBold(true);
+
+        $row = 2;
+        foreach ($season->candidates as $candidate) {
+            $candidatesSheet->fromArray([$candidate->name], null, 'A'.$row);
+            ++$row;
+        }
+
+        $candidatesSheet->getColumnDimension('A')->setAutoSize(true);
+
+        $infoSheet = $spreadsheet->createSheet();
+        $infoSheet->setTitle('Season info');
+        $infoSheet->getStyle('A:A')->getFont()->setBold(true);
+        $infoSheet->fromArray([
+            ['Season name', $season->name],
+            ['Season code', $season->seasonCode],
+            ['Number of quizzes', $season->quizzes->count()],
+            ['Number of candidates', $season->candidates->count()],
+            ['Active quiz', $season->activeQuiz instanceof Quiz ? $season->activeQuiz->name : ''],
+            ['Show numbers', $season->settings?->showNumbers ? 'Yes' : 'No'],
+            ['Confirm answers', $season->settings?->confirmAnswers ? 'Yes' : 'No'],
+            ['Shared with other owners', $season->owners->count() > 1 ? 'Yes' : 'No'],
+        ], null, 'A1');
+        $infoSheet->getColumnDimension('A')->setAutoSize(true);
+        $infoSheet->getColumnDimension('B')->setAutoSize(true);
+
+        $spreadsheet->setActiveSheetIndex(0);
+
+        return $spreadsheet;
+    }
+
+    private function buildQuestionBankWorkbook(Season $season): Spreadsheet
+    {
+        $spreadsheet = new Spreadsheet();
+
+        $questions = $spreadsheet->getActiveSheet();
+        $questions->setTitle('Questions');
+        $this->fillBankQuestionsSheet($questions, $season);
+
+        $labels = $spreadsheet->createSheet();
+        $labels->setTitle('Labels');
+        $this->fillQuestionLabelsSheet($labels, $season);
+
+        $spreadsheet->setActiveSheetIndex(0);
+
+        return $spreadsheet;
+    }
+
+    private function fillBankQuestionsSheet(Worksheet $sheet, Season $season): void
+    {
+        $metaColumns = ['Question', 'Reusable', 'Complete for quiz', 'Labels', 'Used in quizzes'];
+        $sheet->fromArray($metaColumns, null, 'A1');
+        $sheet->getStyle('1:1')->getFont()->setBold(true);
+
+        $answerStartColumnIndex = \count($metaColumns);
+        $maxAnswers = 0;
+        $row = 2;
+
+        foreach ($season->bankQuestions as $bankQuestion) {
+            $labels = implode(', ', array_map(
+                static fn (QuestionLabel $label): string => $label->name,
+                $bankQuestion->labels->toArray(),
+            ));
+            $usedInQuizzes = implode(', ', array_map(
+                static fn (BankQuestionUsage $usage): string => $usage->quiz->name,
+                $bankQuestion->usages->toArray(),
+            ));
+
+            $sheet->fromArray([
+                $bankQuestion->question,
+                $bankQuestion->reusable ? 'Yes' : 'No',
+                $bankQuestion->isCompleteForQuiz ? 'Yes' : 'No',
+                $labels,
+                $usedInQuizzes,
+            ], null, 'A'.$row);
+
+            $col = 0;
+            foreach ($bankQuestion->answers as $answer) {
+                $sheet->setCellValue(Coordinate::stringFromColumnIndex($answerStartColumnIndex + 1 + 2 * $col).$row, $answer->text);
+                $sheet->setCellValue(Coordinate::stringFromColumnIndex($answerStartColumnIndex + 2 + 2 * $col).$row, $answer->isRightAnswer);
+                ++$col;
+            }
+
+            $maxAnswers = max($maxAnswers, $col);
+            ++$row;
+        }
+
+        for ($i = 0; $i < $maxAnswers; ++$i) {
+            $answerCol = Coordinate::stringFromColumnIndex($answerStartColumnIndex + 1 + 2 * $i);
+            $correctCol = Coordinate::stringFromColumnIndex($answerStartColumnIndex + 2 + 2 * $i);
+
+            $sheet->setCellValue($answerCol.'1', 'Answer '.($i + 1));
+            $sheet->setCellValue($correctCol.'1', 'Correct');
+        }
+
+        $lastColumnIndex = $answerStartColumnIndex + max(1, 2 * $maxAnswers);
+        foreach (range('A', Coordinate::stringFromColumnIndex($lastColumnIndex)) as $column) {
+            $sheet->getColumnDimension($column)->setAutoSize(true);
+        }
+    }
+
+    private function fillQuestionLabelsSheet(Worksheet $sheet, Season $season): void
+    {
+        $sheet->fromArray(['Name', 'Colour', 'Slug'], null, 'A1');
+        $sheet->getStyle('1:1')->getFont()->setBold(true);
+
+        $row = 2;
+        foreach ($season->questionLabels as $label) {
+            $sheet->fromArray([$label->name, $label->colour->name, $label->slug], null, 'A'.$row);
+            ++$row;
+        }
+
+        foreach (['A', 'B', 'C'] as $column) {
+            $sheet->getColumnDimension($column)->setAutoSize(true);
+        }
+    }
+
+    /** @throws FilesystemException */
+    private function writeToTempFile(Spreadsheet $spreadsheet): string
+    {
+        $path = tempnam(sys_get_temp_dir(), 'tvdt_export_sheet_');
+
+        try {
+            new Writer\Xlsx($spreadsheet)->save($path);
+        } catch (\Throwable $throwable) {
+            unlink($path);
+
+            throw $throwable;
+        }
+
+        return $path;
+    }
+}

src/Service/QuizSpreadsheetService.php

@@ -7,6 +7,7 @@ namespace Tvdt\Service;
 use PhpOffice\PhpSpreadsheet\Cell\Coordinate;
 use PhpOffice\PhpSpreadsheet\Reader;
 use PhpOffice\PhpSpreadsheet\Spreadsheet;
+use PhpOffice\PhpSpreadsheet\Worksheet\Worksheet;
 use PhpOffice\PhpSpreadsheet\Writer;
 use Symfony\Component\HttpFoundation\File\File;
 use Tvdt\Entity\Answer;
@@ -117,8 +118,13 @@ class QuizSpreadsheetService
     public function quizToXlsx(Quiz $quiz): \Closure
     {
         $spreadsheet = new Spreadsheet();
-        $sheet = $spreadsheet->getActiveSheet();
+        $this->fillQuestionsSheet($spreadsheet->getActiveSheet(), $quiz);
 
+        return $this->toXlsx($spreadsheet);
+    }
+
+    public function fillQuestionsSheet(Worksheet $sheet, Quiz $quiz): void
+    {
         // Write data rows first so we know the maximum answer count.
         $maxAnswers = 0;
         $row = 2;
@@ -153,11 +159,9 @@ class QuizSpreadsheetService
             $sheet->setCellValue($correctCol.'1', 'Correct');
             $sheet->getColumnDimension($correctCol)->setAutoSize(true);
         }
-
-        return $this->toXlsx($spreadsheet);
     }
 
-    private function toXlsx(Spreadsheet $spreadsheet): \Closure
+    public function toXlsx(Spreadsheet $spreadsheet): \Closure
     {
         $writer = new Writer\Xlsx($spreadsheet);
 

templates/backoffice/settings/index.html.twig

@@ -55,14 +55,13 @@
                 {{ form(emailForm, {action: path('tvdt_backoffice_settings_email')}) }}
             </section>
 
-            <section class="mb-5" data-controller="bo--popover">
+            <section class="mb-5">
                 <h4>{{ 'Your data'|trans }}</h4>
-                <span class="d-inline-block" tabindex="0"
-                      data-bs-toggle="popover"
-                      data-bs-trigger="hover focus"
-                      data-bs-content="{{ 'Soon™'|trans }}">
-                    <button type="button" class="btn btn-secondary pe-none" disabled>{{ 'Download data'|trans }}</button>
-                </span>
+                <p>{{ 'Download an archive of everything stored under your account: your profile, the seasons you own, their quizzes, results and candidates.'|trans }}</p>
+                {% if not app.user.isVerified %}
+                    <p class="text-warning">{{ 'Confirm your email address to enable this feature.'|trans }}</p>
+                {% endif %}
+                <a class="btn btn-primary" href="{{ path('tvdt_backoffice_settings_download_data') }}">{{ 'Download data'|trans }}</a>
             </section>
 
             <section class="mb-5">

tests/Command/ClaimSeasonCommandTest.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace Tvdt\Tests\Command;
 
 use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
 use Symfony\Bundle\FrameworkBundle\Console\Application;
 use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
 use Symfony\Component\Console\Command\Command;
@@ -48,21 +49,19 @@ final class ClaimSeasonCommandTest extends KernelTestCase
         $this->assertCount(3, $season->owners);
     }
 
-    public function testInvalidEmailFails(): void
+    /** @return iterable<string, array{string, string}> */
+    public static function invalidArgumentsProvider(): iterable
     {
-        $this->commandTester->execute([
-            'season-code' => 'krtek',
-            'email' => 'nonexisting@example.org',
-        ]);
-
-        $this->assertSame(Command::FAILURE, $this->commandTester->getStatusCode());
+        yield 'unknown email' => ['krtek', 'nonexisting@example.org'];
+        yield 'unknown season' => ['dhadk', 'test@example.org'];
     }
 
-    public function testInvalidSeasonCodeFails(): void
+    #[DataProvider('invalidArgumentsProvider')]
+    public function testInvalidArgumentFails(string $seasonCode, string $email): void
     {
         $this->commandTester->execute([
-            'season-code' => 'dhadk',
-            'email' => 'test@example.org',
+            'season-code' => $seasonCode,
+            'email' => $email,
         ]);
 
         $this->assertSame(Command::FAILURE, $this->commandTester->getStatusCode());

tests/Controller/AbstractControllerWebTestCase.php

@@ -0,0 +1,100 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Controller;
+
+use Doctrine\ORM\EntityManagerInterface;
+use Symfony\Bundle\FrameworkBundle\KernelBrowser;
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+use Symfony\Component\DomCrawler\Crawler;
+use Symfony\Component\HttpFoundation\Request;
+use Tvdt\Entity\Candidate;
+use Tvdt\Entity\Quiz;
+use Tvdt\Entity\Season;
+use Tvdt\Entity\User;
+
+abstract class AbstractControllerWebTestCase extends WebTestCase
+{
+    protected KernelBrowser $client;
+
+    protected EntityManagerInterface $entityManager;
+
+    protected function setUp(): void
+    {
+        $this->client = self::createClient();
+        $this->entityManager = self::getContainer()->get(EntityManagerInterface::class);
+    }
+
+    protected function getUserByEmail(string $email): User
+    {
+        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => $email]);
+        $this->assertInstanceOf(User::class, $user);
+
+        return $user;
+    }
+
+    protected function loginAs(string $email): void
+    {
+        $this->client->loginUser($this->getUserByEmail($email));
+    }
+
+    protected function getQuizByName(string $name): Quiz
+    {
+        $quiz = $this->entityManager->getRepository(Quiz::class)->findOneBy(['name' => $name]);
+        $this->assertInstanceOf(Quiz::class, $quiz);
+
+        return $quiz;
+    }
+
+    protected function getCandidate(string $name): Candidate
+    {
+        $candidate = $this->entityManager->getRepository(Candidate::class)->findOneBy(['name' => $name]);
+        $this->assertInstanceOf(Candidate::class, $candidate);
+
+        return $candidate;
+    }
+
+    protected function getSeasonByCode(string $seasonCode): Season
+    {
+        $season = $this->entityManager->getRepository(Season::class)->findOneBy(['seasonCode' => $seasonCode]);
+        $this->assertInstanceOf(Season::class, $season);
+
+        return $season;
+    }
+
+    /** GETs $url and extracts the CSRF token from a form whose action contains $formActionContains. */
+    protected function getCsrfTokenFromPage(string $url, string $formActionContains, string $tokenFieldName = '_token'): string
+    {
+        $crawler = $this->client->request(Request::METHOD_GET, $url);
+        self::assertResponseIsSuccessful();
+
+        return $this->getCsrfTokenFromCrawler($crawler, $formActionContains, $tokenFieldName);
+    }
+
+    /** Extracts the CSRF token from a form on the page already loaded in the client. */
+    protected function getCsrfTokenFromCurrentPage(string $formActionContains, string $tokenFieldName = '_token'): string
+    {
+        return $this->getCsrfTokenFromCrawler($this->client->getCrawler(), $formActionContains, $tokenFieldName);
+    }
+
+    /** GETs $url and extracts the CSRF token input, regardless of which form it belongs to. */
+    protected function getTokenFromPage(string $url, string $tokenFieldName = '_token'): string
+    {
+        $crawler = $this->client->request(Request::METHOD_GET, $url);
+        self::assertResponseIsSuccessful();
+
+        $input = $crawler->filter(\sprintf('input[name="%s"]', $tokenFieldName));
+        $this->assertGreaterThan(0, $input->count(), \sprintf('No input named "%s" found on the page', $tokenFieldName));
+
+        return (string) $input->first()->attr('value');
+    }
+
+    private function getCsrfTokenFromCrawler(Crawler $crawler, string $formActionContains, string $tokenFieldName): string
+    {
+        $input = $crawler->filter(\sprintf('form[action*="%s"] input[name="%s"]', $formActionContains, $tokenFieldName));
+        $this->assertGreaterThan(0, $input->count(), \sprintf('No form found with action containing "%s"', $formActionContains));
+
+        return (string) $input->first()->attr('value');
+    }
+}

