gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

recht: Meldeverfahren v2 Phasen 5+7 — DSGVO-Strukturformular, 10-€-Checkout mit KI-Vorprüfung, Triage & Panel-Modal

Browse source 
Phase 7 (Spur D, E2 revidiert): KI-Vorprüfung VOR der Zahlung im Modal —
rot lehnt ohne Zahlung ab, gelb/grün führt zum Stripe-Checkout
(SinglePurchaseType::Change, 10 € netto), nach Zahlungseingang übernimmt
der Webhook die geprüfte Fassung sofort (applyPaid: Snapshot, Sperre,
Verlauf). Nur einmal je PM; Obergrenze legal.change_max_distance_percent
(50 %) verhindert die verdeckte Selbst-Depublizierung.

Phase 5 (Spur B): strukturiertes Schwärzungsformular mit Pflicht-Vorschau
im verifizierten Web-Bereich UND als Modal im Kunden-Panel; Admin-Editor
wird aus payload.redaction vorbefüllt. Umsetzungsmail LegalRequestExecuted
an Antragsteller, Bestätigungsmail PressReleaseChangeApplied (Spur A/D,
neuer abbestellbarer Typ press_release_corrected).

Außerdem:
- Re-Sync-Sperre + Sitemap-Invalidierung fest in depublish() verankert
  (Lücke im bezahlten Webhook-Pfad geschlossen)
- Öffentliche „Rechtliches"-Seite als zweistufige Triage: primär der
  Portal-Anmeldelink, Formular nur Fallback mit Identifizierungs-Hinweis;
  Store auf report/dsgvo/personal_rights gehärtet
- Panel-Button „Ändern/Melden" öffnet Anliegen-Modal (4 Spuren) statt
  des Web-Formulars
- Pressekontakt-Fallback für Legacy-Bestände (30k PMs ohne Verknüpfung):
  Detailseite + pressContactEmail() nutzen PM-Kontakt → Firmen-Kontakt →
  Firmendaten
- Korrektur-Gate entity-fest (Editor-Normalisierung zählt nicht als
  Änderung), toEditorHtml() in Admin-Edit + Korrektur-Panel,
  Wochenlimit-Hinweis in Text und Bremsen-Meldung

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-07-23 13:02:57 +00:00
parent b4b2e013d6
commit 9afbedddeb
40 changed files with 2507 additions and 169 deletions
Download patch file Download diff file Expand all files Collapse all files

20
tests/Feature/Admin/AdminPressReleaseFormFieldsTest.php
View file

@ -151,6 +151,26 @@ test('admin edit hydratisiert subtitle, boilerplate_override und Kontakt', funct
->assertSet('contactId', $contact->id);
});
test('admin edit wandelt Legacy-Plaintext für den Editor in Absätze', function () {
/** @var TestCase $this */
$admin = makeFieldsAdmin();
$company = Company::factory()->presseecho()->create();
$pr = PressRelease::factory()->create([
'company_id' => $company->id,
'text' => "Erster Absatz der Meldung.\r\n\r\nZweiter Absatz nach Leerzeile.\r\nDritte Zeile direkt darunter.",
]);
$this->actingAs($admin);
$component = LivewireVolt::test('admin.press-releases.edit', ['id' => $pr->id]);
$editorText = $component->get('text');
expect($editorText)->toContain('<p>Erster Absatz der Meldung.</p>')
->and($editorText)->toContain('<p>Zweiter Absatz nach Leerzeile.<br>')
->and($editorText)->toContain('Dritte Zeile direkt darunter.');
});
test('admin edit speichert subtitle, boilerplate_override und Kontakt', function () {
/** @var TestCase $this */
$admin = makeFieldsAdmin();

