T10: DSA-Meldeformulare mit URL-Feld, Vorgangsnummer und Eingangsbestaetigung

Zwei eigenstaendige Formulare unter /melden/rechtswidrig (DSA Art. 16:
URL, Name, E-Mail, Begruendung, Wahrheitsversicherung) und
/melden/kontaktdaten (DSGVO-Antrag) auf allen drei Domains. Gemeldete
URLs werden automatisch der passenden veroeffentlichten PM zugeordnet;
ohne Treffer bleibt die URL im payload. Jede Meldung erhaelt eine
Vorgangsnummer (M-{id}, analog K-{id} der Kuendigung), die meldende
Person unverzueglich eine Eingangsbestaetigung (DSA Art. 16 Abs. 4) und
das Melde-Postfach einen internen Hinweis — auch im bestehenden
Per-PM-Flow. Admin-Queue zeigt Vorgangsnummer, Name und gemeldete URL;
/melden verlinkt die neuen Formulare als ersten Weg.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Feature/LegalRequestTest.php

@@ -3,10 +3,13 @@
 use App\Enums\LegalRequestStatus;
 use App\Enums\LegalRequestType;
 use App\Enums\Portal;
+use App\Mail\LegalRequestReceived;
+use App\Mail\LegalRequestSubmitted;
 use App\Models\LegalRequest;
 use App\Models\PressRelease;
 use App\Models\User;
 use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Support\Facades\Mail;
 use Livewire\Volt\Volt;
 use Tests\TestCase;
 
@@ -51,13 +54,15 @@ test('the form 404s for a non-published release', function () {
 
 test('a dsgvo request is stored in the queue', function () {
     /** @var TestCase $this */
+    Mail::fake();
     $release = publishedRelease();
 
     $this->post(route('legal-request.store', ['slug' => $release->slug]), [
         'type' => LegalRequestType::Dsgvo->value,
         'requester_email' => 'betroffen@example.test',
         'message' => 'Bitte meine personenbezogenen Daten anonymisieren.',
-    ])->assertRedirect(route('release.detail', ['slug' => $release->slug]));
+    ])->assertRedirect(route('release.detail', ['slug' => $release->slug]))
+        ->assertSessionHas('legal-status');
 
     $request = LegalRequest::query()->firstOrFail();
 
@@ -66,6 +71,11 @@ test('a dsgvo request is stored in the queue', function () {
     expect($request->press_release_id)->toBe($release->id);
     expect($request->requester_email)->toBe('betroffen@example.test');
     expect($request->portal)->toBe(Portal::Businessportal24->value);
+
+    // T10: Vorgangsnummer im Hinweis + Eingangsbestätigung/Queue-Hinweis.
+    expect(session('legal-status'))->toContain($request->reference());
+    Mail::assertSent(LegalRequestReceived::class, fn ($mail) => $mail->hasTo('betroffen@example.test'));
+    Mail::assertSent(LegalRequestSubmitted::class);
 });
 
 test('a personal rights request requires an email', function () {
@@ -82,6 +92,7 @@ test('a personal rights request requires an email', function () {
 
 test('a report can be submitted without an email and feeds the same queue', function () {
     /** @var TestCase $this */
+    Mail::fake();
     $release = publishedRelease();
 
     $this->post(route('legal-request.store', ['slug' => $release->slug]), [
@@ -93,6 +104,10 @@ test('a report can be submitted without an email and feeds the same queue', func
 
     expect($request->type)->toBe(LegalRequestType::Report);
     expect($request->requester_email)->toBeNull();
+
+    // Ohne E-Mail keine Eingangsbestätigung — der interne Hinweis geht trotzdem raus.
+    Mail::assertNotSent(LegalRequestReceived::class);
+    Mail::assertSent(LegalRequestSubmitted::class);
 });
 
 test('a filled honeypot field blocks bots without creating a request', function (string $field) {