tests/Controller/Backoffice/BackofficeControllerTest.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Controller\Backoffice;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use Symfony\Component\HttpFoundation\Request;
+use Tvdt\Controller\Backoffice\BackofficeController;
+use Tvdt\Tests\Controller\AbstractControllerWebTestCase;
+
+#[CoversClass(BackofficeController::class)]
+final class BackofficeControllerTest extends AbstractControllerWebTestCase
+{
+    public function testExportQuizFilenameIsSanitized(): void
+    {
+        $user = $this->getUserByEmail('user2@example.org');
+        $user->isVerified = true;
+
+        $this->entityManager->flush();
+        $this->client->loginUser($user);
+
+        $quiz = $this->getQuizByName('Quiz 1');
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/quiz/%s/export', $quiz->id));
+
+        self::assertResponseIsSuccessful();
+        $disposition = (string) $this->client->getResponse()->headers->get('Content-Disposition');
+        $this->assertStringContainsString('filename=Quiz-1.xlsx', $disposition);
+        $this->assertStringNotContainsString('Quiz 1.xlsx', $disposition);
+    }
+
+    public function testExportQuizRequiresVerifiedEmail(): void
+    {
+        $user = $this->getUserByEmail('user2@example.org');
+        $this->assertFalse($user->isVerified);
+        $this->client->loginUser($user);
+
+        $quiz = $this->getQuizByName('Quiz 1');
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/quiz/%s/export', $quiz->id));
+
+        self::assertResponseRedirects(\sprintf('/backoffice/season/%s', $quiz->season->seasonCode));
+    }
+}

tests/Controller/Backoffice/PrepareEliminationControllerTest.php

@@ -0,0 +1,118 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Controller\Backoffice;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use Safe\DateTimeImmutable;
+use Symfony\Component\HttpFoundation\Request;
+use Tvdt\Controller\Backoffice\PrepareEliminationController;
+use Tvdt\Entity\Answer;
+use Tvdt\Entity\Elimination;
+use Tvdt\Entity\GivenAnswer;
+use Tvdt\Entity\Question;
+use Tvdt\Entity\QuizCandidate;
+use Tvdt\Tests\Controller\AbstractControllerWebTestCase;
+
+#[CoversClass(PrepareEliminationController::class)]
+final class PrepareEliminationControllerTest extends AbstractControllerWebTestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->loginAs('krtek-admin@example.org');
+    }
+
+    public function testIndexCreatesEliminationAndRedirectsToView(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $candidate = $this->getCandidate('Tom');
+
+        $quizCandidate = new QuizCandidate($quiz, $candidate);
+        $quizCandidate->started = new DateTimeImmutable();
+
+        $this->entityManager->persist($quizCandidate);
+
+        $firstQuestion = $quiz->questions->first();
+        $this->assertInstanceOf(Question::class, $firstQuestion);
+        $answer = $firstQuestion->answers->first();
+        $this->assertInstanceOf(Answer::class, $answer);
+        $this->entityManager->persist(new GivenAnswer($candidate, $quiz, $answer));
+        $this->entityManager->flush();
+
+        $token = $this->getCsrfTokenFromPage(\sprintf('/backoffice/season/krtek/quiz/%s/result', $quiz->id), '/elimination/prepare');
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/quiz/%s/elimination/prepare', $quiz->id), [
+            '_token' => $token,
+        ]);
+
+        $response = $this->client->getResponse();
+        $this->assertTrue($response->isRedirect());
+        $this->assertStringContainsString('/backoffice/elimination/', (string) $response->headers->get('Location'));
+
+        $elimination = $this->entityManager->getRepository(Elimination::class)->findOneBy(['quiz' => $quiz]);
+        $this->assertInstanceOf(Elimination::class, $elimination);
+        $this->assertArrayHasKey('Tom', $elimination->data);
+    }
+
+    public function testViewEliminationPageLoads(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $elimination = new Elimination($quiz);
+        $elimination->data = ['Tom' => Elimination::SCREEN_GREEN];
+
+        $this->entityManager->persist($elimination);
+        $this->entityManager->flush();
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/elimination/%s', $elimination->id));
+
+        self::assertResponseIsSuccessful();
+        self::assertSelectorExists('form');
+    }
+
+    public function testViewEliminationSavesUpdatedColours(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $elimination = new Elimination($quiz);
+        $elimination->data = ['Tom' => Elimination::SCREEN_GREEN];
+
+        $this->entityManager->persist($elimination);
+        $this->entityManager->flush();
+
+        $token = $this->getTokenFromPage(\sprintf('/backoffice/elimination/%s', $elimination->id));
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/elimination/%s', $elimination->id), [
+            '_token' => $token,
+            'colour-tom' => Elimination::SCREEN_RED,
+            'start' => '0',
+        ]);
+
+        self::assertResponseRedirects(\sprintf('/backoffice/elimination/%s', $elimination->id));
+        $this->entityManager->clear();
+
+        $updated = $this->entityManager->getRepository(Elimination::class)->find($elimination->id);
+        $this->assertInstanceOf(Elimination::class, $updated);
+        $this->assertSame(Elimination::SCREEN_RED, $updated->data['Tom']);
+    }
+
+    public function testViewEliminationWithStartRedirectsToPublicElimination(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $elimination = new Elimination($quiz);
+        $elimination->data = ['Tom' => Elimination::SCREEN_GREEN];
+
+        $this->entityManager->persist($elimination);
+        $this->entityManager->flush();
+
+        $token = $this->getTokenFromPage(\sprintf('/backoffice/elimination/%s', $elimination->id));
+
+        $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/elimination/%s', $elimination->id), [
+            '_token' => $token,
+            'start' => '1',
+        ]);
+
+        self::assertResponseRedirects(\sprintf('/elimination/%s', $elimination->id));
+    }
+}

tests/Controller/Backoffice/QuestionBankControllerTest.php

@@ -4,39 +4,18 @@ declare(strict_types=1);
 
 namespace Tvdt\Tests\Controller\Backoffice;
 
-use Doctrine\ORM\EntityManagerInterface;
 use PHPUnit\Framework\Attributes\CoversClass;
-use Symfony\Bundle\FrameworkBundle\KernelBrowser;
-use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
 use Symfony\Component\HttpFoundation\Request;
 use Tvdt\Controller\Backoffice\QuestionBankController;
 use Tvdt\Entity\BankAnswer;
 use Tvdt\Entity\BankQuestion;
 use Tvdt\Entity\Question;
 use Tvdt\Entity\QuestionLabel;
-use Tvdt\Entity\Quiz;
-use Tvdt\Entity\User;
+use Tvdt\Tests\Controller\AbstractControllerWebTestCase;
 
 #[CoversClass(QuestionBankController::class)]
-final class QuestionBankControllerTest extends WebTestCase
+final class QuestionBankControllerTest extends AbstractControllerWebTestCase
 {
-    private KernelBrowser $client;
-
-    private EntityManagerInterface $entityManager;
-
-    protected function setUp(): void
-    {
-        $this->client = self::createClient();
-        $this->entityManager = self::getContainer()->get(EntityManagerInterface::class);
-    }
-
-    private function loginAsOwner(): void
-    {
-        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'krtek-admin@example.org']);
-        $this->assertInstanceOf(User::class, $user);
-        $this->client->loginUser($user);
-    }
-
     private function getBankQuestion(string $question): BankQuestion
     {
         $bankQuestion = $this->entityManager->getRepository(BankQuestion::class)->findOneBy(['question' => $question]);
@@ -45,26 +24,9 @@ final class QuestionBankControllerTest extends WebTestCase
         return $bankQuestion;
     }
 
-    private function getQuizByName(string $name): Quiz
-    {
-        $quiz = $this->entityManager->getRepository(Quiz::class)->findOneBy(['name' => $name]);
-        $this->assertInstanceOf(Quiz::class, $quiz);
-
-        return $quiz;
-    }
-
-    private function getCsrfToken(string $formActionContains): string
-    {
-        $crawler = $this->client->getCrawler();
-        $input = $crawler->filter(\sprintf('form[action*="%s"] input[name="_token"]', $formActionContains));
-        $this->assertGreaterThan(0, $input->count(), \sprintf('No form found with action containing "%s"', $formActionContains));
-
-        return (string) $input->first()->attr('value');
-    }
-
     public function testIndexListsBankQuestions(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
 
         $this->assertResponseIsSuccessful();
@@ -75,7 +37,7 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testIndexFiltersByLabel(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $label = $this->entityManager->getRepository(QuestionLabel::class)->findOneBy(['name' => 'Locatie']);
         $this->assertInstanceOf(QuestionLabel::class, $label);
 
@@ -89,9 +51,7 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testNonOwnerIsDenied(): void
     {
-        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'test@example.org']);
-        $this->assertInstanceOf(User::class, $user);
-        $this->client->loginUser($user);
+        $this->loginAs('test@example.org');
 
         $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
 
@@ -100,7 +60,7 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testCreateBankQuestion(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $crawler = $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank/new');
         $this->assertResponseIsSuccessful();
 
@@ -129,7 +89,7 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testCreateAllowedWithoutCorrectAnswer(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $crawler = $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank/new');
         $token = (string) $crawler->filter('input[name="bank_question_form[_token]"]')->attr('value');
 
@@ -152,7 +112,7 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testEditBankQuestion(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $bankQuestion = $this->getBankQuestion('Wat at de Krtek als ontbijt?');
 
         $url = \sprintf('/backoffice/season/krtek/question-bank/%s/edit', $bankQuestion->id);
@@ -181,12 +141,12 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testDeleteUsedBankQuestionLeavesQuizIntact(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $bankQuestion = $this->getBankQuestion('Waar sliep de Krtek?');
         $quiz2QuestionCount = $this->getQuizByName('Quiz 2')->questions->count();
 
         $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
-        $token = $this->getCsrfToken(\sprintf('%s/delete', $bankQuestion->id));
+        $token = $this->getCsrfTokenFromCurrentPage(\sprintf('%s/delete', $bankQuestion->id));
 
         $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/question-bank/%s/delete', $bankQuestion->id), [
             '_token' => $token,
@@ -201,13 +161,13 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testAssignCopiesQuestionIntoQuiz(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $bankQuestion = $this->getBankQuestion('Wat at de Krtek als ontbijt?');
         $quiz = $this->getQuizByName('Quiz 2');
         $questionCount = $quiz->questions->count();
 
         $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
-        $token = $this->getCsrfToken(\sprintf('%s/assign', $bankQuestion->id));
+        $token = $this->getCsrfTokenFromCurrentPage(\sprintf('%s/assign', $bankQuestion->id));
 
         $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/question-bank/%s/assign', $bankQuestion->id), [
             '_token' => $token,
@@ -240,7 +200,7 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testAssignUsedNonReusableQuestionIsRefused(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $bankQuestion = $this->getBankQuestion('Waar sliep de Krtek?');
         $quiz = $this->getQuizByName('Quiz 2');
         $questionCount = $quiz->questions->count();
@@ -248,7 +208,7 @@ final class QuestionBankControllerTest extends WebTestCase
         $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
 
         // The assign form is not rendered for used questions, so post with another form's token
-        $token = $this->getCsrfToken('/assign');
+        $token = $this->getCsrfTokenFromCurrentPage('/assign');
         $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/question-bank/%s/assign', $bankQuestion->id), [
             '_token' => $token,
             'quiz' => (string) $quiz->id,
@@ -262,13 +222,13 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testAssignSameReusableQuestionTwiceToSameQuizIsRefused(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $bankQuestion = $this->getBankQuestion('Wie is de Krtek?');
         $quiz = $this->getQuizByName('Quiz 2');
         $questionCount = $quiz->questions->count();
 
         $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
-        $token = $this->getCsrfToken(\sprintf('%s/assign', $bankQuestion->id));
+        $token = $this->getCsrfTokenFromCurrentPage(\sprintf('%s/assign', $bankQuestion->id));
 
         $url = \sprintf('/backoffice/season/krtek/question-bank/%s/assign', $bankQuestion->id);
         $this->client->request(Request::METHOD_POST, $url, ['_token' => $token, 'quiz' => (string) $quiz->id]);
@@ -283,13 +243,13 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testAssignIntoFinalizedQuizIsDenied(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $bankQuestion = $this->getBankQuestion('Wie is de Krtek?');
         $finalizedQuiz = $this->getQuizByName('Quiz 1');
         $this->assertTrue($finalizedQuiz->isFinalized);
 
         $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
-        $token = $this->getCsrfToken(\sprintf('%s/assign', $bankQuestion->id));
+        $token = $this->getCsrfTokenFromCurrentPage(\sprintf('%s/assign', $bankQuestion->id));
 
         $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/question-bank/%s/assign', $bankQuestion->id), [
             '_token' => $token,
@@ -301,7 +261,7 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testCreateBankQuestionPreservesAnswerOrdering(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $crawler = $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank/new');
         $this->assertResponseIsSuccessful();
         $token = (string) $crawler->filter('input[name="bank_question_form[_token]"]')->attr('value');
@@ -334,7 +294,7 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testEditBankQuestionPreservesAnswerOrdering(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $bankQuestion = $this->getBankQuestion('Wat at de Krtek als ontbijt?');
         // Fixture answers in insertion order (all have ordering=0): Brood (correct), Yoghurt, Niks
 
