security: Rechteausweitung schließen & Admin-Panel feingranular gaten (K1, H1, H2, M8)

- users:manage/roles:manage auf allen User-/Rollen-Masken erzwungen;
  is_super_admin aus $fillable entfernt und nur per autorisiertem
  forceFill setzbar; zentraler Gate::before-Super-Admin-Kurzschluss (K1/M8).
- Nicht-Super-Admins können Super-Admin-Konten nicht mehr bearbeiten (Fix#2);
  Impersonation mit Rangprüfung, keine Token-Erstellung während Impersonation (H1).
- Destruktive/verwaltende Admin-Aktionen (CRM/Billing/Compliance/Struktur)
  hängen an neuen admin-only Permissions; Editor behält reine Content-Rechte (H2).
- Kanonischer Permission-Katalog (App\Authorization\Permission) als Single
  Source of Truth für Seeder und Monitoring.

Deployment: `php artisan db:seed --class=RolesAndPermissionsSeeder` auf allen
Umgebungen ausführen (neue Permissions).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Feature/Admin/AdminPrivilegeEscalationTest.php

@@ -0,0 +1,134 @@
+<?php
+
+use App\Models\User;
+use Database\Seeders\RolesAndPermissionsSeeder;
+use Livewire\Volt\Volt as LivewireVolt;
+use Tests\TestCase;
+
+/**
+ * Regression zu Befund K1/M8 (Audit 14.07.2026):
+ * Die Rolle `editor` hat Admin-Panel-Zugriff (`access-admin`), aber bewusst
+ * NICHT `users:manage`/`roles:manage`. Die Benutzer-/Rollenverwaltung darf
+ * daher für sie gesperrt sein, und `is_super_admin` darf nur ein Super-Admin
+ * vergeben.
+ */
+beforeEach(function () {
+    $this->seed(RolesAndPermissionsSeeder::class);
+});
+
+test('editor cannot open user or role management pages', function () {
+    /** @var TestCase $this */
+    $editor = User::factory()->create();
+    $editor->assignRole('editor');
+
+    $target = User::factory()->create();
+    $target->assignRole('customer');
+
+    $this->actingAs($editor);
+
+    foreach ([
+        'https://pressekonto.test/admin/users',
+        'https://pressekonto.test/admin/users/create',
+        "https://pressekonto.test/admin/users/{$target->id}",
+        "https://pressekonto.test/admin/users/{$target->id}/edit",
+        'https://pressekonto.test/admin/roles',
+        'https://pressekonto.test/admin/roles/create',
+    ] as $url) {
+        $this->get($url)->assertForbidden();
+    }
+});
+
+test('admin can open user and role management pages', function () {
+    /** @var TestCase $this */
+    $admin = User::factory()->create();
+    $admin->assignRole('admin');
+
+    $this->actingAs($admin);
+
+    $this->get('https://pressekonto.test/admin/users')->assertSuccessful();
+    $this->get('https://pressekonto.test/admin/roles')->assertSuccessful();
+});
+
+test('editor cannot mutate roles via the roles component', function () {
+    /** @var TestCase $this */
+    $editor = User::factory()->create();
+    $editor->assignRole('editor');
+
+    $this->actingAs($editor);
+
+    LivewireVolt::test('admin.roles.create')->assertForbidden();
+});
+
+test('non super admin cannot elevate a user to super admin', function () {
+    /** @var TestCase $this */
+    $admin = User::factory()->create();
+    $admin->assignRole('admin'); // hat users:manage, ist aber kein Super-Admin
+
+    $target = User::factory()->create(['email' => 'target@example.com']);
+    $target->assignRole('customer');
+
+    $this->actingAs($admin);
+
+    LivewireVolt::test('admin.users.edit', ['id' => $target->id])
+        ->set('name', 'Ziel Benutzer')
+        ->set('email', 'target@example.com')
+        ->set('selectedRoles', ['customer'])
+        ->set('isSuperAdmin', true)
+        ->call('save')
+        ->assertHasNoErrors();
+
+    expect($target->fresh()->is_super_admin)->toBeFalse();
+});
+
+test('super admin can elevate a user to super admin', function () {
+    /** @var TestCase $this */
+    $superAdmin = User::factory()->superAdmin()->create();
+
+    $target = User::factory()->create(['email' => 'target@example.com']);
+    $target->assignRole('customer');
+
+    $this->actingAs($superAdmin);
+
+    LivewireVolt::test('admin.users.edit', ['id' => $target->id])
+        ->set('name', 'Ziel Benutzer')
+        ->set('email', 'target@example.com')
+        ->set('selectedRoles', ['customer'])
+        ->set('isSuperAdmin', true)
+        ->call('save')
+        ->assertHasNoErrors();
+
+    expect($target->fresh()->is_super_admin)->toBeTrue();
+});
+
+test('non super admin cannot open the edit page of a super admin', function () {
+    /** @var TestCase $this */
+    $admin = User::factory()->create();
+    $admin->assignRole('admin'); // users:manage, aber kein Super-Admin
+
+    $superAdmin = User::factory()->superAdmin()->create();
+
+    $this->actingAs($admin);
+
+    $this->get("https://pressekonto.test/admin/users/{$superAdmin->id}/edit")->assertForbidden();
+});
+
+test('super admin can still edit another super admin', function () {
+    /** @var TestCase $this */
+    $superAdmin = User::factory()->superAdmin()->create();
+    $target = User::factory()->superAdmin()->create(['email' => 'peer@example.com']);
+
+    $this->actingAs($superAdmin);
+
+    $this->get("https://pressekonto.test/admin/users/{$target->id}/edit")->assertSuccessful();
+});
+
+test('is_super_admin is not mass assignable', function () {
+    /** @var TestCase $this */
+    $user = User::query()->create([
+        'name' => 'Massenzuweisung',
+        'email' => 'mass@example.com',
+        'is_super_admin' => true,
+    ]);
+
+    expect($user->fresh()->is_super_admin)->toBeFalse();
+});

