auth: Firmenrechte nur aus nachgewiesener Adresse, 2FA auf allen Login-Wegen (Audit Block 1, Deploy A)

Audit vom 11.09. gegen HEAD geprüft, Entwicklungsplan dazu unter
dev/2026-09-11-audit/ENTWICKLUNGSPLAN.md. Dieser Commit ist Deploy A:
die sechs kleinen Punkte aus Block 1 ohne Schemaänderung.

F01: Der Fortify-Endpunkt PUT /user/profile-information tauschte die
E-Mail sofort und setzte die Verifizierung zurück; der Login-Sync vergab
danach Firmenrechte allein nach E-Mail-Treffer. Feature abgeschaltet
(die Kunden-UI hat den pending_email-Prozess), und der Sync verlangt
jetzt ein verifiziertes, aktives Konto – für alle Aufrufer.

F02: Google-Login übergibt Konten mit bestätigtem TOTP in die Challenge,
wie Passwort- und Magic-Link-Login.

F03: showRecoveryCodes ist gesperrt; ein Client-Update konnte die
Recovery-Codes entschlüsseln lassen.

F08: Nutzer-Detailroute unter can:users:manage (persistente Livewire-
Middleware), Gutschriften autorisieren zusätzlich in der Action.

F09: Gate::before greift nur für aktive Super-Admins; deaktivierte
fallen auf die Gates mit is_active-Prüfung zurück.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tests/Feature/Admin/AdminGrantTest.php

@@ -10,6 +10,7 @@ use App\Services\Billing\AdminGrantService;
 use App\Services\Billing\CreditWalletService;
 use Database\Seeders\RolesAndPermissionsSeeder;
 use Livewire\Volt\Volt as LivewireVolt;
+use Spatie\Permission\PermissionRegistrar;
 use Tests\TestCase;
 
 /**
@@ -97,3 +98,29 @@ test('the grant panel is not available without the users manage permission', fun
 
     $this->get(route('admin.users.show', $editor->id))->assertForbidden();
 });
+
+test('grants are refused once the permission is revoked while the panel stays open (Audit F08)', function () {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+
+    $admin = User::factory()->create(['is_active' => true]);
+    $admin->assignRole('admin');
+    $this->actingAs($admin);
+
+    // Zwei geladene Komponenten (ein 403 verwirft den Livewire-Snapshot).
+    $credits = LivewireVolt::test('admin.users.show', ['id' => $admin->id]);
+    $releases = LivewireVolt::test('admin.users.show', ['id' => $admin->id]);
+
+    // Herabstufung, während die Komponenten bereits geladen sind.
+    $admin->syncRoles(['editor']);
+    app()[PermissionRegistrar::class]->forgetCachedPermissions();
+
+    $credits->set('grantCreditsAmount', 250)->call('grantCredits')->assertForbidden();
+    $releases->set('grantPmCount', 2)->call('grantFreePressReleases')->assertForbidden();
+
+    expect(app(CreditWalletService::class)->balance($admin))->toBe(0)
+        ->and($admin->singlePurchases()->count())->toBe(0);
+
+    // Die Route selbst verlangt die Berechtigung – nicht nur mount().
+    $this->get(route('admin.users.show', $admin->id))->assertForbidden();
+});

tests/Feature/Auth/ContactAccessTest.php

@@ -290,3 +290,45 @@ test('the honeypot blocks bots without creating an account', function () {
     Mail::assertNothingOutgoing();
     expect(User::query()->where('email', 'bot-target@example.test')->exists())->toBeFalse();
 });
+
+test('an unverified email earns no company membership on password login (Audit F01)', function () {
+    /** @var TestCase $this */
+    // Ein Konto hat seine Adresse auf eine fremde Firmen-Adresse gewechselt
+    // und ist deshalb unverifiziert – der Login-Sync darf daraus keine
+    // Firmenrechte ableiten, solange das Postfach nicht nachgewiesen ist.
+    $user = User::factory()->unverified()->create(['email' => 'fremd@example.test', 'is_active' => true]);
+    $user->assignRole('customer');
+
+    $company = Company::factory()->presseecho()->create(['email' => 'fremd@example.test']);
+    Contact::factory()->for($company)->create(['email' => 'fremd@example.test', 'portal' => $company->portal->value]);
+
+    Volt::test('auth.login')
+        ->set('email', 'fremd@example.test')
+        ->set('password', 'password')
+        ->call('login')
+        ->assertRedirect(route('verification.notice', absolute: false));
+
+    expect($user->fresh()->accessibleCompanyIds())->not->toContain($company->id);
+    expect($user->contacts()->count())->toBe(0);
+
+    // Nach Verifikation greift der Sync beim nächsten Login wie bisher.
+    $user->forceFill(['email_verified_at' => now()])->save();
+    app(ContactAccessService::class)->syncMembershipsForEmail($user->fresh());
+
+    expect($user->fresh()->accessibleCompanyIds())->toContain($company->id);
+});
+
+test('the membership sync ignores unverified and deactivated users regardless of the caller (Audit F01)', function () {
+    /** @var TestCase $this */
+    $company = Company::factory()->presseecho()->create(['email' => 'sync-guard@example.test']);
+
+    $unverified = User::factory()->unverified()->create(['email' => 'sync-guard@example.test', 'is_active' => true]);
+    app(ContactAccessService::class)->syncMembershipsForEmail($unverified);
+    expect($unverified->fresh()->accessibleCompanyIds())->not->toContain($company->id);
+
+    $unverified->forceDelete();
+
+    $inactive = User::factory()->create(['email' => 'sync-guard@example.test', 'is_active' => false]);
+    app(ContactAccessService::class)->syncMembershipsForEmail($inactive);
+    expect($inactive->fresh()->accessibleCompanyIds())->not->toContain($company->id);
+});