@@ -374,7 +334,7 @@ final class QuestionBankControllerTest extends WebTestCase
 
     public function testAddAndDeleteLabel(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
         $crawler = $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
         $token = (string) $crawler->filter('form[action$="/question-bank/labels"] input[name="_token"]')->attr('value');
 
@@ -389,7 +349,7 @@ final class QuestionBankControllerTest extends WebTestCase
         $this->assertInstanceOf(QuestionLabel::class, $label);
 
         $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/question-bank');
-        $deleteToken = $this->getCsrfToken(\sprintf('labels/%s/delete', $label->slug));
+        $deleteToken = $this->getCsrfTokenFromCurrentPage(\sprintf('labels/%s/delete', $label->slug));
 
         $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/question-bank/labels/%s/delete', $label->slug), [
             '_token' => $deleteToken,

tests/Controller/Backoffice/QuizControllerTest.php

@@ -4,11 +4,8 @@ declare(strict_types=1);
 
 namespace Tvdt\Tests\Controller\Backoffice;
 
-use Doctrine\ORM\EntityManagerInterface;
 use PHPUnit\Framework\Attributes\CoversClass;
 use Safe\DateTimeImmutable;
-use Symfony\Bundle\FrameworkBundle\KernelBrowser;
-use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
 use Symfony\Component\HttpFoundation\Request;
 use Tvdt\Controller\Backoffice\QuizController;
 use Tvdt\Entity\Answer;
@@ -17,51 +14,21 @@ use Tvdt\Entity\GivenAnswer;
 use Tvdt\Entity\Question;
 use Tvdt\Entity\Quiz;
 use Tvdt\Entity\QuizCandidate;
-use Tvdt\Entity\Season;
-use Tvdt\Entity\User;
+use Tvdt\Tests\Controller\AbstractControllerWebTestCase;
 
 #[CoversClass(QuizController::class)]
-final class QuizControllerTest extends WebTestCase
+final class QuizControllerTest extends AbstractControllerWebTestCase
 {
-    private KernelBrowser $client;
-
-    private EntityManagerInterface $entityManager;
-
     protected function setUp(): void
     {
-        $this->client = self::createClient();
-        $this->entityManager = self::getContainer()->get(EntityManagerInterface::class);
+        parent::setUp();
 
-        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'krtek-admin@example.org']);
-        $this->assertInstanceOf(User::class, $user);
-        $this->client->loginUser($user);
-    }
-
-    private function getQuizByName(string $name): Quiz
-    {
-        $quiz = $this->entityManager->getRepository(Quiz::class)->findOneBy(['name' => $name]);
-        $this->assertInstanceOf(Quiz::class, $quiz);
-
-        return $quiz;
-    }
-
-    private function getCandidate(string $name): Candidate
-    {
-        $candidate = $this->entityManager->getRepository(Candidate::class)->findOneBy(['name' => $name]);
-        $this->assertInstanceOf(Candidate::class, $candidate);
-
-        return $candidate;
+        $this->loginAs('krtek-admin@example.org');
     }
 
     private function getCsrfTokenFromOverview(Quiz $quiz, string $formActionContains): string
     {
-        $crawler = $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/overview', $quiz->id));
-        self::assertResponseIsSuccessful();
-
-        $input = $crawler->filter(\sprintf('form[action*="%s"] input[name="_token"]', $formActionContains));
-        $this->assertGreaterThan(0, $input->count(), \sprintf('No form found with action containing "%s"', $formActionContains));
-
-        return (string) $input->first()->attr('value');
+        return $this->getCsrfTokenFromPage(\sprintf('/backoffice/season/krtek/quiz/%s/overview', $quiz->id), $formActionContains);
     }
 
     public function testIndexRedirectsToOverview(): void
@@ -296,9 +263,7 @@ final class QuizControllerTest extends WebTestCase
 
     public function testNonOwnerIsDenied(): void
     {
-        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'test@example.org']);
-        $this->assertInstanceOf(User::class, $user);
-        $this->client->loginUser($user);
+        $this->loginAs('test@example.org');
 
         $quiz = $this->getQuizByName('Quiz 1');
         $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/overview', $quiz->id));
@@ -308,8 +273,7 @@ final class QuizControllerTest extends WebTestCase
 
     public function testOverviewLoadsForEmptyQuiz(): void
     {
-        $season = $this->entityManager->getRepository(Season::class)->findOneBy(['seasonCode' => 'krtek']);
-        $this->assertInstanceOf(Season::class, $season);
+        $season = $this->getSeasonByCode('krtek');
 
         $emptyQuiz = new Quiz();
         $emptyQuiz->name = 'Empty Quiz';
@@ -326,8 +290,7 @@ final class QuizControllerTest extends WebTestCase
 
     public function testAnswerMappingRedirectsWithFlashWhenNoQuestions(): void
     {
-        $season = $this->entityManager->getRepository(Season::class)->findOneBy(['seasonCode' => 'krtek']);
-        $this->assertInstanceOf(Season::class, $season);
+        $season = $this->getSeasonByCode('krtek');
 
         $emptyQuiz = new Quiz();
         $emptyQuiz->name = 'Empty Quiz';

tests/Controller/Backoffice/QuizFinalizeTest.php

@@ -4,63 +4,29 @@ declare(strict_types=1);
 
 namespace Tvdt\Tests\Controller\Backoffice;
 
-use Doctrine\ORM\EntityManagerInterface;
 use PHPUnit\Framework\Attributes\CoversClass;
 use Safe\DateTimeImmutable;
-use Symfony\Bundle\FrameworkBundle\KernelBrowser;
-use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
 use Symfony\Component\HttpFoundation\Request;
 use Tvdt\Controller\Backoffice\QuizController;
 use Tvdt\Entity\Answer;
-use Tvdt\Entity\Candidate;
 use Tvdt\Entity\Question;
 use Tvdt\Entity\Quiz;
 use Tvdt\Entity\QuizCandidate;
-use Tvdt\Entity\Season;
-use Tvdt\Entity\User;
+use Tvdt\Tests\Controller\AbstractControllerWebTestCase;
 
 #[CoversClass(QuizController::class)]
-final class QuizFinalizeTest extends WebTestCase
+final class QuizFinalizeTest extends AbstractControllerWebTestCase
 {
-    private KernelBrowser $client;
-
-    private EntityManagerInterface $entityManager;
-
     protected function setUp(): void
     {
-        $this->client = self::createClient();
-        $this->entityManager = self::getContainer()->get(EntityManagerInterface::class);
+        parent::setUp();
 
-        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'krtek-admin@example.org']);
-        $this->assertInstanceOf(User::class, $user);
-        $this->client->loginUser($user);
-    }
-
-    private function getQuizByName(string $name): Quiz
-    {
-        $quiz = $this->entityManager->getRepository(Quiz::class)->findOneBy(['name' => $name]);
-        $this->assertInstanceOf(Quiz::class, $quiz);
-
-        return $quiz;
-    }
-
-    private function getKrtekSeason(): Season
-    {
-        $season = $this->entityManager->getRepository(Season::class)->findOneBy(['seasonCode' => 'krtek']);
-        $this->assertInstanceOf(Season::class, $season);
-
-        return $season;
+        $this->loginAs('krtek-admin@example.org');
     }
 
     private function getCsrfTokenFromOverview(Quiz $quiz, string $formActionContains): string
     {
-        $crawler = $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/krtek/quiz/%s/overview', $quiz->id));
-        $this->assertResponseIsSuccessful();
-
-        $input = $crawler->filter(\sprintf('form[action*="%s"] input[name="_token"]', $formActionContains));
-        $this->assertGreaterThan(0, $input->count(), \sprintf('No form found with action containing "%s"', $formActionContains));
-
-        return (string) $input->first()->attr('value');
+        return $this->getCsrfTokenFromPage(\sprintf('/backoffice/season/krtek/quiz/%s/overview', $quiz->id), $formActionContains);
     }
 
     public function testFinalizeSetsFinalizedAt(): void
@@ -79,7 +45,7 @@ final class QuizFinalizeTest extends WebTestCase
 
     public function testFinalizeRefusedWhenQuizHasErrors(): void
     {
-        $season = $this->getKrtekSeason();
+        $season = $this->getSeasonByCode('krtek');
 
         $invalidQuiz = new Quiz();
         $invalidQuiz->name = 'Invalid Quiz';
@@ -116,7 +82,7 @@ final class QuizFinalizeTest extends WebTestCase
         $this->assertResponseRedirects();
 
         $this->entityManager->clear();
-        $season = $this->getKrtekSeason();
+        $season = $this->getSeasonByCode('krtek');
         $this->assertInstanceOf(Quiz::class, $season->activeQuiz);
         $this->assertSame('Quiz 1', $season->activeQuiz->name);
     }
@@ -134,7 +100,7 @@ final class QuizFinalizeTest extends WebTestCase
         $this->assertResponseRedirects();
 
         $this->entityManager->clear();
-        $season = $this->getKrtekSeason();
+        $season = $this->getSeasonByCode('krtek');
         $this->assertInstanceOf(Quiz::class, $season->activeQuiz);
         $this->assertSame('Quiz 2', $season->activeQuiz->name);
     }
@@ -183,8 +149,7 @@ final class QuizFinalizeTest extends WebTestCase
         // Scrape the token before a candidate starts, since the button disappears afterwards
         $token = $this->getCsrfTokenFromOverview($quiz, '/unfinalize');
 
-        $candidate = $this->entityManager->getRepository(Candidate::class)->findOneBy(['name' => 'Tom']);
-        $this->assertInstanceOf(Candidate::class, $candidate);
+        $candidate = $this->getCandidate('Tom');
         $quizCandidate = new QuizCandidate($quiz, $candidate);
         $quizCandidate->started = new DateTimeImmutable();
 
@@ -229,6 +194,6 @@ final class QuizFinalizeTest extends WebTestCase
         self::assertResponseRedirects(\sprintf('/backoffice/season/krtek/quiz/%s/overview', $quiz2->id));
 
         $this->entityManager->clear();
-        $this->assertNotInstanceOf(Quiz::class, $this->getKrtekSeason()->activeQuiz);
+        $this->assertNotInstanceOf(Quiz::class, $this->getSeasonByCode('krtek')->activeQuiz);
     }
 }

tests/Controller/Backoffice/QuizQuestionControllerTest.php

@@ -4,47 +4,18 @@ declare(strict_types=1);
 
 namespace Tvdt\Tests\Controller\Backoffice;
 
-use Doctrine\ORM\EntityManagerInterface;
 use PHPUnit\Framework\Attributes\CoversClass;
-use Symfony\Bundle\FrameworkBundle\KernelBrowser;
-use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
 use Symfony\Component\HttpFoundation\Request;
 use Tvdt\Controller\Backoffice\QuizQuestionController;
 use Tvdt\Entity\Question;
-use Tvdt\Entity\Quiz;
-use Tvdt\Entity\User;
+use Tvdt\Tests\Controller\AbstractControllerWebTestCase;
 
 #[CoversClass(QuizQuestionController::class)]
-final class QuizQuestionControllerTest extends WebTestCase
+final class QuizQuestionControllerTest extends AbstractControllerWebTestCase
 {
-    private KernelBrowser $client;
-
-    private EntityManagerInterface $entityManager;
-
-    protected function setUp(): void
-    {
-        $this->client = self::createClient();
-        $this->entityManager = self::getContainer()->get(EntityManagerInterface::class);
-    }
-
-    private function loginAsOwner(): void
-    {
-        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'krtek-admin@example.org']);
-        $this->assertInstanceOf(User::class, $user);
-        $this->client->loginUser($user);
-    }
-
-    private function getQuizByName(string $name): Quiz
-    {
-        $quiz = $this->entityManager->getRepository(Quiz::class)->findOneBy(['name' => $name]);
-        $this->assertInstanceOf(Quiz::class, $quiz);
-
-        return $quiz;
-    }
-
     public function testEditPreservesAnswerOrdering(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
 
         $quiz = $this->getQuizByName('Quiz 2');
         $question = null;
@@ -111,7 +82,7 @@ final class QuizQuestionControllerTest extends WebTestCase
 
     public function testReorderQuestionsWithinQuiz(): void
     {
-        $this->loginAsOwner();
+        $this->loginAs('krtek-admin@example.org');
 
         $quiz = $this->getQuizByName('Quiz 2');
         $originalQuestions = $quiz->questions->toArray();

tests/Controller/Backoffice/SeasonControllerTest.php

@@ -4,40 +4,27 @@ declare(strict_types=1);
 
 namespace Tvdt\Tests\Controller\Backoffice;
 
-use Doctrine\ORM\EntityManagerInterface;
 use PHPUnit\Framework\Attributes\CoversClass;
-use Symfony\Bundle\FrameworkBundle\KernelBrowser;
-use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
 use Symfony\Component\HttpFoundation\Request;
 use Tvdt\Controller\Backoffice\SeasonController;
 use Tvdt\Entity\Candidate;
 use Tvdt\Entity\Season;
-use Tvdt\Entity\User;
+use Tvdt\Tests\Controller\AbstractControllerWebTestCase;
 
 #[CoversClass(SeasonController::class)]
-final class SeasonControllerTest extends WebTestCase
+final class SeasonControllerTest extends AbstractControllerWebTestCase
 {
-    private KernelBrowser $client;
-
-    private EntityManagerInterface $entityManager;
-
     protected function setUp(): void
     {
-        $this->client = self::createClient();
-        $this->entityManager = self::getContainer()->get(EntityManagerInterface::class);
+        parent::setUp();
 
