press-releases: Publish-Rechte, Quota-Races & Slug vereinheitlichen

- Publish/Reject/Archive und changeStatus erzwingen konsistent
  press-releases:publish; changeStatus schloss die Lücke, über die das
  Status-Modal die Prüfung umging (Fix#1/H2).
- publish()/changeStatusFromAdmin sperren PM- und User-Zeile
  transaktional; QuotaExceededException wird in Admin-Publish und im
  Auto-Publish-Job abgefangen (Warnung statt 500 / bleibt in Review, Fix#3/M2).
- Slug-Erzeugung nur noch über HasUniqueSlug (generateUniqueSlug +
  saveWithUniqueSlugRetry), redundanter Controller-Helper entfernt (M3).
- API-/Legacy-Text wird vor der Persistenz sanitisiert (M6);
  Scheduler/Legacy-Tracking ignorieren soft-gelöschte PMs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/Http/Controllers/Api/Legacy/LegacyPressReleaseController.php

@@ -3,15 +3,16 @@
 namespace App\Http\Controllers\Api\Legacy;
 
 use App\Enums\AiTextDeclaration;
-use App\Enums\PressReleaseEventType;
 use App\Enums\PressReleaseStatus;
 use App\Http\Controllers\Controller;
 use App\Models\AppSetting;
 use App\Models\Category;
 use App\Models\Company;
 use App\Models\PressRelease;
+use App\Scopes\PortalScope;
 use App\Services\PressRelease\BlacklistViolationException;
 use App\Services\PressRelease\BookingRequiredException;
+use App\Services\PressRelease\PressReleaseHtmlSanitizer;
 use App\Services\PressRelease\PressReleaseService;
 use App\Services\PressRelease\QuotaExceededException;
 use Illuminate\Http\JsonResponse;
@@ -19,6 +20,8 @@ use Illuminate\Http\Request;
 use Illuminate\Support\Str;
 use Illuminate\Validation\ValidationException;
 
+use function Illuminate\Support\defer;
+
 /**
  * Alt-Vertrag POST/GET /service/pressreleases (Paritäts-Doku §1/§4):
  *
@@ -37,8 +40,13 @@ class LegacyPressReleaseController extends Controller
 
     public const SETTING_AI_REVIEW = 'legacy_api_ai_review';
 
-    public function store(Request $request, PressReleaseService $service): JsonResponse
-    {
+    public function store(
+        Request $request,
+        PressReleaseService $service,
+        PressReleaseHtmlSanitizer $sanitizer,
+    ): JsonResponse {
+        abort_unless($request->user()->tokenCan('press-releases:write'), 403);
+
         try {
             $validated = $request->validate([
                 'press_release' => ['required', 'array'],
@@ -77,13 +85,16 @@ class LegacyPressReleaseController extends Controller
         }
 
         $language = strtolower(substr((string) ($validated['language'] ?? 'de'), 0, 2)) ?: 'de';
+        $text = $sanitizer->isHtml($validated['text'])
+            ? $sanitizer->clean($validated['text'])
+            : $validated['text'];
 
         $pressRelease = new PressRelease([
             'company_id' => $company->id,
             'category_id' => $category->id,
             'language' => $language,
             'title' => $validated['title'],
-            'text' => $validated['text'],
+            'text' => $text,
             'backlink_url' => $validated['backlink_url'] ?? null,
             'keywords' => $validated['keywords'] ?? null,
             'status' => PressReleaseStatus::Draft->value,
@@ -99,7 +110,10 @@ class LegacyPressReleaseController extends Controller
             'portal' => $pressRelease->portal,
             'language' => $language,
         ]);
-        $pressRelease->save();
+        $pressRelease->saveWithUniqueSlugRetry($pressRelease->title, [
+            'portal' => $pressRelease->portal,
+            'language' => $language,
+        ]);
 
         if (! empty($validated['contacts_list'])) {
             $ownContactIds = $company->contacts()->whereIn('contacts.id', $validated['contacts_list'])->pluck('contacts.id');
@@ -137,7 +151,7 @@ class LegacyPressReleaseController extends Controller
 
     public function show(Request $request, int $pressRelease): JsonResponse
     {
-        $pressRelease = PressRelease::withoutGlobalScopes()
+        $pressRelease = PressRelease::withoutGlobalScope(PortalScope::class)
             ->whereKey($pressRelease)
             ->with(['company'])
             ->first();
@@ -150,11 +164,10 @@ class LegacyPressReleaseController extends Controller
             return $this->legacyError(404, ['Not found.']);
         }
 
-        // Hit-Zählung wie im Altsystem (dort auch für API-Abrufe).
-        PressRelease::withoutGlobalScopes()
-            ->whereKey($pressRelease->getKey())
-            ->update(['hits' => ($pressRelease->hits ?? 0) + 1]);
-        $pressRelease->events()->create(['type' => PressReleaseEventType::View]);
+        // Hit-Zählung wie im Altsystem (dort auch für API-Abrufe), aber erst
+        // nach der Antwort und atomar, damit parallele Polls keine Hits verlieren.
+        $pressReleaseId = $pressRelease->getKey();
+        defer(static fn () => PressRelease::recordDeferredView($pressReleaseId));
 
