api: Ziel-Portal einer Einreichung explizit auflösen statt vom Konto erben

Legacy-API-Kunden mit Keys beider Altportale — vor allem connektar — senden
jede Meldung an presseecho.de UND businessportal24.de. Weil die Firma ihr
Portal vom User und die Meldung es von der Firma erbte, landeten beide Kopien
im selben Portal, die zweite mit Slug-Suffix "-2". Verifiziert wurde das über
die Token-Hashes gegen die Legacy-Datenbanken.

Das Portal wird jetzt in fester Reihenfolge aufgelöst: expliziter
portal-Parameter, sonst die aufgerufene Domain, sonst das Portal des
Firmenprofils, zuletzt Portal::Both — genau der Default, den beide Spalten
ohnehin tragen. Die Auflösung ist damit nicht-nullbar; vorher konnte sie null
liefern, was als SQL-Fehler und damit als 500er beim Alt-Client gelandet wäre.
Ein Update über die v1-API verschiebt eine bestehende Meldung ausschließlich
über den expliziten Parameter, nie über die aufgerufene Domain.

press-releases:fix-api-portal-duplicates repariert die Altdaten: Es findet
Paare (gleicher User, Titel, Sprache und Portal, beide per API eingereicht,
kurz nacheinander) und verschiebt die zweite Kopie samt ihrer exklusiven Firma
ins jeweils andere Portal, mit neu vergebenem Slug. Web-Doppel-Submits ohne
Status-Log source=api und Legacy-Sync-Daten mit gesetzter legacy_id werden
geschont. Auf Live ausgeführt und verifiziert.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/Feature/Api/ApiPortalResolutionTest.php