-        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'krtek-admin@example.org']);
-        $this->assertInstanceOf(User::class, $user);
-        $this->client->loginUser($user);
+        $this->loginAs('krtek-admin@example.org');
     }
 
     public function testRegenerateSeasonCodeChangesTheCode(): void
     {
         $oldCode = 'krtek';
-        $crawler = $this->client->request(Request::METHOD_GET, \sprintf('/backoffice/season/%s/settings', $oldCode));
-        self::assertResponseIsSuccessful();
-
-        $token = (string) $crawler->filter('form[action*="/regenerate-code"] input[name="_token"]')->first()->attr('value');
+        $token = $this->getCsrfTokenFromPage(\sprintf('/backoffice/season/%s/settings', $oldCode), '/regenerate-code');
 
         $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/%s/settings/regenerate-code', $oldCode), [
             '_token' => $token,
@@ -54,13 +41,9 @@ final class SeasonControllerTest extends WebTestCase
 
     public function testRegenerateSeasonCodeIsDeniedForNonOwner(): void
     {
-        $crawler = $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/settings');
-        self::assertResponseIsSuccessful();
-        $token = (string) $crawler->filter('form[action*="/regenerate-code"] input[name="_token"]')->first()->attr('value');
+        $token = $this->getCsrfTokenFromPage('/backoffice/season/krtek/settings', '/regenerate-code');
 
-        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'test@example.org']);
-        $this->assertInstanceOf(User::class, $user);
-        $this->client->loginUser($user);
+        $this->loginAs('test@example.org');
 
         $this->client->request(Request::METHOD_POST, '/backoffice/season/krtek/settings/regenerate-code', [
             '_token' => $token,
@@ -69,29 +52,10 @@ final class SeasonControllerTest extends WebTestCase
         self::assertResponseStatusCodeSame(403);
     }
 
-    private function getCandidate(string $name): Candidate
-    {
-        $candidate = $this->entityManager->getRepository(Candidate::class)->findOneBy(['name' => $name]);
-        $this->assertInstanceOf(Candidate::class, $candidate);
-
-        return $candidate;
-    }
-
-    private function getCsrfTokenFromCandidatesTab(string $formActionContains): string
-    {
-        $crawler = $this->client->request(Request::METHOD_GET, '/backoffice/season/krtek/candidates');
-        self::assertResponseIsSuccessful();
-
-        $input = $crawler->filter(\sprintf('form[action*="%s"] input[name="_token"]', $formActionContains));
-        $this->assertGreaterThan(0, $input->count(), \sprintf('No form found with action containing "%s"', $formActionContains));
-
-        return (string) $input->first()->attr('value');
-    }
-
     public function testRenameCandidate(): void
     {
         $candidate = $this->getCandidate('Tom');
-        $token = $this->getCsrfTokenFromCandidatesTab(\sprintf('/candidate/%s/rename', $candidate->id));
+        $token = $this->getCsrfTokenFromPage('/backoffice/season/krtek/candidates', \sprintf('/candidate/%s/rename', $candidate->id));
 
         $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/candidate/%s/rename', $candidate->id), [
             '_token' => $token,
@@ -109,7 +73,7 @@ final class SeasonControllerTest extends WebTestCase
     public function testRenameCandidateToExistingNameShowsError(): void
     {
         $candidate = $this->getCandidate('Tom');
-        $token = $this->getCsrfTokenFromCandidatesTab(\sprintf('/candidate/%s/rename', $candidate->id));
+        $token = $this->getCsrfTokenFromPage('/backoffice/season/krtek/candidates', \sprintf('/candidate/%s/rename', $candidate->id));
 
         $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/candidate/%s/rename', $candidate->id), [
             '_token' => $token,
@@ -128,7 +92,7 @@ final class SeasonControllerTest extends WebTestCase
     {
         $candidate = $this->getCandidate('Tom');
         $candidateId = $candidate->id;
-        $token = $this->getCsrfTokenFromCandidatesTab(\sprintf('/candidate/%s/delete', $candidate->id));
+        $token = $this->getCsrfTokenFromPage('/backoffice/season/krtek/candidates', \sprintf('/candidate/%s/delete', $candidate->id));
 
         $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/candidate/%s/delete', $candidate->id), [
             '_token' => $token,
@@ -143,11 +107,9 @@ final class SeasonControllerTest extends WebTestCase
     public function testRenameCandidateIsDeniedForNonOwner(): void
     {
         $candidate = $this->getCandidate('Tom');
-        $token = $this->getCsrfTokenFromCandidatesTab(\sprintf('/candidate/%s/rename', $candidate->id));
+        $token = $this->getCsrfTokenFromPage('/backoffice/season/krtek/candidates', \sprintf('/candidate/%s/rename', $candidate->id));
 
-        $user = $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'test@example.org']);
-        $this->assertInstanceOf(User::class, $user);
-        $this->client->loginUser($user);
+        $this->loginAs('test@example.org');
 
         $this->client->request(Request::METHOD_POST, \sprintf('/backoffice/season/krtek/candidate/%s/rename', $candidate->id), [
             '_token' => $token,

tests/Controller/Backoffice/SettingsControllerTest.php

@@ -4,11 +4,9 @@ declare(strict_types=1);
 
 namespace Tvdt\Tests\Controller\Backoffice;
 
-use Doctrine\ORM\EntityManagerInterface;
 use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
 use Safe\DateTimeImmutable;
-use Symfony\Bundle\FrameworkBundle\KernelBrowser;
-use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
 use Tvdt\Controller\Backoffice\SettingsController;
@@ -17,43 +15,21 @@ use Tvdt\Entity\Quiz;
 use Tvdt\Entity\ResetPasswordRequest;
 use Tvdt\Entity\Season;
 use Tvdt\Entity\User;
+use Tvdt\Tests\Controller\AbstractControllerWebTestCase;
 
 #[CoversClass(SettingsController::class)]
-final class SettingsControllerTest extends WebTestCase
+final class SettingsControllerTest extends AbstractControllerWebTestCase
 {
-    private KernelBrowser $client;
-
-    private EntityManagerInterface $entityManager;
-
     protected function setUp(): void
     {
-        $this->client = self::createClient();
-        $this->entityManager = self::getContainer()->get(EntityManagerInterface::class);
+        parent::setUp();
 
         $this->loginAs('test@example.org');
     }
 
-    private function loginAs(string $email): void
-    {
-        $user = $this->getUserByEmail($email);
-        $this->assertInstanceOf(User::class, $user);
-        $this->client->loginUser($user);
-    }
-
-    private function getUserByEmail(string $email): ?User
-    {
-        return $this->entityManager->getRepository(User::class)->findOneBy(['email' => $email]);
-    }
-
     private function getCsrfTokenFromSettings(string $formActionContains): string
     {
-        $crawler = $this->client->request(Request::METHOD_GET, '/backoffice/settings');
-        self::assertResponseIsSuccessful();
-
-        $input = $crawler->filter(\sprintf('form[action*="%s"] input[name="_token"]', $formActionContains));
-        $this->assertGreaterThan(0, $input->count(), \sprintf('No form found with action containing "%s"', $formActionContains));
-
-        return (string) $input->first()->attr('value');
+        return $this->getCsrfTokenFromPage('/backoffice/settings', $formActionContains);
     }
 
     public function testSettingsPageLoadsAndNavContainsSettingsLink(): void
@@ -98,7 +74,6 @@ final class SettingsControllerTest extends WebTestCase
         $this->entityManager->clear();
 
         $user = $this->getUserByEmail('test@example.org');
-        $this->assertInstanceOf(User::class, $user);
         $hasher = self::getContainer()->get(UserPasswordHasherInterface::class);
         $this->assertTrue($hasher->isPasswordValid($user, 'NewPass123!'));
 
@@ -107,32 +82,21 @@ final class SettingsControllerTest extends WebTestCase
         self::assertResponseIsSuccessful();
     }
 
-    public function testChangePasswordWithWrongCurrentPasswordIsRejected(): void
+    /** @return iterable<string, array{string, string, string}> */
+    public static function invalidPasswordChangeProvider(): iterable
     {
-        $this->client->request(Request::METHOD_GET, '/backoffice/settings');
-        $form = $this->client->getCrawler()->filter('form[action*="/backoffice/settings/password"]')->form([
-            'change_user_password_form[currentPassword]' => 'wrong-password',
-            'change_user_password_form[plainPassword][first]' => 'NewPass123!',
-            'change_user_password_form[plainPassword][second]' => 'NewPass123!',
-        ]);
-        $this->client->submit($form);
-
-        self::assertResponseStatusCodeSame(422);
-        $this->entityManager->clear();
-
-        $user = $this->getUserByEmail('test@example.org');
-        $this->assertInstanceOf(User::class, $user);
-        $hasher = self::getContainer()->get(UserPasswordHasherInterface::class);
-        $this->assertTrue($hasher->isPasswordValid($user, TestFixtures::PASSWORD));
+        yield 'wrong current password' => ['wrong-password', 'NewPass123!', 'NewPass123!'];
+        yield 'mismatched repeat' => [TestFixtures::PASSWORD, 'NewPass123!', 'SomethingElse!'];
     }
 
-    public function testChangePasswordWithMismatchedRepeatIsRejected(): void
+    #[DataProvider('invalidPasswordChangeProvider')]
+    public function testChangePasswordIsRejected(string $currentPassword, string $first, string $second): void
     {
         $this->client->request(Request::METHOD_GET, '/backoffice/settings');
         $form = $this->client->getCrawler()->filter('form[action*="/backoffice/settings/password"]')->form([
-            'change_user_password_form[currentPassword]' => TestFixtures::PASSWORD,
-            'change_user_password_form[plainPassword][first]' => 'NewPass123!',
-            'change_user_password_form[plainPassword][second]' => 'SomethingElse!',
+            'change_user_password_form[currentPassword]' => $currentPassword,
+            'change_user_password_form[plainPassword][first]' => $first,
+            'change_user_password_form[plainPassword][second]' => $second,
         ]);
         $this->client->submit($form);
 
@@ -140,7 +104,6 @@ final class SettingsControllerTest extends WebTestCase
         $this->entityManager->clear();
 
         $user = $this->getUserByEmail('test@example.org');
-        $this->assertInstanceOf(User::class, $user);
         $hasher = self::getContainer()->get(UserPasswordHasherInterface::class);
         $this->assertTrue($hasher->isPasswordValid($user, TestFixtures::PASSWORD));
     }
@@ -157,9 +120,8 @@ final class SettingsControllerTest extends WebTestCase
         self::assertEmailCount(1);
         $this->entityManager->clear();
 
-        $this->assertNotInstanceOf(User::class, $this->getUserByEmail('test@example.org'));
+        $this->assertNotInstanceOf(User::class, $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'test@example.org']));
         $user = $this->getUserByEmail('new-address@example.org');
-        $this->assertInstanceOf(User::class, $user);
         $this->assertFalse($user->isVerified);
 
         // User stays logged in
@@ -179,7 +141,7 @@ final class SettingsControllerTest extends WebTestCase
         self::assertEmailCount(0);
         $this->entityManager->clear();
 
-        $this->assertInstanceOf(User::class, $this->getUserByEmail('test@example.org'));
+        $this->getUserByEmail('test@example.org');
     }
 
     public function testResendConfirmationEmailSendsEmail(): void
@@ -200,8 +162,8 @@ final class SettingsControllerTest extends WebTestCase
         $token = $this->getCsrfTokenFromSettings('/backoffice/settings/resend-confirmation');
 
         $user = $this->getUserByEmail('test@example.org');
-        $this->assertInstanceOf(User::class, $user);
         $user->isVerified = true;
+
         $this->entityManager->flush();
 
         $crawler = $this->client->request(Request::METHOD_GET, '/backoffice/settings');
@@ -242,7 +204,6 @@ final class SettingsControllerTest extends WebTestCase
     public function testChangePasswordInvalidatesResetPasswordRequests(): void
     {
         $user = $this->getUserByEmail('test@example.org');
-        $this->assertInstanceOf(User::class, $user);
         $this->createResetPasswordRequest($user);
 
         $this->client->request(Request::METHOD_GET, '/backoffice/settings');
@@ -257,14 +218,12 @@ final class SettingsControllerTest extends WebTestCase
         $this->entityManager->clear();
 
         $user = $this->getUserByEmail('test@example.org');
-        $this->assertInstanceOf(User::class, $user);
         $this->assertSame(0, $this->entityManager->getRepository(ResetPasswordRequest::class)->count(['user' => $user]));
     }
 
     public function testChangeEmailInvalidatesResetPasswordRequests(): void
     {
         $user = $this->getUserByEmail('test@example.org');
-        $this->assertInstanceOf(User::class, $user);
         $this->createResetPasswordRequest($user);
 
         $this->client->request(Request::METHOD_GET, '/backoffice/settings');
@@ -277,7 +236,6 @@ final class SettingsControllerTest extends WebTestCase
         $this->entityManager->clear();
 
         $user = $this->getUserByEmail('new-address@example.org');
-        $this->assertInstanceOf(User::class, $user);
         $this->assertSame(0, $this->entityManager->getRepository(ResetPasswordRequest::class)->count(['user' => $user]));
     }
 
@@ -293,7 +251,7 @@ final class SettingsControllerTest extends WebTestCase
         self::assertResponseRedirects('/backoffice/settings');
         $this->entityManager->clear();
 
