auth: Firmenrechte nur aus nachgewiesener Adresse, 2FA auf allen Login-Wegen (Audit Block 1, Deploy A)

Audit vom 11.09. gegen HEAD geprüft, Entwicklungsplan dazu unter
dev/2026-09-11-audit/ENTWICKLUNGSPLAN.md. Dieser Commit ist Deploy A:
die sechs kleinen Punkte aus Block 1 ohne Schemaänderung.

F01: Der Fortify-Endpunkt PUT /user/profile-information tauschte die
E-Mail sofort und setzte die Verifizierung zurück; der Login-Sync vergab
danach Firmenrechte allein nach E-Mail-Treffer. Feature abgeschaltet
(die Kunden-UI hat den pending_email-Prozess), und der Sync verlangt
jetzt ein verifiziertes, aktives Konto – für alle Aufrufer.

F02: Google-Login übergibt Konten mit bestätigtem TOTP in die Challenge,
wie Passwort- und Magic-Link-Login.

F03: showRecoveryCodes ist gesperrt; ein Client-Update konnte die
Recovery-Codes entschlüsseln lassen.

F08: Nutzer-Detailroute unter can:users:manage (persistente Livewire-
Middleware), Gutschriften autorisieren zusätzlich in der Action.

F09: Gate::before greift nur für aktive Super-Admins; deaktivierte
fallen auf die Gates mit is_active-Prüfung zurück.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tests/Feature/Auth/ContactAccessTest.php

@@ -290,3 +290,45 @@ test('the honeypot blocks bots without creating an account', function () {
     Mail::assertNothingOutgoing();
     expect(User::query()->where('email', 'bot-target@example.test')->exists())->toBeFalse();
 });
+
+test('an unverified email earns no company membership on password login (Audit F01)', function () {
+    /** @var TestCase $this */
+    // Ein Konto hat seine Adresse auf eine fremde Firmen-Adresse gewechselt
+    // und ist deshalb unverifiziert – der Login-Sync darf daraus keine
+    // Firmenrechte ableiten, solange das Postfach nicht nachgewiesen ist.
+    $user = User::factory()->unverified()->create(['email' => 'fremd@example.test', 'is_active' => true]);
+    $user->assignRole('customer');
+
+    $company = Company::factory()->presseecho()->create(['email' => 'fremd@example.test']);
+    Contact::factory()->for($company)->create(['email' => 'fremd@example.test', 'portal' => $company->portal->value]);
+
+    Volt::test('auth.login')
+        ->set('email', 'fremd@example.test')
+        ->set('password', 'password')
+        ->call('login')
+        ->assertRedirect(route('verification.notice', absolute: false));
+
+    expect($user->fresh()->accessibleCompanyIds())->not->toContain($company->id);
+    expect($user->contacts()->count())->toBe(0);
+
+    // Nach Verifikation greift der Sync beim nächsten Login wie bisher.
+    $user->forceFill(['email_verified_at' => now()])->save();
+    app(ContactAccessService::class)->syncMembershipsForEmail($user->fresh());
+
+    expect($user->fresh()->accessibleCompanyIds())->toContain($company->id);
+});
+
+test('the membership sync ignores unverified and deactivated users regardless of the caller (Audit F01)', function () {
+    /** @var TestCase $this */
+    $company = Company::factory()->presseecho()->create(['email' => 'sync-guard@example.test']);
+
+    $unverified = User::factory()->unverified()->create(['email' => 'sync-guard@example.test', 'is_active' => true]);
+    app(ContactAccessService::class)->syncMembershipsForEmail($unverified);
+    expect($unverified->fresh()->accessibleCompanyIds())->not->toContain($company->id);
+
+    $unverified->forceDelete();
+
+    $inactive = User::factory()->create(['email' => 'sync-guard@example.test', 'is_active' => false]);
+    app(ContactAccessService::class)->syncMembershipsForEmail($inactive);
+    expect($inactive->fresh()->accessibleCompanyIds())->not->toContain($company->id);
+});

tests/Feature/Auth/GoogleLoginTest.php

@@ -5,6 +5,7 @@ use Database\Seeders\RolesAndPermissionsSeeder;
 use Laravel\Socialite\Contracts\Provider;
 use Laravel\Socialite\Facades\Socialite;
 use Laravel\Socialite\Two\User as SocialiteUser;
+use PragmaRX\Google2FA\Google2FA;
 use Tests\TestCase;
 
 beforeEach(function () {
@@ -103,3 +104,22 @@ test('a failed google callback redirects back to login with an error', function
 
     $this->assertGuest();
 });
+
+test('google login hands an account with confirmed two-factor to the challenge (Audit F02)', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create(['email' => 'totp-google@example.test', 'is_active' => true]);
+    $user->assignRole('customer');
+    $user->forceFill([
+        'two_factor_secret' => encrypt(app(Google2FA::class)->generateSecretKey()),
+        'two_factor_confirmed_at' => now(),
+    ])->save();
+
+    fakeGoogleUser('g-totp-1', 'totp-google@example.test', 'Totp');
+
+    $this->get(route('oauth.google.callback'))
+        ->assertRedirect(route('two-factor.challenge'));
+
+    $this->assertGuest();
+    expect(session('login.id'))->toBe($user->id);
+    expect($user->fresh()->last_login_at)->toBeNull();
+});

tests/Feature/Auth/UserAccessTest.php

@@ -2,6 +2,7 @@
 
 use App\Models\User;
 use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Support\Facades\Gate;
 use Tests\TestCase;
 
 test('active admin and editor users can access admin area', function () {
@@ -64,3 +65,18 @@ test('api-only and inactive users cannot access customer area', function () {
     expect($apiOnly->canAccessCustomer())->toBeFalse();
     expect($inactiveCustomer->canAccessCustomer())->toBeFalse();
 });
+
+test('a deactivated super admin is locked out of both panels despite the gate shortcut (Audit F09)', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create([
+        'is_active' => false,
+        'is_super_admin' => true,
+    ]);
+
+    expect($user->canAccessAdmin())->toBeFalse();
+    expect(Gate::forUser($user)->allows('access-admin'))->toBeFalse();
+    expect(Gate::forUser($user)->allows('access-customer'))->toBeFalse();
+
+    $this->actingAs($user)->get(route('dashboard'))->assertForbidden();
+    $this->actingAs($user)->get(route('me.dashboard'))->assertForbidden();
+});