gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

feat: API-Zugang endet mit der Buchung, optionales Ablaufdatum für API-Tokens
Some checks are pending
linter / quality (push) Waiting to run
Details
tests / ci (push) Waiting to run
Details

Browse source 
Bisher blieb ein einmal erstellter Token gültig, auch wenn Abo bzw. Buchung
längst beendet waren. EnsureApiAccessIsBooked prüft jetzt bei jeder Anfrage
(v1 und /service/…-Altpfade), ob das Konto API-Zugang hat
(ApiAccessEligibilityService::hasApiAccess), sonst 403. Die Tokens bleiben
erhalten und funktionieren nach erneuter Buchung wieder.

Kunden können beim Erstellen optional ein Ablaufdatum setzen (bis 5 Jahre);
die Token-Liste zeigt „Gültig bis“ und einen Hinweis, wenn der Zugang
pausiert ist. sanctum:prune-expired räumt abgelaufene Tokens nach 30 Tagen
täglich ab. API-Doku (public/api/v1.yml) ergänzt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-10-08 11:41:24 +00:00
parent 7fa310fa76
commit 6d85d2982a
24 changed files with 319 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

9
tests/Feature/Api/ApiPortalResolutionTest.php
View file

@ -7,7 +7,6 @@ use App\Models\PressRelease;
use App\Models\User;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Support\Facades\Queue;
use Laravel\Sanctum\Sanctum;
use Tests\TestCase;
/**
@ -28,7 +27,7 @@ function portalResolutionApiUser(Portal $portal = Portal::Businessportal24): Use
]);
$user->forceFill(['registration_type' => 'apiuser'])->save();
Sanctum::actingAs($user, [
apiActingAs($user, [
'press-releases:read',
'press-releases:write',
'companies:read',
@ -150,7 +149,7 @@ test('v1 press release creation resolves the portal from parameter and domain',
$category = Category::factory()->withTranslations()->create(['portal' => Portal::Both]);
$user->companies()->attach($company->id, ['role' => 'owner']);
Sanctum::actingAs($user, ['press-releases:read', 'press-releases:write']);
apiActingAs($user, ['press-releases:read', 'press-releases:write']);
config()->set('app.theme', 'presseecho');
@ -179,7 +178,7 @@ test('v1 press release creation rejects the portal value both', function () {
$category = Category::factory()->withTranslations()->create(['portal' => Portal::Both]);
$user->companies()->attach($company->id, ['role' => 'owner']);
Sanctum::actingAs($user, ['press-releases:read', 'press-releases:write']);
apiActingAs($user, ['press-releases:read', 'press-releases:write']);
$this->postJson('/api/v1/press-releases', [
'portal' => 'both',
@ -204,7 +203,7 @@ test('v1 update keeps the portal unless an explicit portal parameter is sent', f
->for(Category::factory()->withTranslations()->create(['portal' => Portal::Both]))
->create(['user_id' => $user->id, 'company_id' => $company->id]);
Sanctum::actingAs($user, ['press-releases:read', 'press-releases:write']);
apiActingAs($user, ['press-releases:read', 'press-releases:write']);
// Update über die "falsche" Domain verschiebt die PM nicht …
config()->set('app.theme', 'presseecho');