-        $this->assertInstanceOf(User::class, $this->getUserByEmail('test@example.org'));
+        $this->getUserByEmail('test@example.org');
     }
 
     public function testDeleteAccountRemovesSoleOwnerSeasonsAndKeepsSharedSeasons(): void
@@ -309,7 +267,7 @@ final class SettingsControllerTest extends WebTestCase
         self::assertResponseRedirects();
         $this->entityManager->clear();
 
-        $this->assertNotInstanceOf(User::class, $this->getUserByEmail('sole-owner@example.org'));
+        $this->assertNotInstanceOf(User::class, $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'sole-owner@example.org']));
 
         // Sole-owner season is removed, including its quiz
         $this->assertNotInstanceOf(Season::class, $this->entityManager->getRepository(Season::class)->findOneBy(['seasonCode' => 'doomd']));
@@ -340,7 +298,7 @@ final class SettingsControllerTest extends WebTestCase
         self::assertResponseRedirects();
         $this->entityManager->clear();
 
-        $this->assertNotInstanceOf(User::class, $this->getUserByEmail('user2@example.org'));
+        $this->assertNotInstanceOf(User::class, $this->entityManager->getRepository(User::class)->findOneBy(['email' => 'user2@example.org']));
 
         foreach (['krtek', 'bbbbb'] as $seasonCode) {
             $season = $this->entityManager->getRepository(Season::class)->findOneBy(['seasonCode' => $seasonCode]);
@@ -350,4 +308,46 @@ final class SettingsControllerTest extends WebTestCase
             $this->assertNotEmpty($ownerEmails);
         }
     }
+
+    public function testDownloadDataRequiresAuthentication(): void
+    {
+        $this->client->restart();
+        $this->client->request(Request::METHOD_GET, '/backoffice/settings/download-data');
+
+        self::assertResponseRedirects();
+    }
+
+    public function testDownloadDataReturnsAZipWithATimestampedAccountFilename(): void
+    {
+        $this->markUserVerified('test@example.org');
+
+        $this->client->request(Request::METHOD_GET, '/backoffice/settings/download-data');
+
+        self::assertResponseIsSuccessful();
+        self::assertResponseHeaderSame('Content-Type', 'application/zip');
+
+        $disposition = (string) $this->client->getResponse()->headers->get('Content-Disposition');
+        $this->assertMatchesRegularExpression(
+            '/filename=tijd-voor-de-test-data-test-example-org-\d{4}-\d{2}-\d{2}_\d{2}-\d{2}-\d{2}\.zip/',
+            $disposition,
+        );
+    }
+
+    public function testDownloadDataRequiresVerifiedEmail(): void
+    {
+        $user = $this->getUserByEmail('test@example.org');
+        $this->assertFalse($user->isVerified);
+
+        $this->client->request(Request::METHOD_GET, '/backoffice/settings/download-data');
+
+        self::assertResponseRedirects('/backoffice/settings');
+    }
+
+    private function markUserVerified(string $email): void
+    {
+        $user = $this->getUserByEmail($email);
+        $user->isVerified = true;
+
+        $this->entityManager->flush();
+    }
 }

tests/Controller/EliminationControllerTest.php

@@ -0,0 +1,86 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Controller;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use Symfony\Component\HttpFoundation\Request;
+use Tvdt\Controller\EliminationController;
+use Tvdt\Entity\Elimination;
+use Tvdt\Helpers\Base64;
+
+#[CoversClass(EliminationController::class)]
+final class EliminationControllerTest extends AbstractControllerWebTestCase
+{
+    private Elimination $elimination;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $quiz = $this->getQuizByName('Quiz 1');
+
+        $this->elimination = new Elimination($quiz);
+        $this->elimination->data = ['Tom' => Elimination::SCREEN_GREEN];
+
+        $this->entityManager->persist($this->elimination);
+        $this->entityManager->flush();
+
+        $this->loginAs('krtek-admin@example.org');
+    }
+
+    public function testIndexIsDeniedForNonOwner(): void
+    {
+        $this->loginAs('test@example.org');
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/elimination/%s', $this->elimination->id));
+
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    public function testIndexPageLoads(): void
+    {
+        $this->client->request(Request::METHOD_GET, \sprintf('/elimination/%s', $this->elimination->id));
+
+        self::assertResponseIsSuccessful();
+        self::assertSelectorExists('form');
+    }
+
+    public function testIndexRedirectsToCandidateScreen(): void
+    {
+        $crawler = $this->client->request(Request::METHOD_GET, \sprintf('/elimination/%s', $this->elimination->id));
+        $form = $crawler->filter('form')->form([
+            'elimination_enter_name[name]' => 'Tom',
+        ]);
+        $this->client->submit($form);
+
+        self::assertResponseRedirects(\sprintf('/elimination/%s/%s', $this->elimination->id, Base64::base64UrlEncode('Tom')));
+    }
+
+    public function testCandidateScreenUnknownCandidateRedirectsWithFlash(): void
+    {
+        $this->client->request(Request::METHOD_GET, \sprintf('/elimination/%s/%s', $this->elimination->id, Base64::base64UrlEncode('Nobody')));
+
+        self::assertResponseRedirects(\sprintf('/elimination/%s', $this->elimination->id));
+        $this->client->followRedirect();
+        self::assertSelectorTextContains('body', 'Kon kandidaat met naam Nobody niet vinden');
+    }
+
+    public function testCandidateScreenCandidateNotInEliminationDataRedirectsWithFlash(): void
+    {
+        $this->client->request(Request::METHOD_GET, \sprintf('/elimination/%s/%s', $this->elimination->id, Base64::base64UrlEncode('Claudia')));
+
+        self::assertResponseRedirects(\sprintf('/elimination/%s', $this->elimination->id));
+        $this->client->followRedirect();
+        self::assertSelectorTextContains('body', 'Kon geen kandidaat vinden met de naam Claudia in de eliminatie');
+    }
+
+    public function testCandidateScreenRendersColour(): void
+    {
+        $this->client->request(Request::METHOD_GET, \sprintf('/elimination/%s/%s', $this->elimination->id, Base64::base64UrlEncode('Tom')));
+
+        self::assertResponseIsSuccessful();
+        self::assertSelectorExists(\sprintf('#%s', Elimination::SCREEN_GREEN));
+    }
+}

tests/Controller/LoginControllerTest.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Controller;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use Symfony\Component\HttpFoundation\Request;
+use Tvdt\Controller\LoginController;
+
+#[CoversClass(LoginController::class)]
+final class LoginControllerTest extends AbstractControllerWebTestCase
+{
+    public function testLoginPageLoadsWhenNotAuthenticated(): void
+    {
+        $this->client->request(Request::METHOD_GET, '/login');
+
+        self::assertResponseIsSuccessful();
+        self::assertSelectorExists('form');
+    }
+
+    public function testLoginRedirectsToBackofficeWhenAlreadyAuthenticated(): void
+    {
+        $this->loginAs('test@example.org');
+
+        $this->client->request(Request::METHOD_GET, '/login');
+
+        self::assertResponseRedirects('/backoffice/');
+    }
+
+    public function testLoginWithInvalidCredentialsShowsFlash(): void
+    {
+        $this->client->request(Request::METHOD_GET, '/login');
+        $form = $this->client->getCrawler()->filter('form')->form([
+            '_username' => 'test@example.org',
+            '_password' => 'wrong-password',
+        ]);
+        $this->client->submit($form);
+
+        self::assertResponseRedirects('/login');
+        $this->client->followRedirect();
+        self::assertSelectorTextContains('body', 'Ongeldige inloggegevens.');
+    }
+
+    public function testLogoutIsInterceptedByFirewall(): void
+    {
+        $this->loginAs('test@example.org');
+
+        $this->client->request(Request::METHOD_GET, '/logout');
+
+        self::assertResponseRedirects();
+    }
+}

tests/Controller/QuizControllerTest.php

@@ -0,0 +1,209 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Controller;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use Symfony\Component\HttpFoundation\Request;
+use Tvdt\Controller\QuizController;
+use Tvdt\Entity\Answer;
+use Tvdt\Entity\Candidate;
+use Tvdt\Entity\GivenAnswer;
+use Tvdt\Entity\Question;
+use Tvdt\Entity\QuizCandidate;
+use Tvdt\Helpers\Base64;
+
+#[CoversClass(QuizController::class)]
+final class QuizControllerTest extends AbstractControllerWebTestCase
+{
+    private function answerQuestion(Question $question): void
+    {
+        $tomHash = Base64::base64UrlEncode('Tom');
+        $url = \sprintf('/krtek/%s', $tomHash);
+
+        $crawler = $this->client->request(Request::METHOD_GET, $url);
+        self::assertResponseIsSuccessful();
+        $token = (string) $crawler->filter('input[name="token"]')->first()->attr('value');
+
+        $answer = $question->answers->first();
+        $this->assertInstanceOf(Answer::class, $answer);
+
+        $this->client->request(Request::METHOD_POST, $url, [
+            'token' => $token,
+            'answer' => (string) $answer->id,
+        ]);
+
+        self::assertResponseRedirects($url);
+    }
+
+    public function testSelectSeasonPageLoads(): void
+    {
+        $this->client->request(Request::METHOD_GET, '/');
+
+        self::assertResponseIsSuccessful();
+        self::assertSelectorExists('form');
+    }
+
+    public function testSelectSeasonWithInvalidCodeRedirectsWithFlash(): void
+    {
+        $crawler = $this->client->request(Request::METHOD_GET, '/');
+        $form = $crawler->filter('form')->form([
+            'select_season[season_code]' => 'aaaaa',
+        ]);
+        $this->client->submit($form);
+
+        self::assertResponseRedirects('/');
+        $this->client->followRedirect();
+        self::assertSelectorTextContains('body', 'Ongeldige seizoencode');
+    }
+
+    public function testSelectSeasonWithValidCodeRedirectsToEnterName(): void
+    {
+        $crawler = $this->client->request(Request::METHOD_GET, '/');
+        $form = $crawler->filter('form')->form([
+            'select_season[season_code]' => 'krtek',
+        ]);
+        $this->client->submit($form);
+
+        self::assertResponseRedirects('/krtek');
+    }
+
+    public function testEnterNamePageLoads(): void
+    {
+        $this->client->request(Request::METHOD_GET, '/krtek');
+
+        self::assertResponseIsSuccessful();
+        self::assertSelectorExists('form');
+    }
+
+    public function testEnterNameRedirectsToQuizPage(): void
+    {
+        $crawler = $this->client->request(Request::METHOD_GET, '/krtek');
+        $form = $crawler->filter('form')->form([
+            'enter_name[name]' => 'Tom',
+        ]);
+        $this->client->submit($form);
+
+        self::assertResponseRedirects(\sprintf('/krtek/%s', Base64::base64UrlEncode('Tom')));
+    }
+
+    public function testQuizPageUnknownCandidateRedirectsWithFlash(): void
+    {
+        $this->client->request(Request::METHOD_GET, \sprintf('/krtek/%s', Base64::base64UrlEncode('Nobody')));
+
+        self::assertResponseRedirects('/krtek');
+        $this->client->followRedirect();
+        self::assertSelectorTextContains('body', 'Kandidaat niet gevonden');
+    }
+
+    public function testQuizPageWithoutActiveQuizRedirectsWithFlash(): void
+    {
+        $season = $this->getSeasonByCode('bbbbb');
+        $season->addCandidate(new Candidate('Nienke'));
+
+        $this->entityManager->flush();
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/bbbbb/%s', Base64::base64UrlEncode('Nienke')));
+
+        self::assertResponseRedirects('/bbbbb');
+        $this->client->followRedirect();
+        self::assertSelectorTextContains('body', 'Er is geen test actief');
+    }
+
+    public function testQuizPageRendersFirstQuestion(): void
+    {
+        $this->client->request(Request::METHOD_GET, \sprintf('/krtek/%s', Base64::base64UrlEncode('Tom')));
+
+        self::assertResponseIsSuccessful();
+        self::assertSelectorTextContains('body', 'Is de Krtek een man of een vrouw?');
+    }
+
+    public function testQuizPageAnsweringPersistsGivenAnswerAndRedirects(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $firstQuestion = $quiz->questions->first();
+        $this->assertInstanceOf(Question::class, $firstQuestion);
+        $answer = $firstQuestion->answers->first();
+        $this->assertInstanceOf(Answer::class, $answer);
+
+        $this->answerQuestion($firstQuestion);
+        $this->entityManager->clear();
+
+        $candidate = $this->getCandidate('Tom');
+        $givenAnswer = $this->entityManager->getRepository(GivenAnswer::class)->findOneBy(['candidate' => $candidate]);
+        $this->assertInstanceOf(GivenAnswer::class, $givenAnswer);
+        $this->assertTrue($answer->id->equals($givenAnswer->answer->id));
+    }
+
+    public function testQuizPageInvalidAnswerIdShowsFlash(): void
+    {
+        $url = \sprintf('/krtek/%s', Base64::base64UrlEncode('Tom'));
+        $crawler = $this->client->request(Request::METHOD_GET, $url);
+        $token = (string) $crawler->filter('input[name="token"]')->first()->attr('value');
+
+        $this->client->request(Request::METHOD_POST, $url, [
+            'token' => $token,
+            'answer' => '00000000-0000-0000-0000-000000000000',
+        ]);
+
+        self::assertResponseRedirects($url);
+        $this->client->followRedirect();
+        self::assertSelectorTextContains('body', 'Selecteer een antwoorden alsjeblieft');
+    }
+
+    public function testQuizPageOutOfOrderAnswerShowsFlash(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $secondQuestion = $quiz->questions->get(1);
+        $this->assertInstanceOf(Question::class, $secondQuestion);
+        $answer = $secondQuestion->answers->first();
+        $this->assertInstanceOf(Answer::class, $answer);
+
+        $url = \sprintf('/krtek/%s', Base64::base64UrlEncode('Tom'));
+        $crawler = $this->client->request(Request::METHOD_GET, $url);
+        $token = (string) $crawler->filter('input[name="token"]')->first()->attr('value');
+
+        $this->client->request(Request::METHOD_POST, $url, [
+            'token' => $token,
+            'answer' => (string) $answer->id,
+        ]);
+
+        self::assertResponseRedirects($url);
+        $this->client->followRedirect();
+        self::assertSelectorTextContains('body', 'Je kan deze vraag niet beantwoorden');
+    }
+
+    public function testQuizPageCompletedShowsFlashAndRedirects(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+
+        foreach ($quiz->questions as $question) {
+            $this->answerQuestion($question);
+        }
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/krtek/%s', Base64::base64UrlEncode('Tom')));
+
+        self::assertResponseRedirects('/krtek');
+        $this->client->followRedirect();
+        self::assertSelectorTextContains('body', 'Test voltooid');
+    }
+
+    public function testQuizPageInactiveCandidateIsBlocked(): void
+    {
+        $quiz = $this->getQuizByName('Quiz 1');
+        $candidate = $this->getCandidate('Tom');
+
+        $quizCandidate = new QuizCandidate($quiz, $candidate);
+        $quizCandidate->active = false;
+
+        $this->entityManager->persist($quizCandidate);
+        $this->entityManager->flush();
+
+        $this->client->request(Request::METHOD_GET, \sprintf('/krtek/%s', Base64::base64UrlEncode('Tom')));
+
+        self::assertResponseRedirects('/krtek');
+        $this->client->followRedirect();
+        self::assertSelectorTextContains('body', 'Je mag deze test niet beantwoorden');
+    }
+}