195
tests/Feature/Billing/ChangeCheckoutTest.php Normal file
View file

@ -0,0 +1,195 @@
<?php
use App\Enums\LegalRequestStatus;
use App\Enums\LegalRequestType;
use App\Enums\LegalRequestVerificationMethod;
use App\Enums\Portal;
use App\Enums\SinglePurchaseStatus;
use App\Enums\SinglePurchaseType;
use App\Listeners\ProcessStripeWebhook;
use App\Mail\PressReleaseChangeApplied;
use App\Models\BillingAddress;
use App\Models\BookingConfirmation;
use App\Models\LegalRequest;
use App\Models\PressRelease;
use App\Models\SinglePurchase;
use App\Models\User;
use App\Services\Billing\StripeCheckoutService;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Mail;
use Illuminate\Support\Facades\Queue;
use Laravel\Cashier\Checkout;
use Laravel\Cashier\Events\WebhookReceived;
use Tests\TestCase;
beforeEach(function (): void {
/** @var TestCase $this */
$this->seed(RolesAndPermissionsSeeder::class);
config()->set('billing.change_price_cents', 1000);
});
function changeCustomer(): User
{
$user = User::factory()->create(['is_active' => true, 'email_verified_at' => now()]);
$user->assignRole('customer');
BillingAddress::factory()->create(['user_id' => $user->id]);
// B2B-Gate: zeitnahe Unternehmer-Bestätigung (wie im Änderungs-Modal).
BookingConfirmation::query()->create([
'user_id' => $user->id,
'booking_type' => 'press_release_change',
'agb_version' => (string) config('legal.agb_version'),
'confirmed_at' => now(),
]);
return $user;
}
function publishedChangeReleaseFor(User $user): PressRelease
{
return PressRelease::factory()
->published()
->forPortal(Portal::Businessportal24)
->create([
'user_id' => $user->id,
'published_at' => now()->subDay(),
'title' => 'Solaranlage in Hamburg eroeffnet und in Betrieb',
]);
}
function approvedChangeRequestFor(PressRelease $release, User $user): LegalRequest
{
return LegalRequest::query()->create([
'press_release_id' => $release->id,
'portal' => $release->portal?->value,
'type' => LegalRequestType::Change->value,
'status' => LegalRequestStatus::Open->value,
'requester_email' => (string) $user->email,
'message' => 'Kostenpflichtige Änderung (Spur D) über das Kunden-Panel eingereicht.',
'payload' => [
'source' => 'self_service',
'new_values' => ['title' => 'Solaranlage in Muenchen eroeffnet und in Vollbetrieb'],
'ki_check' => ['classification' => 'green', 'reasons' => []],
],
'verified_at' => now(),
'verification_method' => LegalRequestVerificationMethod::LoggedIn->value,
]);
}
test('the change checkout refuses without an approved precheck request', function () {
/** @var TestCase $this */
$user = changeCustomer();
$release = publishedChangeReleaseFor($user);
$this->actingAs($user)
->get(route('me.checkout.change', $release->id))
->assertRedirect(route('me.bookings.index'))
->assertSessionHas('checkout-notice');
expect(SinglePurchase::count())->toBe(0);
});
test('a red-rejected precheck request does not unlock the checkout', function () {
/** @var TestCase $this */
$user = changeCustomer();
$release = publishedChangeReleaseFor($user);
$request = approvedChangeRequestFor($release, $user);
$request->forceFill([
'status' => LegalRequestStatus::Rejected->value,
'payload' => array_merge($request->payload, ['ki_check' => ['classification' => 'red', 'reasons' => ['Unzulässiges Wort.']]]),
])->save();
$this->actingAs($user)
->get(route('me.checkout.change', $release->id))
->assertRedirect(route('me.bookings.index'))
->assertSessionHas('checkout-notice');
expect(SinglePurchase::count())->toBe(0);
});
test('the change checkout creates a pending purchase, links the request and reuses pendings', function () {
/** @var TestCase $this */
$user = changeCustomer();
$release = publishedChangeReleaseFor($user);
$legalRequest = approvedChangeRequestFor($release, $user);
