T12: Depublikations-Checkout mit Tombstone (config-gated)

Kunden koennen eigene veroeffentlichte PMs kostenpflichtig aus der
oeffentlichen Ansicht nehmen: Panel auf der PM-Detailseite (inkl.
T1neu-Unternehmer-Checkbox und Doppelausweis netto/brutto), Stripe-
Ad-hoc-Checkout wie Credit-Topups, Erfuellung im Webhook — die PM
wechselt auf archived + depublished_at, die oeffentliche URL zeigt
dauerhaft einen Tombstone (410 Gone, ohne Inhalte, mit ehrlichem
Drittarchive-Hinweis). Doppelbuchungs-Bremse pro PM; Status-Log mit
Quelle "depublication". Gate: ohne BILLING_DEPUBLICATION_PRICE_CENTS
bleibt der Weg deaktiviert und /melden zeigt die neutrale
Preisformulierung [EXTERN: Preis festlegen, O6].

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Feature/Billing/DepublicationTest.php

@@ -0,0 +1,160 @@
+<?php
+
+use App\Enums\Portal;
+use App\Enums\PressReleaseStatus;
+use App\Enums\SinglePurchaseStatus;
+use App\Enums\SinglePurchaseType;
+use App\Listeners\ProcessStripeWebhook;
+use App\Models\BillingAddress;
+use App\Models\BookingConfirmation;
+use App\Models\PressRelease;
+use App\Models\SinglePurchase;
+use App\Models\User;
+use App\Services\Billing\StripeCheckoutService;
+use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Http\RedirectResponse;
+use Laravel\Cashier\Checkout;
+use Laravel\Cashier\Events\WebhookReceived;
+use Tests\TestCase;
+
+beforeEach(function (): void {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+    config()->set('billing.depublication_price_cents', 19900);
+});
+
+function depublicationCustomer(): User
+{
+    $user = User::factory()->create(['is_active' => true, 'email_verified_at' => now()]);
+    $user->assignRole('customer');
+    BillingAddress::factory()->create(['user_id' => $user->id]);
+
+    // B2B-Gate (T1neu): zeitnahe Unternehmer-Bestätigung.
+    BookingConfirmation::query()->create([
+        'user_id' => $user->id,
+        'booking_type' => 'depublication',
+        'agb_version' => (string) config('legal.agb_version'),
+        'confirmed_at' => now(),
+    ]);
+
+    return $user;
+}
+
+function publishedReleaseFor(User $user): PressRelease
+{
+    return PressRelease::factory()
+        ->published()
+        ->forPortal(Portal::Businessportal24)
+        ->create(['user_id' => $user->id, 'published_at' => now()->subDay()]);
+}
+
+test('the depublication checkout is disabled without a configured price', function () {
+    /** @var TestCase $this */
+    config()->set('billing.depublication_price_cents', null);
+    $user = depublicationCustomer();
+    $release = publishedReleaseFor($user);
+
+    $this->actingAs($user)
+        ->get(route('me.checkout.depublication', $release->id))
+        ->assertRedirect(route('me.bookings.index'))
+        ->assertSessionHas('checkout-notice');
+
+    expect(SinglePurchase::count())->toBe(0);
+});
+
+test('only own published releases can be depublished', function () {
+    /** @var TestCase $this */
+    $user = depublicationCustomer();
+
+    // Fremde PM → 404 (accessibleBy-Scope).
+    $foreign = PressRelease::factory()->published()->forPortal(Portal::Businessportal24)->create();
+    $this->actingAs($user)
+        ->get(route('me.checkout.depublication', $foreign->id))
+        ->assertNotFound();
+
+    // Eigener Entwurf → Hinweis statt Checkout.
+    $draft = PressRelease::factory()->forPortal(Portal::Businessportal24)->create([
+        'user_id' => $user->id,
+        'status' => PressReleaseStatus::Draft,
+    ]);
+    $this->actingAs($user)
+        ->get(route('me.checkout.depublication', $draft->id))
+        ->assertRedirect(route('me.bookings.index'))
+        ->assertSessionHas('checkout-notice');
+
+    expect(SinglePurchase::count())->toBe(0);
+});
+
+test('the depublication checkout creates a pending purchase and hands it to stripe', function () {
+    /** @var TestCase $this */
+    $user = depublicationCustomer();
+    $release = publishedReleaseFor($user);
+
+    $checkout = Mockery::mock(Checkout::class);
+    $checkout->shouldReceive('toResponse')->andReturn(new RedirectResponse('https://checkout.stripe.com/c/pay/test'));
+    $this->mock(StripeCheckoutService::class, function ($mock) use ($checkout) {
+        $mock->shouldReceive('forDepublication')->once()->andReturn($checkout);
+    });
+
+    $this->actingAs($user)
+        ->get(route('me.checkout.depublication', $release->id))
+        ->assertRedirect('https://checkout.stripe.com/c/pay/test');
+
+    $purchase = SinglePurchase::sole();
+    expect($purchase->type)->toBe(SinglePurchaseType::Depublication);
+    expect($purchase->status)->toBe(SinglePurchaseStatus::Pending);
+    expect($purchase->price_cents)->toBe(19900);
+    expect($purchase->press_release_id)->toBe($release->id);
+
+    // Doppelbuchungs-Bremse: zweiter Aufruf legt keinen weiteren Kauf an.
+    $this->actingAs($user)
+        ->get(route('me.checkout.depublication', $release->id))
+        ->assertRedirect(route('me.bookings.index'));
+
+    expect(SinglePurchase::count())->toBe(1);
+});
+
+test('the paid webhook depublishes the release and the public page shows a tombstone', function () {
+    /** @var TestCase $this */
+    $user = depublicationCustomer();
+    $release = publishedReleaseFor($user);
+
+    $purchase = SinglePurchase::query()->create([
+        'user_id' => $user->id,
+        'type' => SinglePurchaseType::Depublication->value,
+        'status' => SinglePurchaseStatus::Pending->value,
+        'price_cents' => 19900,
+        'currency' => 'EUR',
+        'press_release_id' => $release->id,
+    ]);
+
+    $event = new WebhookReceived([
+        'type' => 'checkout.session.completed',
+        'data' => ['object' => [
+            'id' => 'cs_test_depub',
+            'payment_intent' => 'pi_test_depub',
+            'metadata' => ['single_purchase_id' => (string) $purchase->id],
+        ]],
+    ]);
+
+    app(ProcessStripeWebhook::class)->handle($event);
+    app(ProcessStripeWebhook::class)->handle($event); // Replay bleibt folgenlos.
+
+    $release->refresh();
+    expect($release->status)->toBe(PressReleaseStatus::Archived);
+    expect($release->depublished_at)->not->toBeNull();
+    expect($purchase->fresh()->status)->toBe(SinglePurchaseStatus::Paid);
+    expect($purchase->fresh()->consumed_at)->not->toBeNull();
+    expect($release->statusLogs()->count())->toBeGreaterThan(0);
+
+    // Öffentliche URL: Tombstone mit 410 Gone statt 404, ohne Inhalte.
+    $this->get('https://businessportal24.test/de/press-release/'.$release->slug)
+        ->assertStatus(410)
+        ->assertSeeText('Diese Pressemitteilung wurde entfernt')
+        ->assertSeeText('auf Wunsch des Absenders')
+        ->assertDontSeeText($release->title);
+
+    // Unbekannte Slugs bleiben 404.
+    $this->get('https://businessportal24.test/de/press-release/gibt-es-nicht')
+        ->assertNotFound();
+});