tests/Controller/RegistrationControllerTest.php

@@ -0,0 +1,90 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Controller;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use Symfony\Component\HttpFoundation\Request;
+use SymfonyCasts\Bundle\VerifyEmail\VerifyEmailHelperInterface;
+use Tvdt\Controller\RegistrationController;
+
+#[CoversClass(RegistrationController::class)]
+final class RegistrationControllerTest extends AbstractControllerWebTestCase
+{
+    public function testRegisterPageLoadsWhenNotAuthenticated(): void
+    {
+        $this->client->request(Request::METHOD_GET, '/register');
+
+        self::assertResponseIsSuccessful();
+        self::assertSelectorExists('form');
+    }
+
+    public function testRegisterRedirectsToBackofficeWhenAlreadyAuthenticated(): void
+    {
+        $this->loginAs('test@example.org');
+
+        $this->client->request(Request::METHOD_GET, '/register');
+
+        self::assertResponseRedirects('/backoffice/');
+    }
+
+    public function testRegisterCreatesUserSendsConfirmationAndLogsIn(): void
+    {
+        $crawler = $this->client->request(Request::METHOD_GET, '/register');
+        $form = $crawler->filter('form')->form([
+            'registration_form[email]' => 'newuser@example.org',
+            'registration_form[plainPassword][first]' => 'NewPass123!',
+            'registration_form[plainPassword][second]' => 'NewPass123!',
+        ]);
+        $this->client->submit($form);
+
+        self::assertResponseRedirects('/backoffice/');
+        self::assertEmailCount(1);
+
+        $this->entityManager->clear();
+        $user = $this->getUserByEmail('newuser@example.org');
+        $this->assertFalse($user->isVerified);
+    }
+
+    public function testVerifyEmailWithoutIdRedirectsToRegister(): void
+    {
+        $this->client->request(Request::METHOD_GET, '/verify/email');
+
+        self::assertResponseRedirects('/register');
+    }
+
+    public function testVerifyEmailWithUnknownIdRedirectsToRegister(): void
+    {
+        $this->client->request(Request::METHOD_GET, '/verify/email', ['id' => '00000000-0000-0000-0000-000000000000']);
+
+        self::assertResponseRedirects('/register');
+    }
+
+    public function testVerifyEmailWithValidSignatureMarksUserVerified(): void
+    {
+        $user = $this->getUserByEmail('test@example.org');
+        $this->assertFalse($user->isVerified);
+
+        /** @var VerifyEmailHelperInterface $helper */
+        $helper = self::getContainer()->get(VerifyEmailHelperInterface::class);
+        $signature = $helper->generateSignature('tvdt_verify_email', $user->id->toRfc4122(), $user->email, ['id' => $user->id]);
+
+        $this->client->request(Request::METHOD_GET, $signature->getSignedUrl());
+
+        self::assertResponseRedirects('/backoffice/');
+
+        $this->entityManager->clear();
+        $updatedUser = $this->getUserByEmail('test@example.org');
+        $this->assertTrue($updatedUser->isVerified);
+    }
+
+    public function testVerifyEmailWithInvalidSignatureShowsErrorAndRedirects(): void
+    {
+        $user = $this->getUserByEmail('test@example.org');
+
+        $this->client->request(Request::METHOD_GET, '/verify/email', ['id' => (string) $user->id, 'expires' => '9999999999', 'signature' => 'invalid']);
+
+        self::assertResponseRedirects('/register');
+    }
+}

tests/Controller/ResetPasswordControllerTest.php

@@ -4,10 +4,8 @@ declare(strict_types=1);
 
 namespace Tvdt\Tests\Controller;
 
-use Doctrine\ORM\EntityManagerInterface;
 use PHPUnit\Framework\Attributes\CoversClass;
-use Symfony\Bundle\FrameworkBundle\KernelBrowser;
-use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+use PHPUnit\Framework\Attributes\DataProvider;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
 use SymfonyCasts\Bundle\ResetPassword\ResetPasswordHelperInterface;
@@ -15,18 +13,8 @@ use Tvdt\Controller\ResetPasswordController;
 use Tvdt\Entity\User;
 
 #[CoversClass(ResetPasswordController::class)]
-final class ResetPasswordControllerTest extends WebTestCase
+final class ResetPasswordControllerTest extends AbstractControllerWebTestCase
 {
-    private KernelBrowser $client;
-
-    private EntityManagerInterface $entityManager;
-
-    protected function setUp(): void
-    {
-        $this->client = self::createClient();
-        $this->entityManager = self::getContainer()->get(EntityManagerInterface::class);
-    }
-
     public function testRequestPageLoads(): void
     {
         $this->client->request(Request::METHOD_GET, '/reset-password');
@@ -35,22 +23,19 @@ final class ResetPasswordControllerTest extends WebTestCase
         $this->assertSelectorExists('form');
     }
 
-    public function testRequestWithUnknownEmailRedirectsToCheckEmail(): void
+    /** @return iterable<string, array{string}> */
+    public static function emailProvider(): iterable
     {
-        $this->client->request(Request::METHOD_GET, '/reset-password');
-        $form = $this->client->getCrawler()->filter('form')->form([
-            'reset_password_request_form[email]' => 'unknown@example.org',
-        ]);
-        $this->client->submit($form);
-
-        $this->assertResponseRedirects('/reset-password/check-email');
+        yield 'unknown email' => ['unknown@example.org'];
+        yield 'known email' => ['test@example.org'];
     }
 
-    public function testRequestWithKnownEmailRedirectsToCheckEmail(): void
+    #[DataProvider('emailProvider')]
+    public function testRequestRedirectsToCheckEmail(string $email): void
     {
         $this->client->request(Request::METHOD_GET, '/reset-password');
         $form = $this->client->getCrawler()->filter('form')->form([
-            'reset_password_request_form[email]' => 'test@example.org',
+            'reset_password_request_form[email]' => $email,
         ]);
         $this->client->submit($form);
 

tests/Controller/WellKnownControllerTest.php

@@ -6,21 +6,12 @@ namespace Tvdt\Tests\Controller;
 
 use PHPUnit\Framework\Attributes\CoversClass;
 use Safe\DateTimeImmutable;
-use Symfony\Bundle\FrameworkBundle\KernelBrowser;
-use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
 use Symfony\Component\HttpFoundation\Request;
 use Tvdt\Controller\WellKnownController;
 
 #[CoversClass(WellKnownController::class)]
-final class WellKnownControllerTest extends WebTestCase
+final class WellKnownControllerTest extends AbstractControllerWebTestCase
 {
-    private KernelBrowser $client;
-
-    protected function setUp(): void
-    {
-        $this->client = self::createClient();
-    }
-
     public function testChangePasswordRedirectsToSettings(): void
     {
         $this->client->request(Request::METHOD_GET, '/.well-known/change-password');

tests/Entity/BankQuestionTest.php

@@ -0,0 +1,100 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Entity;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\TestCase;
+use Tvdt\Entity\BankAnswer;
+use Tvdt\Entity\BankQuestion;
+use Tvdt\Entity\BankQuestionUsage;
+use Tvdt\Entity\Quiz;
+
+#[CoversClass(BankQuestion::class)]
+final class BankQuestionTest extends TestCase
+{
+    public function testIsCompleteForQuizIsFalseWithoutTwoAnswers(): void
+    {
+        $bankQuestion = new BankQuestion();
+        $bankQuestion->addAnswer(new BankAnswer('Only answer', true));
+
+        $this->assertFalse($bankQuestion->isCompleteForQuiz);
+    }
+
+    public function testIsCompleteForQuizIsFalseWithoutCorrectAnswer(): void
+    {
+        $bankQuestion = new BankQuestion();
+        $bankQuestion->addAnswer(new BankAnswer('Wrong 1'));
+        $bankQuestion->addAnswer(new BankAnswer('Wrong 2'));
+
+        $this->assertFalse($bankQuestion->isCompleteForQuiz);
+    }
+
+    public function testIsCompleteForQuizIsFalseWithMultipleCorrectAnswers(): void
+    {
+        $bankQuestion = new BankQuestion();
+        $bankQuestion->addAnswer(new BankAnswer('Right 1', true));
+        $bankQuestion->addAnswer(new BankAnswer('Right 2', true));
+
+        $this->assertFalse($bankQuestion->isCompleteForQuiz);
+    }
+
+    public function testIsCompleteForQuizIsTrueWithTwoAnswersAndOneCorrect(): void
+    {
+        $bankQuestion = new BankQuestion();
+        $bankQuestion->addAnswer(new BankAnswer('Right', true));
+        $bankQuestion->addAnswer(new BankAnswer('Wrong'));
+
+        $this->assertTrue($bankQuestion->isCompleteForQuiz);
+    }
+
+    public function testCanBeAssignedIsTrueWhenUnused(): void
+    {
+        $bankQuestion = new BankQuestion();
+
+        $this->assertTrue($bankQuestion->canBeAssigned);
+    }
+
+    public function testCanBeAssignedIsTrueWhenReusableEvenIfUsed(): void
+    {
+        $bankQuestion = new BankQuestion();
+        $bankQuestion->reusable = true;
+        $bankQuestion->addUsage(new BankQuestionUsage($bankQuestion, new Quiz()));
+
+        $this->assertTrue($bankQuestion->canBeAssigned);
+    }
+
+    public function testCanBeAssignedIsFalseWhenSingleUseAndUsed(): void
+    {
+        $bankQuestion = new BankQuestion();
+        $bankQuestion->addUsage(new BankQuestionUsage($bankQuestion, new Quiz()));
+
+        $this->assertFalse($bankQuestion->canBeAssigned);
+    }
+
+    public function testIsUsedInQuizIsTrueForQuizWithUsage(): void
+    {
+        $bankQuestion = new BankQuestion();
+        $quiz = new Quiz();
+        $bankQuestion->addUsage(new BankQuestionUsage($bankQuestion, $quiz));
+
+        $this->assertTrue($bankQuestion->isUsedInQuiz($quiz));
+    }
+
+    public function testIsUsedInQuizIsFalseForDifferentQuiz(): void
+    {
+        $bankQuestion = new BankQuestion();
+        $bankQuestion->addUsage(new BankQuestionUsage($bankQuestion, new Quiz()));
+
+        $this->assertFalse($bankQuestion->isUsedInQuiz(new Quiz()));
+    }
+
+    public function testToStringReturnsQuestionText(): void
+    {
+        $bankQuestion = new BankQuestion();
+        $bankQuestion->question = 'Wie is de Krtek?';
+
+        $this->assertSame('Wie is de Krtek?', (string) $bankQuestion);
+    }
+}