tests/Feature/Admin/EditorPermissionBoundaryTest.php

@@ -0,0 +1,124 @@
+<?php
+
+use App\Http\Controllers\Api\Legacy\LegacyPressReleaseController;
+use App\Models\AppSetting;
+use App\Models\Company;
+use App\Models\Contact;
+use App\Models\User;
+use Database\Seeders\RolesAndPermissionsSeeder;
+use Livewire\Volt\Volt as LivewireVolt;
+use Tests\TestCase;
+
+/**
+ * Regression zu Befund H2 (Audit 14.07.2026): Die Rolle `editor` behält ihre
+ * Content-Rechte (PMs), darf aber keine destruktiven CRM-/Billing-/Compliance-/
+ * Struktur-Aktionen ausführen. Gekoppelt an die neuen Seeder-Permissions
+ * companies:write / categories:manage / footer-codes:manage / billing:manage /
+ * compliance:manage.
+ */
+beforeEach(function () {
+    $this->seed(RolesAndPermissionsSeeder::class);
+});
+
+function editorActor(): User
+{
+    $editor = User::factory()->create();
+    $editor->assignRole('editor');
+
+    return $editor;
+}
+
+test('editor is blocked from admin-only management pages', function () {
+    /** @var TestCase $this */
+    $this->actingAs(editorActor());
+
+    foreach ([
+        'admin/categories',
+        'admin/categories/create',
+        'admin/footer-codes',
+        'admin/footer-codes/create',
+        'admin/payments',
+        'admin/coupons',
+        'admin/invoices',
+        'admin/legal-requests',
+        'admin/contact-messages',
+    ] as $path) {
+        $this->get("https://pressekonto.test/{$path}")->assertForbidden();
+    }
+});
+
+test('editor keeps access to content and read-only CRM pages', function () {
+    /** @var TestCase $this */
+    $this->actingAs(editorActor());
+
+    $this->get('https://pressekonto.test/admin/press-releases')->assertSuccessful();
+    $this->get('https://pressekonto.test/admin/companies')->assertSuccessful();
+    $this->get('https://pressekonto.test/admin/contacts')->assertSuccessful();
+});
+
+test('editor cannot open company write forms', function () {
+    /** @var TestCase $this */
+    $company = Company::factory()->presseecho()->create();
+    $this->actingAs(editorActor());
+
+    $this->get('https://pressekonto.test/admin/companies/create')->assertForbidden();
+    $this->get("https://pressekonto.test/admin/companies/{$company->id}/edit")->assertForbidden();
+});
+
+test('editor cannot delete a contact from the index', function () {
+    /** @var TestCase $this */
+    $company = Company::factory()->presseecho()->create();
+    $contact = Contact::factory()->for($company)->create();
+
+    $this->actingAs(editorActor());
+
+    LivewireVolt::test('admin.contacts.index')
+        ->call('deleteContactFromIndex', $contact->id)
+        ->assertForbidden();
+
+    expect(Contact::query()->whereKey($contact->id)->exists())->toBeTrue();
+});
+
+test('editor cannot invoke admin-only livewire actions directly', function () {
+    /** @var TestCase $this */
+    $this->actingAs(editorActor());
+
+    LivewireVolt::test('admin.categories.create')
+        ->call('save')
+        ->assertForbidden();
+
+    LivewireVolt::test('admin.footer-codes.create')
+        ->call('save')
+        ->assertForbidden();
+
+    LivewireVolt::test('admin.payments.index')
+        ->call('cancelBundle', 999_999)
+        ->assertForbidden();
+
+    LivewireVolt::test('admin.legal-requests.index')
+        ->call('resolveWithdrawal', 999_999)
+        ->assertForbidden();
+
+    LivewireVolt::test('admin.press-releases.index')
+        ->set('legacyApiAiReview', true)
+        ->assertForbidden();
+
+    expect(AppSetting::getBool(LegacyPressReleaseController::SETTING_AI_REVIEW))->toBeFalse();
+});
+
+test('admin retains access to all restricted management pages', function () {
+    /** @var TestCase $this */
+    $admin = User::factory()->create();
+    $admin->assignRole('admin');
+    $this->actingAs($admin);
+
+    foreach ([
+        'admin/categories',
+        'admin/footer-codes',
+        'admin/invoices',
+        'admin/legal-requests',
+        'admin/contact-messages',
+    ] as $path) {
+        $this->get("https://pressekonto.test/{$path}")->assertSuccessful();
+    }
+});