tests/Feature/Auth/GoogleLoginTest.php

@@ -5,6 +5,7 @@ use Database\Seeders\RolesAndPermissionsSeeder;
 use Laravel\Socialite\Contracts\Provider;
 use Laravel\Socialite\Facades\Socialite;
 use Laravel\Socialite\Two\User as SocialiteUser;
+use PragmaRX\Google2FA\Google2FA;
 use Tests\TestCase;
 
 beforeEach(function () {
@@ -103,3 +104,22 @@ test('a failed google callback redirects back to login with an error', function
 
     $this->assertGuest();
 });
+
+test('google login hands an account with confirmed two-factor to the challenge (Audit F02)', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create(['email' => 'totp-google@example.test', 'is_active' => true]);
+    $user->assignRole('customer');
+    $user->forceFill([
+        'two_factor_secret' => encrypt(app(Google2FA::class)->generateSecretKey()),
+        'two_factor_confirmed_at' => now(),
+    ])->save();
+
+    fakeGoogleUser('g-totp-1', 'totp-google@example.test', 'Totp');
+
+    $this->get(route('oauth.google.callback'))
+        ->assertRedirect(route('two-factor.challenge'));
+
+    $this->assertGuest();
+    expect(session('login.id'))->toBe($user->id);
+    expect($user->fresh()->last_login_at)->toBeNull();
+});

tests/Feature/Auth/UserAccessTest.php

@@ -2,6 +2,7 @@
 
 use App\Models\User;
 use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Support\Facades\Gate;
 use Tests\TestCase;
 
 test('active admin and editor users can access admin area', function () {
@@ -64,3 +65,18 @@ test('api-only and inactive users cannot access customer area', function () {
     expect($apiOnly->canAccessCustomer())->toBeFalse();
     expect($inactiveCustomer->canAccessCustomer())->toBeFalse();
 });
+
+test('a deactivated super admin is locked out of both panels despite the gate shortcut (Audit F09)', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create([
+        'is_active' => false,
+        'is_super_admin' => true,
+    ]);
+
+    expect($user->canAccessAdmin())->toBeFalse();
+    expect(Gate::forUser($user)->allows('access-admin'))->toBeFalse();
+    expect(Gate::forUser($user)->allows('access-customer'))->toBeFalse();
+
+    $this->actingAs($user)->get(route('dashboard'))->assertForbidden();
+    $this->actingAs($user)->get(route('me.dashboard'))->assertForbidden();
+});

tests/Feature/CustomerProfileSecurityTest.php

@@ -14,6 +14,7 @@ use Database\Seeders\RolesAndPermissionsSeeder;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Mail;
 use Illuminate\Support\Facades\URL;
+use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
 use Livewire\Volt\Volt as LivewireVolt;
 use PragmaRX\Google2FA\Google2FA;
 use Tests\TestCase;
@@ -523,3 +524,35 @@ test('legacy invoice policy denies access to invoices of other users', function
     expect($intruder->can('view', $invoice))->toBeFalse();
     expect($intruder->can('downloadPdf', $invoice))->toBeFalse();
 });
+
+test('the fortify profile-information endpoint is switched off (Audit F01)', function () {
+    /** @var TestCase $this */
+    $customer = User::factory()->create([
+        'is_active' => true,
+        'email' => 'eigene@example.com',
+        'email_verified_at' => now(),
+    ]);
+
+    $this->actingAs($customer)
+        ->put('/user/profile-information', ['name' => $customer->name, 'email' => 'fremd@example.com'])
+        ->assertNotFound();
+
+    expect($customer->fresh()->email)->toBe('eigene@example.com');
+    expect($customer->fresh()->email_verified_at)->not->toBeNull();
+});
+
+test('recovery codes cannot be revealed by mutating the component property (Audit F03)', function () {
+    /** @var TestCase $this */
+    $customer = User::factory()->create(['is_active' => true]);
+    $customer->forceFill([
+        'two_factor_secret' => encrypt(app(Google2FA::class)->generateSecretKey()),
+        'two_factor_recovery_codes' => encrypt(json_encode(['geheim-code-eins', 'geheim-code-zwei'])),
+        'two_factor_confirmed_at' => now(),
+    ])->save();
+
+    $this->actingAs($customer);
+
+    LivewireVolt::test('customer.security')
+        ->set('showRecoveryCodes', true)
+        ->assertDontSee('geheim-code-eins');
+})->throws(CannotUpdateLockedPropertyException::class);