@@ -0,0 +1,216 @@
+<?php
+
+use App\Enums\Portal;
+use App\Models\Category;
+use App\Models\Company;
+use App\Models\PressRelease;
+use App\Models\User;
+use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Support\Facades\Queue;
+use Laravel\Sanctum\Sanctum;
+use Tests\TestCase;
+
+/**
+ * Regression zum API-Portal-Fix (13.08.2026): Kunden mit Keys beider
+ * Altportale senden an presseecho.de UND businessportal24.de — bisher
+ * erbten Firma und PM immer das User-/Firmen-Portal, sodass alles im
+ * selben Portal landete (zweite Kopie mit Slug "-2"). Das Ziel-Portal
+ * kommt jetzt aus explizitem Parameter > Request-Domain > Fallback.
+ */
+function portalResolutionApiUser(Portal $portal = Portal::Businessportal24): User
+{
+    test()->seed(RolesAndPermissionsSeeder::class);
+    config()->set('billing.enforce_booking', false);
+
+    $user = User::factory()->create([
+        'is_active' => true,
+        'portal' => $portal,
+    ]);
+    $user->forceFill(['registration_type' => 'apiuser'])->save();
+
+    Sanctum::actingAs($user, [
+        'press-releases:read',
+        'press-releases:write',
+        'companies:read',
+    ]);
+
+    return $user;
+}
+
+function legacyPressReleasePayload(Company $company, Category $category, array $overrides = []): array
+{
+    return [
+        'press_release' => array_merge([
+            'company_id' => $company->id,
+            'category_id' => $category->legacy_id ?? $category->id,
+            'language' => 'de',
+            'title' => 'Portal-Auflösung Test-PM',
+            'text' => 'Inhalt der Test-Pressemitteilung.',
+        ], $overrides),
+    ];
+}
+
+test('legacy company creation uses the request domain portal over the user portal', function () {
+    /** @var TestCase $this */
+    portalResolutionApiUser(Portal::Businessportal24);
+    config()->set('app.theme', 'presseecho');
+
+    $this->postJson('/service/users/me/companies', [
+        'company' => ['name' => 'Domain GmbH'],
+    ])->assertCreated();
+
+    $company = Company::withoutGlobalScopes()->where('name', 'Domain GmbH')->firstOrFail();
+    expect($company->portal)->toBe(Portal::Presseecho);
+});
+
+test('legacy company creation falls back to the user portal without domain context', function () {
+    /** @var TestCase $this */
+    portalResolutionApiUser(Portal::Businessportal24);
+    config()->set('app.theme', 'portal');
+
+    $this->postJson('/service/users/me/companies', [
+        'company' => ['name' => 'Fallback GmbH'],
+    ])->assertCreated();
+
+    $company = Company::withoutGlobalScopes()->where('name', 'Fallback GmbH')->firstOrFail();
+    expect($company->portal)->toBe(Portal::Businessportal24);
+});
+
+test('legacy company creation accepts an explicit portal parameter over the domain', function () {
+    /** @var TestCase $this */
+    portalResolutionApiUser(Portal::Businessportal24);
+    config()->set('app.theme', 'businessportal24');
+
+    $this->postJson('/service/users/me/companies', [
+        'company' => ['name' => 'Parameter GmbH', 'portal' => 'presseecho'],
+    ])->assertCreated();
+
+    $company = Company::withoutGlobalScopes()->where('name', 'Parameter GmbH')->firstOrFail();
+    expect($company->portal)->toBe(Portal::Presseecho);
+});
+
+test('legacy press release creation uses the request domain portal over the company portal', function () {
+    /** @var TestCase $this */
+    Queue::fake();
+    $user = portalResolutionApiUser(Portal::Businessportal24);
+    $company = Company::factory()->businessportal24()->create(['owner_user_id' => $user->id]);
+    $user->companies()->attach($company->id, ['role' => 'owner']);
+    $category = Category::factory()->create(['legacy_id' => 4711]);
+
+    config()->set('app.theme', 'presseecho');
+
+    $this->postJson('/service/pressreleases', legacyPressReleasePayload($company, $category))
+        ->assertCreated();
+
+    $pressRelease = PressRelease::withoutGlobalScopes()->latest('id')->firstOrFail();
+    expect($pressRelease->portal)->toBe(Portal::Presseecho)
+        ->and($pressRelease->slug)->toBe('portal-auflosung-test-pm');
+});
+
+test('legacy press release creation accepts an explicit portal parameter over the domain', function () {
+    /** @var TestCase $this */
+    Queue::fake();
+    $user = portalResolutionApiUser(Portal::Businessportal24);
+    $company = Company::factory()->businessportal24()->create(['owner_user_id' => $user->id]);
+    $user->companies()->attach($company->id, ['role' => 'owner']);
+    $category = Category::factory()->create(['legacy_id' => 4712]);
+
+    config()->set('app.theme', 'businessportal24');
+
+    $this->postJson(
+        '/service/pressreleases',
+        legacyPressReleasePayload($company, $category, ['portal' => 'presseecho']),
+    )->assertCreated();
+
+    $pressRelease = PressRelease::withoutGlobalScopes()->latest('id')->firstOrFail();
+    expect($pressRelease->portal)->toBe(Portal::Presseecho);
+});
+
+test('legacy press release creation falls back to the company portal without domain context', function () {
+    /** @var TestCase $this */
+    Queue::fake();
+    $user = portalResolutionApiUser(Portal::Businessportal24);
+    $company = Company::factory()->businessportal24()->create(['owner_user_id' => $user->id]);
+    $user->companies()->attach($company->id, ['role' => 'owner']);
+    $category = Category::factory()->create(['legacy_id' => 4713]);
+
+    config()->set('app.theme', 'portal');
+
+    $this->postJson('/service/pressreleases', legacyPressReleasePayload($company, $category))
+        ->assertCreated();
+
+    $pressRelease = PressRelease::withoutGlobalScopes()->latest('id')->firstOrFail();
+    expect($pressRelease->portal)->toBe(Portal::Businessportal24);
+});
+
+test('v1 press release creation resolves the portal from parameter and domain', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create();
+    $company = Company::factory()->businessportal24()->create();
+    $category = Category::factory()->withTranslations()->create();
+    $user->companies()->attach($company->id, ['role' => 'owner']);
+
+    Sanctum::actingAs($user, ['press-releases:read', 'press-releases:write']);
+
+    config()->set('app.theme', 'presseecho');
+
+    $this->postJson('/api/v1/press-releases', [
+        'company_id' => $company->id,
+        'category_id' => $category->id,
+        'language' => 'de',
+        'title' => 'Domain bestimmt das Portal',
+        'text' => 'Inhalt',
+    ])->assertCreated()->assertJsonPath('data.portal', 'presseecho');
+
+    $this->postJson('/api/v1/press-releases', [
+        'portal' => 'businessportal24',
+        'company_id' => $company->id,
+        'category_id' => $category->id,
+        'language' => 'de',
+        'title' => 'Parameter schlägt Domain',
+        'text' => 'Inhalt',
+    ])->assertCreated()->assertJsonPath('data.portal', 'businessportal24');
+});
+
+test('v1 press release creation rejects the portal value both', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create();
+    $company = Company::factory()->businessportal24()->create();
+    $category = Category::factory()->withTranslations()->create();
+    $user->companies()->attach($company->id, ['role' => 'owner']);
+
+    Sanctum::actingAs($user, ['press-releases:read', 'press-releases:write']);
+
+    $this->postJson('/api/v1/press-releases', [
+        'portal' => 'both',
+        'company_id' => $company->id,
+        'category_id' => $category->id,
+        'language' => 'de',
+        'title' => 'Beide Portale sind nicht erlaubt',
+        'text' => 'Inhalt',
+    ])->assertUnprocessable()->assertJsonValidationErrors(['portal']);
+});
+
+test('v1 update keeps the portal unless an explicit portal parameter is sent', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create();
+    $company = Company::factory()->businessportal24()->create();
+    $user->companies()->attach($company->id, ['role' => 'owner']);
+
+    $pressRelease = PressRelease::factory()
+        ->forPortal(Portal::Businessportal24)
+        ->create(['user_id' => $user->id, 'company_id' => $company->id]);
+
+    Sanctum::actingAs($user, ['press-releases:read', 'press-releases:write']);
+
+    // Update über die "falsche" Domain verschiebt die PM nicht …
+    config()->set('app.theme', 'presseecho');
+    $this->patchJson("/api/v1/press-releases/{$pressRelease->id}", [
+        'title' => 'Titel bleibt im Portal',
+    ])->assertOk()->assertJsonPath('data.portal', 'businessportal24');
+
+    // … ein expliziter Parameter schon.
+    $this->patchJson("/api/v1/press-releases/{$pressRelease->id}", [
+        'portal' => 'presseecho',
+    ])->assertOk()->assertJsonPath('data.portal', 'presseecho');
+});