         $spokeUrl = $this->spokeBaseUrl($pressRelease->portal?->value);
 

app/Http/Controllers/Api/V1/PressReleaseController.php

@@ -13,6 +13,7 @@ use App\Models\PressRelease;
 use App\Services\PressRelease\AiDeclarationRequiredException;
 use App\Services\PressRelease\BlacklistViolationException;
 use App\Services\PressRelease\BookingRequiredException;
+use App\Services\PressRelease\PressReleaseHtmlSanitizer;
 use App\Services\PressRelease\PressReleaseService;
 use App\Services\PressRelease\QuotaExceededException;
 use Illuminate\Http\JsonResponse;
@@ -40,20 +41,15 @@ class PressReleaseController extends Controller
 
     public function store(StorePressReleaseRequest $request): JsonResponse
     {
-        $validated = $request->validated();
+        $validated = $this->sanitizeHtmlText($request->validated());
         $company = $this->findOwnedCompany((int) $validated['company_id'], $request);
         abort_unless($company !== null, 403);
 
-        $pressRelease = PressRelease::withoutGlobalScopes()->create([
+        $pressRelease = new PressRelease([
             ...$validated,
             'uuid' => (string) Str::uuid(),
             'user_id' => $request->user()->id,
             'portal' => $company->portal->value,
-            'slug' => $this->uniqueSlug(
-                Str::slug($validated['title']),
-                $company->portal->value,
-                $validated['language'],
-            ),
             // Über die API angelegte PMs sind immer Entwürfe. Der Übergang nach
             // `review` erfolgt ausschließlich über die explizite submit-Route,
             // damit Blacklist-/Quota-/Log-Prüfung garantiert durchlaufen werden.
@@ -68,6 +64,14 @@ class PressReleaseController extends Controller
                 'ai_declaration_confirmed_at' => now(),
             ] : []),
         ]);
+        $pressRelease->slug = $pressRelease->generateUniqueSlug($validated['title'], [
+            'portal' => $company->portal->value,
+            'language' => $validated['language'],
+        ]);
+        $pressRelease->saveWithUniqueSlugRetry($validated['title'], [
+            'portal' => $company->portal->value,
+            'language' => $validated['language'],
+        ]);
 
         return PressReleaseResource::make(
             $pressRelease->load($this->apiResourceRelations())
@@ -96,7 +100,7 @@ class PressReleaseController extends Controller
             ], 409);
         }
 
-        $validated = $request->validated();
+        $validated = $this->sanitizeHtmlText($request->validated());
         $company = isset($validated['company_id'])
             ? $this->findOwnedCompany((int) $validated['company_id'], $request)
             : $this->findOwnedCompany((int) $pressRelease->company_id, $request);
@@ -116,10 +120,17 @@ class PressReleaseController extends Controller
             || array_key_exists('language', $validated)
             || array_key_exists('company_id', $validated)
         ) {
-            $pressRelease->slug = $this->uniqueSlug(Str::slug($title), $portal, $language, $pressRelease->id);
+            // Selbst-Ausschluss übernimmt der Trait automatisch ($self->exists).
+            $pressRelease->slug = $pressRelease->generateUniqueSlug($title, [
+                'portal' => $portal,
+                'language' => $language,
+            ]);
         }
 
-        $pressRelease->save();
+        $pressRelease->saveWithUniqueSlugRetry($title, [
+            'portal' => $portal,
+            'language' => $language,
+        ]);
 
         // Inhaltliche Änderung einer bereits geprüften/bewerteten PM → neu prüfen.
         if ($pressRelease->wasChanged(['title', 'text'])) {
@@ -247,24 +258,24 @@ class PressReleaseController extends Controller
         return str_starts_with((string) $request->route()?->getName(), 'legacy-service.');
     }
 
-    private function uniqueSlug(string $baseSlug, string $portal, string $language, ?int $excludeId = null): string
+    /**
+     * Säubert einen per API übergebenen HTML-Text vor der Persistenz — analog
+     * zum Web-Formular, das immer über den Sanitizer speichert. Nur HTML wird
+     * durch HTMLPurifier gejagt; Legacy-Plaintext bleibt unverändert (wird beim
+     * Rendern ohnehin escaped), damit `<`/`&` in Klartext-Einreichungen nicht
+     * zerstört werden.
+     *
+     * @param  array<string, mixed>  $validated
+     * @return array<string, mixed>
+     */
+    private function sanitizeHtmlText(array $validated): array
     {
-        $slug = $baseSlug !== '' ? $baseSlug : Str::random(8);
-        $candidate = $slug;
-        $suffix = 2;
+        $sanitizer = app(PressReleaseHtmlSanitizer::class);
 
-        while (
-            PressRelease::withoutGlobalScopes()
-                ->where('portal', $portal)
-                ->where('language', $language)
-                ->where('slug', $candidate)
-                ->when($excludeId !== null, fn ($query) => $query->whereKeyNot($excludeId))
-                ->exists()
-        ) {
-            $candidate = "{$slug}-{$suffix}";
-            $suffix++;
+        if (array_key_exists('text', $validated) && $sanitizer->isHtml($validated['text'])) {
+            $validated['text'] = $sanitizer->clean($validated['text']);
         }
 
-        return $candidate;
+        return $validated;
     }
 }