tests/Entity/EliminationTest.php

@@ -0,0 +1,89 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Entity;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpFoundation\InputBag;
+use Tvdt\Entity\Elimination;
+use Tvdt\Entity\Quiz;
+
+#[CoversClass(Elimination::class)]
+final class EliminationTest extends TestCase
+{
+    public function testGetScreenColourReturnsNullForNullName(): void
+    {
+        $elimination = new Elimination(new Quiz());
+
+        $this->assertNull($elimination->getScreenColour(null));
+    }
+
+    public function testGetScreenColourReturnsNullForUnknownName(): void
+    {
+        $elimination = new Elimination(new Quiz());
+        $elimination->data = $this->colours(['Tom' => Elimination::SCREEN_GREEN]);
+
+        $this->assertNull($elimination->getScreenColour('Claudia'));
+    }
+
+    public function testGetScreenColourReturnsColourForKnownName(): void
+    {
+        $elimination = new Elimination(new Quiz());
+        $elimination->data = $this->colours(['Tom' => Elimination::SCREEN_GREEN, 'Claudia' => Elimination::SCREEN_RED]);
+
+        $this->assertSame(Elimination::SCREEN_RED, $elimination->getScreenColour('Claudia'));
+    }
+
+    public function testUpdateFromInputBagUpdatesKnownColours(): void
+    {
+        $elimination = new Elimination(new Quiz());
+        $elimination->data = $this->colours(['Tom' => Elimination::SCREEN_GREEN, 'Claudia' => Elimination::SCREEN_RED]);
+
+        $elimination->updateFromInputBag($this->inputBag(['colour-tom' => Elimination::SCREEN_RED]));
+
+        $this->assertSame(Elimination::SCREEN_RED, $elimination->data['Tom']);
+        $this->assertSame(Elimination::SCREEN_RED, $elimination->data['Claudia']);
+    }
+
+    public function testUpdateFromInputBagIgnoresMissingInput(): void
+    {
+        $elimination = new Elimination(new Quiz());
+        $elimination->data = $this->colours(['Tom' => Elimination::SCREEN_GREEN]);
+
+        $elimination->updateFromInputBag($this->inputBag([]));
+
+        $this->assertSame(Elimination::SCREEN_GREEN, $elimination->data['Tom']);
+    }
+
+    public function testUpdateFromInputBagReturnsSelf(): void
+    {
+        $elimination = new Elimination(new Quiz());
+
+        $this->assertSame($elimination, $elimination->updateFromInputBag($this->inputBag([])));
+    }
+
+    /**
+     * @param array<string, string> $colours
+     *
+     * @return array<string, string>
+     */
+    private function colours(array $colours): array
+    {
+        return $colours;
+    }
+
+    /**
+     * @param array<string, string> $parameters
+     *
+     * @return InputBag<bool|float|int|string>
+     */
+    private function inputBag(array $parameters): InputBag
+    {
+        /** @var InputBag<bool|float|int|string> $inputBag */
+        $inputBag = new InputBag($parameters);
+
+        return $inputBag;
+    }
+}

tests/Helpers/Base64Test.php

@@ -4,28 +4,34 @@ declare(strict_types=1);
 
 namespace Tvdt\Tests\Helpers;
 
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
 use PHPUnit\Framework\TestCase;
 use Safe\Exceptions\UrlException;
 use Tvdt\Helpers\Base64;
 
+#[CoversClass(Base64::class)]
 final class Base64Test extends TestCase
 {
-    public function testBase64UrlEncode(): void
+    /** @return iterable<string, array{string, string}> */
+    public static function pairProvider(): iterable
     {
-        $this->assertSame('TWFyaWpu', Base64::base64UrlEncode('Marijn'));
-        $this->assertSame('UGhpbGluZQ', Base64::base64UrlEncode('Philine'));
-
-        $this->assertSame('_g', Base64::base64UrlEncode(\chr(254)));
-        $this->assertSame('-g', Base64::base64UrlEncode(\chr(250)));
+        yield 'Marijn' => ['Marijn', 'TWFyaWpu'];
+        yield 'Philine' => ['Philine', 'UGhpbGluZQ'];
+        yield 'byte 254' => [\chr(254), '_g'];
+        yield 'byte 250' => [\chr(250), '-g'];
     }
 
-    public function testBase64UrlDecode(): void
+    #[DataProvider('pairProvider')]
+    public function testBase64UrlEncode(string $decoded, string $encoded): void
     {
-        $this->assertSame('Marijn', Base64::base64UrlDecode('TWFyaWpu'));
-        $this->assertSame('Philine', Base64::base64UrlDecode('UGhpbGluZQ'));
+        $this->assertSame($encoded, Base64::base64UrlEncode($decoded));
+    }
 
-        $this->assertSame(\chr(254), Base64::base64UrlDecode('_g'));
-        $this->assertSame(\chr(250), Base64::base64UrlDecode('-g'));
+    #[DataProvider('pairProvider')]
+    public function testBase64UrlDecode(string $decoded, string $encoded): void
+    {
+        $this->assertSame($decoded, Base64::base64UrlDecode($encoded));
     }
 
     public function testBase64UrlDecodeCanHandlePadding(): void

tests/Helpers/FilenameSanitizerTest.php

@@ -0,0 +1,34 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Helpers;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Tvdt\Helpers\FilenameSanitizer;
+
+#[CoversClass(FilenameSanitizer::class)]
+final class FilenameSanitizerTest extends TestCase
+{
+    /** @return iterable<string, array{string, string}> */
+    public static function sanitizeProvider(): iterable
+    {
+        yield 'replaces spaces with dashes' => ['Krtek Weekend', 'Krtek-Weekend'];
+        yield 'strips path traversal' => ['../../etc/passwd', 'etc-passwd'];
+        yield 'strips forward slash' => ['a/b', 'a-b'];
+        yield 'strips backslash' => ['a\\b', 'a-b'];
+        yield 'strips control characters and special symbols' => ["Quiz #1 <script>\0", 'Quiz-1-script'];
+        yield 'transliterates unicode to ascii' => ['Wéird Ñame', 'Weird-Name'];
+        yield 'transliterates at sign in email' => ['test@example.org', 'test-example-org'];
+        yield 'returns unnamed for empty input' => ['', 'unnamed'];
+        yield 'returns unnamed for fully stripped input' => ['///', 'unnamed'];
+    }
+
+    #[DataProvider('sanitizeProvider')]
+    public function testSanitize(string $input, string $expected): void
+    {
+        $this->assertSame($expected, FilenameSanitizer::sanitize($input));
+    }
+}

tests/Repository/SeasonRepositoryTest.php

@@ -5,25 +5,28 @@ declare(strict_types=1);
 namespace Tvdt\Tests\Repository;
 
 use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
 use Tvdt\Entity\Season;
 use Tvdt\Repository\SeasonRepository;
 
 #[CoversClass(SeasonRepository::class)]
 final class SeasonRepositoryTest extends DatabaseTestCase
 {
-    public function testGetSeasonsForUser(): void
+    /** @return iterable<string, array{string, string}> */
+    public static function userSeasonsProvider(): iterable
     {
-        $user = $this->getUserByEmail('krtek-admin@example.org');
+        yield 'krtek admin' => ['krtek-admin@example.org', 'krtek'];
+        yield 'user1' => ['user1@example.org', 'bbbbb'];
+    }
+
+    #[DataProvider('userSeasonsProvider')]
+    public function testGetSeasonsForUser(string $email, string $expectedSeasonCode): void
+    {
+        $user = $this->getUserByEmail($email);
 
         $seasons = $this->seasonRepository->getSeasonsForUser($user);
         $this->assertCount(1, $seasons);
-        $this->assertSame('krtek', $seasons[0]->seasonCode);
-
-        $user = $this->getUserByEmail('user1@example.org');
-
-        $seasons = $this->seasonRepository->getSeasonsForUser($user);
-        $this->assertCount(1, $seasons);
-        $this->assertSame('bbbbb', $seasons[0]->seasonCode);
+        $this->assertSame($expectedSeasonCode, $seasons[0]->seasonCode);
     }
 
     public function testUserWithMultipleSeasons(): void

tests/Repository/UserRepositoryTest.php

@@ -7,6 +7,12 @@ namespace Tvdt\Tests\Repository;
 use PHPUnit\Framework\Attributes\CoversClass;
 use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
 use Tvdt\DataFixtures\TestFixtures;
+use Tvdt\Entity\BankQuestion;
+use Tvdt\Entity\Elimination;
+use Tvdt\Entity\GivenAnswer;
+use Tvdt\Entity\Question;
+use Tvdt\Entity\Quiz;
+use Tvdt\Entity\QuizCandidate;
 use Tvdt\Repository\UserRepository;
 
 use function PHPUnit\Framework\assertEmpty;
@@ -42,4 +48,89 @@ final class UserRepositoryTest extends DatabaseTestCase
         $this->expectException(\InvalidArgumentException::class);
         $this->userRepository->makeAdmin('invalid@example.org');
     }
+
+    /**
+     * GDPR right-to-erasure: deleting the sole owner of a season must physically remove every
+     * row tied to it, not merely soft-delete it. QuizCandidate, GivenAnswer, and Elimination are
+     * all Gedmo\SoftDeleteable, so a naive $em->remove($season) cascade leaves them (or the
+     * transaction itself) behind. Assertions bypass the softdeleteable filter and read raw SQL,
+     * since a soft-deleted row would otherwise still be invisible to a filtered ORM query.
+     */
+    public function testDeleteUserHardDeletesQuizCandidateGivenAnswerAndElimination(): void
+    {
+        $user = $this->getUserByEmail('sole-owner@example.org');
+        $season = $this->getSeasonByCode('doomd');
+
+        $quiz = $this->entityManager->getRepository(Quiz::class)->findOneBy(['name' => 'Doomed Quiz', 'season' => $season]);
+        $this->assertInstanceOf(Quiz::class, $quiz);
+        $candidate = $this->getCandidateBySeasonAndName($season, 'Vera');
+
+        /** @var Question $question */
+        $question = $quiz->questions->first();
+        $rightAnswer = $question->answers->first();
+        $this->assertNotFalse($rightAnswer);
+
+        $this->quizCandidateRepository->createIfNotExist($quiz, $candidate);
+        $quizCandidate = $this->quizCandidateRepository->findOneBy(['quiz' => $quiz, 'candidate' => $candidate]);
+        $this->assertInstanceOf(QuizCandidate::class, $quizCandidate);
+
+        $givenAnswer = new GivenAnswer($candidate, $quiz, $rightAnswer);
+        $this->entityManager->persist($givenAnswer);
+
+        $elimination = new Elimination($quiz);
+        $elimination->data = ['Vera' => Elimination::SCREEN_GREEN];
+
+        $this->entityManager->persist($elimination);
+
+        $this->entityManager->flush();
+
+        $quizCandidateId = $quizCandidate->id->toString();
+        $givenAnswerId = $givenAnswer->id->toString();
+        $eliminationId = $elimination->id->toString();
+
+        $this->userRepository->deleteUser($user);
+        $this->entityManager->clear();
+
+        $connection = $this->entityManager->getConnection();
+        $this->assertSame(0, (int) $connection->fetchOne('select count(*) from quiz_candidate where id = ?', [$quizCandidateId]));
+        $this->assertSame(0, (int) $connection->fetchOne('select count(*) from given_answer where id = ?', [$givenAnswerId]));
+        $this->assertSame(0, (int) $connection->fetchOne('select count(*) from elimination where id = ?', [$eliminationId]));
+    }
+
+    /**
+     * Gedmo\Loggable writes an audit row (including the editor's username/email) to
+     * ext_log_entries for every change to a Versioned field. Those rows aren't linked via a
+     * foreign key (object_id is a plain string), so deleting the season/BankQuestion never
+     * cleans them up on its own — the deleted account's email would otherwise live on forever.
+     */
+    public function testDeleteUserPurgesBankQuestionAuditLogEntries(): void
+    {
+        $user = $this->getUserByEmail('sole-owner@example.org');
+        $season = $this->getSeasonByCode('doomd');
+
+        $bankQuestion = new BankQuestion();
+        $bankQuestion->question = 'Wie is de Krtek eigenlijk?';
+        $bankQuestion->season = $season;
+
+        $this->entityManager->persist($bankQuestion);
+        $this->entityManager->flush();
+
+        $bankQuestionId = $bankQuestion->id->toString();
+        $connection = $this->entityManager->getConnection();
+
+        $logCountBefore = (int) $connection->fetchOne(
+            'select count(*) from ext_log_entries where object_class = ? and object_id = ?',
+            [BankQuestion::class, $bankQuestionId],
+        );
+        $this->assertGreaterThan(0, $logCountBefore);
+
+        $this->userRepository->deleteUser($user);
+        $this->entityManager->clear();
+
+        $logCountAfter = (int) $connection->fetchOne(
+            'select count(*) from ext_log_entries where object_class = ? and object_id = ?',
+            [BankQuestion::class, $bankQuestionId],
+        );
+        $this->assertSame(0, $logCountAfter);
+    }
 }