tests/Feature/Admin/UserImpersonationTest.php

@@ -45,10 +45,9 @@ test('users without manage permission cannot start impersonation', function () {
 
     $this->actingAs($editor);
 
-    LivewireVolt::test('admin.users')
-        ->assertDontSee('Login als User')
-        ->call('loginAsUser', $customer->id)
-        ->assertForbidden();
+    // Ohne users:manage ist die Benutzerverwaltung (und damit die
+    // Impersonation) bereits auf Seiten-Ebene gesperrt.
+    $this->get('https://pressekonto.test/admin/users')->assertForbidden();
 
     $this->assertAuthenticatedAs($editor);
     $this->assertFalse(session()->has(UserImpersonation::SessionKey));
@@ -95,6 +94,52 @@ test('admin can impersonate accounts with admin access', function () {
     $this->get(route('dashboard'))->assertRedirect(route('me.dashboard'));
 });
 
+test('non super admin cannot impersonate a super admin', function () {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+
+    $admin = User::factory()->create();
+    $admin->assignRole('admin'); // users:manage, aber kein Super-Admin
+
+    $superAdmin = User::factory()->superAdmin()->create([
+        'email' => 'super@example.com',
+    ]);
+    $superAdmin->assignRole('admin');
+
+    $this->actingAs($admin);
+
+    LivewireVolt::test('admin.users')
+        ->set('search', 'super@example.com')
+        ->call('loginAsUser', $superAdmin->id)
+        ->assertForbidden();
+
+    $this->assertAuthenticatedAs($admin);
+    $this->assertFalse(session()->has(UserImpersonation::SessionKey));
+});
+
+test('super admin can impersonate another super admin', function () {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+
+    $superAdmin = User::factory()->superAdmin()->create();
+    $superAdmin->assignRole('admin');
+
+    $targetSuperAdmin = User::factory()->superAdmin()->create([
+        'email' => 'target-super@example.com',
+    ]);
+    $targetSuperAdmin->assignRole('admin');
+
+    $this->actingAs($superAdmin);
+
+    LivewireVolt::test('admin.users')
+        ->set('search', 'target-super@example.com')
+        ->call('loginAsUser', $targetSuperAdmin->id)
+        ->assertRedirect(route('me.dashboard'));
+
+    $this->assertAuthenticatedAs($targetSuperAdmin);
+    expect(session(UserImpersonation::SessionKey))->toBe($superAdmin->id);
+});
+
 test('impersonated user can return to the admin account', function () {
     /** @var TestCase $this */
     $this->seed(RolesAndPermissionsSeeder::class);

tests/Feature/CustomerPortalTest.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Actions\Admin\UserImpersonation;
 use App\Enums\InvoiceStatus;
 use App\Enums\UserPaymentOptionStatus;
 use App\Models\Invoice;
@@ -57,6 +58,35 @@ test('customer cannot create api token without active payment access', function
     expect($customer->tokens()->count())->toBe(0);
 });
 
+test('api tokens cannot be created or revoked during impersonation', function () {
+    /** @var TestCase $this */
+    $admin = User::factory()->create();
+    $customer = User::factory()->create(['is_active' => true]);
+    UserPaymentOption::factory()->create([
+        'user_id' => $customer->id,
+        'status' => UserPaymentOptionStatus::Active->value,
+        'current_period_start' => now()->subDay(),
+        'current_period_end' => now()->addMonth(),
+    ]);
+    $token = $customer->createToken('Existing token', ['press-releases:read'])->accessToken;
+
+    $this->actingAs($customer)
+        ->withSession([UserImpersonation::SessionKey => $admin->id]);
+
+    LivewireVolt::test('customer.tokens')
+        ->assertSee('Während der Benutzer-Impersonation können keine API-Tokens erstellt oder widerrufen werden.')
+        ->set('tokenName', 'Impersonated token')
+        ->set('selectedAbilities', ['press-releases:read'])
+        ->call('createToken')
+        ->assertForbidden();
+
+    LivewireVolt::test('customer.tokens')
+        ->call('revokeToken', $token->id)
+        ->assertForbidden();
+
+    expect($customer->tokens()->pluck('id')->all())->toBe([$token->id]);
+});
+
 test('customer sees only own legacy invoices', function () {
     /** @var TestCase $this */
     $customer = User::factory()->create(['is_active' => true]);