gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

security/api/betrieb: Fortify-2FA-Nebenwege gesperrt, Policy nur für aktive Super-Admins, Nachprüfungen aus dem Umsetzungsaudit (Block 7, U08–U10, U13, 7.1, 7.2, 7.5)

Browse source 
- Fortifys sieben 2FA-Verwaltungsrouten antworten mit 404 (Middleware über
  fortify.middleware); die Sicherheitsseite verlangt weiter den zweiten Faktor (U09)
- PressReleasePolicy/CompanyPolicy::before() bejahen nur aktive Super-Admins (7.2)
- API-Update prüft bei Portalwechsel die bestehende Kategorie gegen das neue Portal (U10)
- Aggregation: Zeitbudget 480 s unter dem Lock von 600 s, Marke nur unter
  Zeilensperre vom erwarteten Stand aus, sonst Fehler-Exit (U13)
- Newsletter-Bereinigungsmigration behält je Paar die sent-Zeile (U08)
- E-Mail-Wechsel stößt den Rechte-Sync sofort an; company-memberships:audit
  --classify zeigt vorher die Kandidaten und begrenzt mit --before (7.1)
- Detailseite wählt bei Slug-Kollision wie der Melde-Resolver (7.5)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-09-18 12:03:04 +00:00
parent c46dfd3b83
commit 05cf53e17d
18 changed files with 447 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

20
tests/Feature/Auth/UserAccessTest.php
View file

@ -1,5 +1,7 @@
<?php
use App\Models\Company;
use App\Models\PressRelease;
use App\Models\User;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Support\Facades\Gate;
@ -80,3 +82,21 @@ test('a deactivated super admin is locked out of both panels despite the gate sh
$this->actingAs($user)->get(route('dashboard'))->assertForbidden();
$this->actingAs($user)->get(route('me.dashboard'))->assertForbidden();
});
test('a deactivated super admin is not whitelisted by the policy shortcuts either (Audit 7.2)', function () {
$user = User::factory()->create([
'is_active' => false,
'is_super_admin' => true,
]);
$pressRelease = PressRelease::factory()->create();
$company = Company::factory()->create();
expect(Gate::forUser($user)->allows('update', $pressRelease))->toBeFalse()
->and(Gate::forUser($user)->allows('view', $pressRelease))->toBeFalse()
->and(Gate::forUser($user)->allows('update', $company))->toBeFalse()
->and(Gate::forUser($user)->allows('view', $company))->toBeFalse();
$user->forceFill(['is_active' => true])->save();
expect(Gate::forUser($user->fresh())->allows('update', $pressRelease))->toBeTrue();
});