tests/Service/DataExportServiceTest.php

@@ -0,0 +1,286 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Service;
+
+use PhpOffice\PhpSpreadsheet\Reader;
+use PhpOffice\PhpSpreadsheet\Worksheet\Worksheet;
+use PHPUnit\Framework\Attributes\CoversClass;
+use Tvdt\Entity\Answer;
+use Tvdt\Entity\GivenAnswer;
+use Tvdt\Entity\Question;
+use Tvdt\Entity\Quiz;
+use Tvdt\Entity\QuizCandidate;
+use Tvdt\Entity\User;
+use Tvdt\Service\DataExportService;
+use Tvdt\Tests\Repository\DatabaseTestCase;
+
+use function Safe\file_put_contents;
+use function Safe\tempnam;
+use function Safe\unlink;
+
+#[CoversClass(DataExportService::class)]
+final class DataExportServiceTest extends DatabaseTestCase
+{
+    private DataExportService $subject;
+
+    /** @var list<string> */
+    private array $tempFiles = [];
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->subject = self::getContainer()->get(DataExportService::class);
+    }
+
+    protected function tearDown(): void
+    {
+        foreach ($this->tempFiles as $path) {
+            if (file_exists($path)) {
+                unlink($path);
+            }
+        }
+
+        parent::tearDown();
+    }
+
+    public function testExportForUserWithNoSeasonsContainsOnlyProfile(): void
+    {
+        $zip = $this->openZip($this->getUserByEmail('test@example.org'));
+
+        $this->assertSame(1, $zip->numFiles);
+        $this->assertNotFalse($zip->locateName('profile.xlsx'));
+        $zip->close();
+    }
+
+    public function testExportForUserIncludesOwnedSeasonsQuizzesAndCandidates(): void
+    {
+        $zip = $this->openZip($this->getUserByEmail('user2@example.org'));
+
+        $names = $this->entryNames($zip);
+
+        $this->assertContains('profile.xlsx', $names);
+        $this->assertContains('krtek-Krtek-Weekend/Quiz-1.xlsx', $names);
+        $this->assertContains('krtek-Krtek-Weekend/Quiz-2.xlsx', $names);
+        $this->assertContains('krtek-Krtek-Weekend/candidates.xlsx', $names);
+        $this->assertContains('krtek-Krtek-Weekend/question-bank.xlsx', $names);
+        $this->assertContains('bbbbb-Another-Season/candidates.xlsx', $names);
+        $this->assertContains('bbbbb-Another-Season/question-bank.xlsx', $names);
+
+        // Another Season has no quizzes, so no quiz xlsx should be present for it.
+        foreach ($names as $name) {
+            $this->assertStringStartsNotWith('bbbbb-Another-Season/Quiz', $name);
+        }
+
+        $quizContent = $zip->getFromName('krtek-Krtek-Weekend/Quiz-1.xlsx');
+        $this->assertIsString($quizContent);
+        $this->assertSame(['Quiz info', 'Questions', 'Raw answers', 'Results', 'Eliminations'], $this->sheetNames($quizContent));
+
+        $candidatesContent = $zip->getFromName('krtek-Krtek-Weekend/candidates.xlsx');
+        $this->assertIsString($candidatesContent);
+        $this->assertSame(['Candidates', 'Season info'], $this->sheetNames($candidatesContent));
+
+        $questionBankContent = $zip->getFromName('krtek-Krtek-Weekend/question-bank.xlsx');
+        $this->assertIsString($questionBankContent);
+        $this->assertSame(['Questions', 'Labels'], $this->sheetNames($questionBankContent));
+
+        $zip->close();
+    }
+
+    public function testQuestionBankSheetIncludesBankQuestionsAndUsage(): void
+    {
+        $zip = $this->openZip($this->getUserByEmail('user2@example.org'));
+
+        $questionBankContent = $zip->getFromName('krtek-Krtek-Weekend/question-bank.xlsx');
+        $this->assertIsString($questionBankContent);
+        $zip->close();
+
+        $rows = $this->loadSheet($questionBankContent, 'Questions')->toArray();
+        $header = $rows[0];
+        $dataRows = \array_slice($rows, 1);
+
+        $questionIndex = array_search('Question', $header, true);
+        $reusableIndex = array_search('Reusable', $header, true);
+        $labelsIndex = array_search('Labels', $header, true);
+        $usedInQuizzesIndex = array_search('Used in quizzes', $header, true);
+
+        $reusableRow = current(array_filter($dataRows, static fn (array $row): bool => 'Wie is de Krtek?' === $row[$questionIndex]));
+        $this->assertIsArray($reusableRow);
+        $this->assertSame('Yes', $reusableRow[$reusableIndex]);
+        $this->assertSame('Finale', $reusableRow[$labelsIndex]);
+
+        $usedRow = current(array_filter($dataRows, static fn (array $row): bool => 'Waar sliep de Krtek?' === $row[$questionIndex]));
+        $this->assertIsArray($usedRow);
+        $this->assertSame('Quiz 2', $usedRow[$usedInQuizzesIndex]);
+
+        $labelRows = $this->loadSheet($questionBankContent, 'Labels')->toArray();
+        $labelNames = array_column(\array_slice($labelRows, 1), 0);
+        $this->assertContains('Locatie', $labelNames);
+        $this->assertContains('Finale', $labelNames);
+    }
+
+    public function testProfileSheetDoesNotContainPasswordHash(): void
+    {
+        $user = $this->getUserByEmail('user2@example.org');
+        $zip = $this->openZip($user);
+
+        $profileContent = $zip->getFromName('profile.xlsx');
+        $this->assertIsString($profileContent);
+        $zip->close();
+
+        $rows = $this->loadSheet($profileContent, 'Account')->toArray();
+        $flattened = implode(' ', array_merge(...$rows));
+
+        $this->assertStringNotContainsString($user->password, $flattened);
+    }
+
+    public function testResultsSheetIncludesSoftDeletedQuizCandidates(): void
+    {
+        $season = $this->getSeasonByCode('krtek');
+        $quiz = $this->entityManager->getRepository(Quiz::class)->findOneBy(['name' => 'Quiz 1', 'season' => $season]);
+        $this->assertInstanceOf(Quiz::class, $quiz);
+        $candidate = $this->getCandidateBySeasonAndName($season, 'Claudia');
+
+        $quizCandidate = new QuizCandidate($quiz, $candidate);
+        $this->entityManager->persist($quizCandidate);
+        $this->entityManager->flush();
+
+        $this->entityManager->remove($quizCandidate);
+        $this->entityManager->flush();
+        $this->entityManager->clear();
+
+        $zip = $this->openZip($this->getUserByEmail('user2@example.org'));
+        $quizContent = $zip->getFromName('krtek-Krtek-Weekend/Quiz-1.xlsx');
+        $this->assertIsString($quizContent);
+        $zip->close();
+
+        $rows = $this->loadSheet($quizContent, 'Results')->toArray();
+        $deletedColumnIndex = array_search('Deleted', $rows[0], true);
+        $this->assertIsInt($deletedColumnIndex);
+        $hasDeletedRow = array_any(\array_slice($rows, 1), static fn (array $row): bool => null !== $row[$deletedColumnIndex] && '' !== $row[$deletedColumnIndex]);
+
+        $this->assertTrue($hasDeletedRow, 'Expected the soft-deleted QuizCandidate to still appear with a Deleted timestamp');
+    }
+
+    public function testRawAnswersSheetShowsCandidatesByQuestionsGrid(): void
+    {
+        $season = $this->getSeasonByCode('krtek');
+        $quiz = $this->entityManager->getRepository(Quiz::class)->findOneBy(['name' => 'Quiz 1', 'season' => $season]);
+        $this->assertInstanceOf(Quiz::class, $quiz);
+        $candidate = $this->getCandidateBySeasonAndName($season, 'Claudia');
+
+        /** @var Question $firstQuestion */
+        $firstQuestion = $quiz->questions->first();
+        $chosenAnswer = $firstQuestion->answers->filter(static fn (Answer $answer): bool => 'Man' === $answer->text)->first();
+        $this->assertInstanceOf(Answer::class, $chosenAnswer);
+
+        $this->quizCandidateRepository->createIfNotExist($quiz, $candidate);
+
+        $givenAnswer = new GivenAnswer($candidate, $quiz, $chosenAnswer);
+        $this->entityManager->persist($givenAnswer);
+        $this->entityManager->flush();
+
+        $zip = $this->openZip($this->getUserByEmail('user2@example.org'));
+        $quizContent = $zip->getFromName('krtek-Krtek-Weekend/Quiz-1.xlsx');
+        $this->assertIsString($quizContent);
+        $zip->close();
+
+        $rows = $this->loadSheet($quizContent, 'Raw answers')->toArray();
+        $header = $rows[0];
+        $this->assertSame('Candidate', $header[0]);
+
+        $questionColumnIndex = array_search($firstQuestion->question, $header, true);
+        $this->assertIsInt($questionColumnIndex);
+
+        $claudiaRow = current(array_filter(
+            \array_slice($rows, 1),
+            static fn (array $row): bool => 'Claudia' === $row[0],
+        ));
+        $this->assertIsArray($claudiaRow);
+        $this->assertSame('Man', $claudiaRow[$questionColumnIndex]);
+    }
+
+    public function testQuizInfoSheetShowsDropoutsFinalizationAndDisabledQuestions(): void
+    {
+        $season = $this->getSeasonByCode('krtek');
+        $quiz = $this->entityManager->getRepository(Quiz::class)->findOneBy(['name' => 'Quiz 1', 'season' => $season]);
+        $this->assertInstanceOf(Quiz::class, $quiz);
+        $this->assertTrue($quiz->isFinalized);
+
+        /** @var Question $disabledQuestion */
+        $disabledQuestion = $quiz->questions->first();
+        $disabledQuestion->enabled = false;
+
+        $this->entityManager->flush();
+
+        $zip = $this->openZip($this->getUserByEmail('user2@example.org'));
+        $quizContent = $zip->getFromName('krtek-Krtek-Weekend/Quiz-1.xlsx');
+        $this->assertIsString($quizContent);
+        $zip->close();
+
+        $rows = $this->loadSheet($quizContent, 'Quiz info')->toArray();
+        $values = [];
+        foreach ($rows as $row) {
+            $values[$row[0]] = $row[1];
+        }
+
+        $this->assertSame('Quiz 1', $values['Quiz name']);
+        $this->assertSame($quiz->dropouts, (int) $values['Number of dropouts']);
+        $this->assertSame('Yes', $values['Finalized']);
+        $this->assertNotEmpty($values['Finalized at']);
+        $this->assertStringContainsString($disabledQuestion->question, (string) $values['Disabled questions']);
+    }
+
+    private function openZip(User $user): \ZipArchive
+    {
+        $zipPath = $this->subject->exportForUser($user);
+        $this->tempFiles[] = $zipPath;
+
+        $zip = new \ZipArchive();
+        $this->assertTrue($zip->open($zipPath));
+
+        return $zip;
+    }
+
+    /** @return list<string> */
+    private function entryNames(\ZipArchive $zip): array
+    {
+        $names = [];
+        for ($i = 0; $i < $zip->numFiles; ++$i) {
+            $name = $zip->getNameIndex($i);
+            $this->assertIsString($name);
+            $names[] = $name;
+        }
+
+        return $names;
+    }
+
+    /** @return list<string> */
+    private function sheetNames(string $xlsxContent): array
+    {
+        $path = $this->createTempPath();
+        file_put_contents($path, $xlsxContent);
+
+        return array_values(new Reader\Xlsx()->load($path)->getSheetNames());
+    }
+
+    private function loadSheet(string $xlsxContent, string $sheetName): Worksheet
+    {
+        $path = $this->createTempPath();
+        file_put_contents($path, $xlsxContent);
+
+        $sheet = new Reader\Xlsx()->load($path)->getSheetByName($sheetName);
+        $this->assertInstanceOf(Worksheet::class, $sheet);
+
+        return $sheet;
+    }
+
+    private function createTempPath(): string
+    {
+        $path = tempnam(sys_get_temp_dir(), 'tvdt_export_test_');
+        $this->tempFiles[] = $path;
+
+        return $path;
+    }
+}

translations/messages+intl-icu.nl.xliff

@@ -205,6 +205,14 @@
         <source>Confirm Answers</source>
         <target>Bevestig antwoorden</target>
       </trans-unit>
+      <trans-unit id="T1Z6nI1" resname="Confirm your email address to enable this feature.">
+        <source>Confirm your email address to enable this feature.</source>
+        <target>Bevestig je e-mailadres om deze functie te kunnen gebruiken.</target>
+      </trans-unit>
+      <trans-unit id="QZfvKMx" resname="Confirm your email address to enable this.">
+        <source>Confirm your email address to enable this.</source>
+        <target>Bevestig je e-mailadres om dit te gebruiken.</target>
+      </trans-unit>
       <trans-unit id="PiAVEe9" resname="Confirmed">
         <source>Confirmed</source>
         <target>Bevestigd</target>
@@ -293,6 +301,10 @@
         <source>Download Template</source>
         <target>Download sjabloon</target>
       </trans-unit>
+      <trans-unit id="43g0Dc8" resname="Download an archive of everything stored under your account: your profile, the seasons you own, their quizzes, results and candidates.">
+        <source>Download an archive of everything stored under your account: your profile, the seasons you own, their quizzes, results and candidates.</source>
+        <target>Download een archief met alles wat onder je account is opgeslagen: je profiel, de seizoenen die je bezit, met de bijbehorende testen, resultaten en kandidaten.</target>
+      </trans-unit>
       <trans-unit id="58e2QWG" resname="Download data">
         <source>Download data</source>
         <target>Gegevens downloaden</target>
@@ -557,6 +569,18 @@
         <source>Please Confirm your Email</source>
         <target>Bevestig je e-mailadres alsjeblieft</target>
       </trans-unit>
+      <trans-unit id="7osID7L" resname="Please confirm your email address before downloading your data.">
+        <source>Please confirm your email address before downloading your data.</source>
+        <target>Bevestig eerst je e-mailadres voordat je je gegevens downloadt.</target>
+      </trans-unit>
+      <trans-unit id="XS4opCD" resname="Please confirm your email address before exporting a quiz.">
+        <source>Please confirm your email address before exporting a quiz.</source>
+        <target>Bevestig je e-mailadres voordat je een quiz exporteert.</target>
+      </trans-unit>
+      <trans-unit id="y4TgBCP" resname="Please confirm your email address before exporting data.">
+        <source>Please confirm your email address before exporting data.</source>
+        <target>Bevestig eerst je e-mailadres voordat je gegevens exporteert.</target>
+      </trans-unit>
       <trans-unit id="mq1QYAv" resname="Please select an answer">
         <source>Please select an answer</source>
         <target>Selecteer een antwoorden alsjeblieft</target>