tests/Feature/Api/LegacyServiceParityTest.php

@@ -125,6 +125,10 @@ test('the full connektar flow works like the old api with immediate publishing',
         ->assertJsonStructure(['id', 'title', 'text', 'teaser_end', 'language', 'category_id', 'view_url', 'company' => ['viewUrl', 'name']])
         ->assertJsonPath('company.name', 'Muster Energie GmbH');
 
+    // Aufruf-Zähler: der Request protokolliert nur das Ereignis, verbucht
+    // wird es gebündelt durch den Scheduler.
+    $this->artisan('press-releases:aggregate-views')->assertSuccessful();
+
     $trackedRelease = PressRelease::withoutGlobalScopes()->findOrFail($pressRelease->id);
 
     expect($trackedRelease->hits)->toBe(1)
@@ -227,6 +231,7 @@ test('api submissions notify the press contact instead of the api submitter', fu
     Mail::fake();
     Queue::fake();
     $user = parityApiUser();
+    $user->forceFill(['name' => 'Sebastian Einbock'])->save();
 
     $company = Company::factory()->create([
         'portal' => Portal::Businessportal24,
@@ -252,5 +257,47 @@ test('api submissions notify the press contact instead of the api submitter', fu
         ],
     ])->assertCreated();
 
-    Mail::assertQueued(PressReleasePublished::class, fn ($mail) => $mail->hasTo('presse@muster.de'));
+    // Anrede folgt dem Empfänger (Pressekontakt), nicht dem API-Konto:
+    // gegen das gerenderte HTML geprüft, weil dort der Fehler auftrat.
+    Mail::assertQueued(PressReleasePublished::class, function ($mail) {
+        $html = $mail->render();
+
+        return $mail->hasTo('presse@muster.de')
+            && str_contains($html, 'Hallo Max Mustermann,')
+            && ! str_contains($html, 'Sebastian Einbock');
+    });
+});
+
+test('api submissions without press contact address the company by name', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+    Queue::fake();
+    $user = parityApiUser();
+    $user->forceFill(['name' => 'Sebastian Einbock'])->save();
+
+    $company = Company::factory()->create([
+        'portal' => Portal::Businessportal24,
+        'is_active' => true,
+        'name' => 'Muster GmbH',
+        'email' => 'firma@muster.de',
+    ]);
+    $user->companies()->attach($company->id, ['role' => 'owner']);
+    $category = Category::factory()->create(['portal' => Portal::Businessportal24]);
+
+    $this->postJson('/service/pressreleases', [
+        'press_release' => [
+            'company_id' => $company->id,
+            'category_id' => $category->id,
+            'title' => 'Mail geht an die Firma',
+            'text' => 'Inhalt für den Firmen-Fallback-Test.',
+        ],
+    ])->assertCreated();
+
+    Mail::assertQueued(PressReleasePublished::class, function ($mail) {
+        $html = $mail->render();
+
+        return $mail->hasTo('firma@muster.de')
+            && str_contains($html, 'Hallo Muster GmbH,')
+            && ! str_contains($html, 'Sebastian Einbock');
+    });
 });