tests/Feature/Web/ReportFormTest.php

@@ -0,0 +1,129 @@
+<?php
+
+use App\Enums\LegalRequestType;
+use App\Enums\Portal;
+use App\Mail\LegalRequestReceived;
+use App\Mail\LegalRequestSubmitted;
+use App\Models\LegalRequest;
+use App\Models\PressRelease;
+use Illuminate\Support\Facades\Mail;
+use Tests\TestCase;
+
+test('the standalone report forms render on every domain', function (string $way, string $heading) {
+    /** @var TestCase $this */
+    $this->get("https://presseecho.test/de/melden/{$way}")
+        ->assertSuccessful()
+        ->assertSeeText($heading)
+        ->assertSee('name="reported_url"', false);
+
+    $this->get("https://pressekonto.test/de/melden/{$way}")->assertSuccessful();
+})->with([
+    'rechtswidrig' => ['rechtswidrig', 'Rechtswidrige Inhalte melden'],
+    'kontaktdaten' => ['kontaktdaten', 'Eigene Kontaktdaten entfernen lassen'],
+]);
+
+test('an illegal content report creates a request and confirms receipt with a reference', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $response = $this->from('https://businessportal24.test/de/melden/rechtswidrig')
+        ->post('https://businessportal24.test/de/melden/rechtswidrig', [
+            'reported_url' => 'https://businessportal24.com/de/press-release/irgendein-artikel',
+            'requester_name' => 'Erika Musterfrau',
+            'requester_email' => 'erika@example.com',
+            'message' => 'Diese Mitteilung enthält nachweislich falsche Tatsachenbehauptungen über mich.',
+            'truth_affirmed' => '1',
+        ]);
+
+    $response->assertRedirect('https://businessportal24.test/de/melden/rechtswidrig')
+        ->assertSessionHas('report-status');
+
+    $request = LegalRequest::query()->sole();
+    expect($request->type)->toBe(LegalRequestType::Report);
+    expect($request->requester_email)->toBe('erika@example.com');
+    expect($request->requesterName())->toBe('Erika Musterfrau');
+    expect($request->reportedUrl())->toBe('https://businessportal24.com/de/press-release/irgendein-artikel');
+    expect($request->payload['truth_affirmed'])->toBeTrue();
+    expect($request->portal)->toBe('businessportal24');
+    expect(session('report-status'))->toContain($request->reference());
+
+    // DSA Art. 16 Abs. 4: unverzügliche Eingangsbestätigung + interner Hinweis.
+    Mail::assertSent(LegalRequestReceived::class, fn ($mail) => $mail->hasTo('erika@example.com'));
+    Mail::assertSent(LegalRequestSubmitted::class);
+});
+
+test('a reported url matching a published release is linked to it', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $release = PressRelease::factory()
+        ->published()
+        ->forPortal(Portal::Businessportal24)
+        ->create(['published_at' => now()->subDay()]);
+
+    $this->post('https://businessportal24.test/de/melden/rechtswidrig', [
+        'reported_url' => 'https://businessportal24.com/de/press-release/'.$release->slug,
+        'requester_name' => 'Erika Musterfrau',
+        'requester_email' => 'erika@example.com',
+        'message' => 'Diese Mitteilung verletzt meine Markenrechte an mehreren Stellen.',
+        'truth_affirmed' => '1',
+    ]);
+
+    expect(LegalRequest::query()->sole()->press_release_id)->toBe($release->id);
+});
+
+test('the illegal content report requires the truthfulness affirmation and a valid url', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $this->from('https://businessportal24.test/de/melden/rechtswidrig')
+        ->post('https://businessportal24.test/de/melden/rechtswidrig', [
+            'reported_url' => 'keine-url',
+            'requester_name' => 'Erika Musterfrau',
+            'requester_email' => 'erika@example.com',
+            'message' => 'Diese Mitteilung enthält falsche Tatsachenbehauptungen über mich.',
+        ])
+        ->assertSessionHasErrors(['reported_url', 'truth_affirmed']);
+
+    expect(LegalRequest::query()->count())->toBe(0);
+    Mail::assertNothingSent();
+});
+
+test('the contact data removal form creates a dsgvo request without affirmation checkbox', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $this->post('https://presseecho.test/de/melden/kontaktdaten', [
+        'reported_url' => 'https://presseecho.de/de/press-release/alter-artikel',
+        'requester_name' => 'Max Mustermann',
+        'requester_email' => 'max@example.com',
+        'message' => 'Mein Name und meine Telefonnummer stehen im Pressekontakt dieser Mitteilung.',
+    ])->assertSessionHas('report-status');
+
+    $request = LegalRequest::query()->sole();
+    expect($request->type)->toBe(LegalRequestType::Dsgvo);
+    expect($request->portal)->toBe('presseecho');
+    Mail::assertSent(LegalRequestReceived::class);
+});
+
+test('a filled honeypot is silently discarded', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $this->post('https://businessportal24.test/de/melden/rechtswidrig', [
+        'reported_url' => 'https://businessportal24.com/de/press-release/spam',
+        'requester_name' => 'Bot',
+        'requester_email' => 'bot@example.com',
+        'message' => 'Automatisch generierter Inhalt mit ausreichend vielen Zeichen.',
+        'truth_affirmed' => '1',
+        'website' => 'https://spam.example.com',
+    ])->assertSessionHas('report-status');
+
+    expect(LegalRequest::query()->count())->toBe(0);
+    Mail::assertNothingSent();
+});
+
+test('an unknown form way responds 404', function () {
+    /** @var TestCase $this */
+    $this->get('https://businessportal24.test/de/melden/sonstiges')->assertNotFound();
+});