12-05-2026 Frontend dev

tests/Feature/PressReleasePreviewTest.php

@@ -0,0 +1,74 @@
+<?php
+
+use App\Enums\PressReleaseStatus;
+use App\Models\PressRelease;
+use App\Models\User;
+use App\Services\Auth\MagicLinkGenerator;
+use Tests\TestCase;
+
+test('preview link returns press release for valid unexpired token', function () {
+    /** @var TestCase $this */
+    $owner = User::factory()->create();
+    $pr = PressRelease::factory()->create([
+        'user_id' => $owner->id,
+        'status' => PressReleaseStatus::Draft->value,
+        'title' => 'Geheime Vorschau',
+        'text' => 'Vertraulicher Inhalt für unsere Partner.',
+    ]);
+
+    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);
+
+    $this->get(route('press-releases.preview', ['token' => $share['plain_token']]))
+        ->assertOk()
+        ->assertSee('Geheime Vorschau')
+        ->assertSee('Vertraulicher Inhalt');
+});
+
+test('preview link allows access to draft press release without authentication', function () {
+    /** @var TestCase $this */
+    $owner = User::factory()->create();
+    $pr = PressRelease::factory()->create([
+        'user_id' => $owner->id,
+        'status' => PressReleaseStatus::Review->value,
+    ]);
+
+    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);
+
+    $response = $this->get(route('press-releases.preview', ['token' => $share['plain_token']]));
+
+    $response->assertOk();
+    expect(auth()->check())->toBeFalse();
+});
+
+test('expired preview link returns 410 gone', function () {
+    /** @var TestCase $this */
+    $owner = User::factory()->create();
+    $pr = PressRelease::factory()->create(['user_id' => $owner->id]);
+
+    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);
+    $share['magic_link']->update(['expires_at' => now()->subMinute()]);
+
+    $this->get(route('press-releases.preview', ['token' => $share['plain_token']]))
+        ->assertStatus(410)
+        ->assertSee('abgelaufen');
+});
+
+test('invalid token returns 404', function () {
+    /** @var TestCase $this */
+    $this->get(route('press-releases.preview', ['token' => str_repeat('a', 64)]))
+        ->assertStatus(404)
+        ->assertSee('ungültig');
+});
+
+test('preview link for soft deleted press release returns 404', function () {
+    /** @var TestCase $this */
+    $owner = User::factory()->create();
+    $pr = PressRelease::factory()->create(['user_id' => $owner->id]);
+
+    $share = app(MagicLinkGenerator::class)->createPressReleaseShareLink($pr, $owner);
+
+    $pr->forceDelete();
+
+    $this->get(route('press-releases.preview', ['token' => $share['plain_token']]))
+        ->assertStatus(404);
+});