fix: correct inverted user-type guard in UserService::activateExternalUser()

The guard "Make sure user is an external user" compared the enum against
a boolean (`UserTypeEnum::OIDC_EXTERNAL === !$user->getUserType()`), which
is always false, so the check never threw. Use !== against the enum value,
matching the equivalent guard in removeUserFromCurrentTenant().

The activate endpoint is still gated by ExternalUserAuthenticator at the
firewall, so this was dead defense-in-depth rather than an exploitable
hole; this restores the intended service-layer check.

Removes the corresponding identical.alwaysFalse / booleanNot.alwaysFalse
entries from the PHPStan baseline and adds unit tests covering both the
non-external rejection and the unknown-code path.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: turegjorup

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+- Fixed inverted user-type guard in `UserService::activateExternalUser()`: the "user is not of
+  external type" check could never trigger due to a stray negation (`=== !$user->getUserType()`).
+  The endpoint was still protected by `ExternalUserAuthenticator`, so this restores the intended
+  defense-in-depth at the service layer. Added unit tests.
 - Enabled PHPStan's `reportIgnoresWithoutComments`: inline `@phpstan-ignore` annotations must
   carry a comment explaining the suppression.
 

phpstan-baseline.neon

@@ -2826,18 +2826,6 @@ parameters:
 			count: 1
 			path: src/Service/TenantFactory.php
 
-		-
-			message: '#^Negated boolean expression is always false\.$#'
-			identifier: booleanNot.alwaysFalse
-			count: 1
-			path: src/Service/UserService.php
-
-		-
-			message: '#^Strict comparison using \=\=\= between App\\Enum\\UserTypeEnum\:\:OIDC_EXTERNAL and false will always evaluate to false\.$#'
-			identifier: identical.alwaysFalse
-			count: 1
-			path: src/Service/UserService.php
-
 		-
 			message: '#^Class App\\State\\AbstractProcessor implements generic interface ApiPlatform\\State\\ProcessorInterface but does not specify its types\: T1, T2$#'
 			identifier: missingType.generics

src/Service/UserService.php

@@ -71,7 +71,7 @@ public function activateExternalUser(string $code): void
         $user = $this->security->getUser();
 
         // Make sure user is an external user.
-        if (UserTypeEnum::OIDC_EXTERNAL === !$user->getUserType()) {
+        if (UserTypeEnum::OIDC_EXTERNAL !== $user->getUserType()) {
             throw new BadRequestException('User is not of external type.');
         }
 

tests/Service/UserServiceTest.php

@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Tests\Service;
+
+use App\Entity\User;
+use App\Enum\UserTypeEnum;
+use App\Exceptions\BadRequestException;
+use App\Exceptions\NotFoundException;
+use App\Repository\UserActivationCodeRepository;
+use App\Repository\UserRepository;
+use App\Repository\UserRoleTenantRepository;
+use App\Service\UserService;
+use Doctrine\ORM\EntityManagerInterface;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\Security\Core\Security;
+
+class UserServiceTest extends TestCase
+{
+    public function testActivateExternalUserThrowsForNonExternalUser(): void
+    {
+        $user = new User();
+        $user->setUserType(UserTypeEnum::OIDC_INTERNAL);
+
+        $userService = $this->createUserService($user);
+
+        $this->expectException(BadRequestException::class);
+        $this->expectExceptionMessage('User is not of external type.');
+
+        $userService->activateExternalUser('SOMECODE');
+    }
+
+    public function testActivateExternalUserThrowsForUnknownCode(): void
+    {
+        $user = new User();
+        $user->setUserType(UserTypeEnum::OIDC_EXTERNAL);
+
+        $userService = $this->createUserService($user);
+
+        $this->expectException(NotFoundException::class);
+
+        $userService->activateExternalUser('UNKNOWNCODE');
+    }
+
+    private function createUserService(User $user): UserService
+    {
+        $security = $this->createMock(Security::class);
+        $security->method('getUser')->willReturn($user);
+
+        $activationCodeRepository = $this->createMock(UserActivationCodeRepository::class);
+        $activationCodeRepository->method('findOneBy')->willReturn(null);
+
+        return new UserService(
+            $activationCodeRepository,
+            $this->createMock(EntityManagerInterface::class),
+            $security,
+            'hash-salt',
+            $this->createMock(UserRoleTenantRepository::class),
+            $this->createMock(UserRepository::class),
+            'P2D',
+        );
+    }
+}