$checkout = Mockery::mock(Checkout::class);
$checkout->shouldReceive('toResponse')->andReturn(new RedirectResponse('https://checkout.stripe.com/c/pay/test'));
$this->mock(StripeCheckoutService::class, function ($mock) use ($checkout) {
// Zweimal: der zweite Aufruf verwendet den offenen Kauf wieder.
$mock->shouldReceive('forChange')->twice()->andReturn($checkout);
});
$this->actingAs($user)
->get(route('me.checkout.change', $release->id))
->assertRedirect('https://checkout.stripe.com/c/pay/test');
$purchase = SinglePurchase::sole();
expect($purchase->type)->toBe(SinglePurchaseType::Change);
expect($purchase->status)->toBe(SinglePurchaseStatus::Pending);
expect($purchase->price_cents)->toBe(1000);
expect($purchase->press_release_id)->toBe($release->id);
expect($legalRequest->fresh()->single_purchase_id)->toBe($purchase->id);
// Abgebrochener Checkout blockiert nicht: erneuter Aufruf nutzt den
// Pending-Kauf wieder statt einen zweiten anzulegen.
$this->actingAs($user)
->get(route('me.checkout.change', $release->id))
->assertRedirect('https://checkout.stripe.com/c/pay/test');
expect(SinglePurchase::count())->toBe(1);
});
test('the paid webhook applies the change immediately with snapshot, lock and consumed purchase', function () {
/** @var TestCase $this */
Mail::fake();
Queue::fake();
$user = changeCustomer();
$release = publishedChangeReleaseFor($user);
$legalRequest = approvedChangeRequestFor($release, $user);
$purchase = SinglePurchase::query()->create([
'user_id' => $user->id,
'type' => SinglePurchaseType::Change->value,
'status' => SinglePurchaseStatus::Pending->value,
'price_cents' => 1000,
'currency' => 'EUR',
'press_release_id' => $release->id,
]);
$legalRequest->forceFill(['single_purchase_id' => $purchase->id])->save();
$event = new WebhookReceived([
'type' => 'checkout.session.completed',
'data' => ['object' => [
'id' => 'cs_test_change',
'payment_intent' => 'pi_test_change',
'payment_status' => 'paid',
'metadata' => ['single_purchase_id' => (string) $purchase->id],
]],
]);
app(ProcessStripeWebhook::class)->handle($event);
app(ProcessStripeWebhook::class)->handle($event); // Replay bleibt folgenlos.
$release->refresh();
$legalRequest->refresh();
expect($release->title)->toBe('Solaranlage in Muenchen eroeffnet und in Vollbetrieb')
->and($release->isSyncLocked())->toBeTrue()
->and($legalRequest->status)->toBe(LegalRequestStatus::Resolved)
->and($legalRequest->executed_at)->not->toBeNull()
->and($legalRequest->redactionSnapshots()->count())->toBe(1)
->and($legalRequest->redactionSnapshots()->first()->encrypted_before['fields']['title'])->toBe('Solaranlage in Hamburg eroeffnet und in Betrieb');
expect($purchase->fresh()->status)->toBe(SinglePurchaseStatus::Consumed);
expect($purchase->fresh()->consumed_at)->not->toBeNull();
// Der Käufer erhält genau eine Bestätigung (Replay löst keine zweite aus).
Mail::assertQueued(PressReleaseChangeApplied::class, function (PressReleaseChangeApplied $mail) use ($user, $release) {
return $mail->hasTo($user->email) && $mail->pressRelease->is($release) && $mail->isPaidChange;
});
Mail::assertQueuedCount(1);
});

3
tests/Feature/Billing/DepublicationTest.php
View file

@ -224,6 +224,9 @@ test('the paid webhook depublishes the release and the public page shows a tombs
$release->refresh();
expect($release->status)->toBe(PressReleaseStatus::Archived);
expect($release->depublished_at)->not->toBeNull();
// Re-Sync-Sperre (Meldeverfahren §7): ohne sie würde der nächste
// Importer-Lauf die bezahlte Entfernung überschreiben.
expect($release->isSyncLocked())->toBeTrue();
// Eingelöst = Status Consumed — nur so erscheint der Kauf unter
// „Eingelöste Käufe" auf der Buchungs-Seite.
expect($purchase->fresh()->status)->toBe(SinglePurchaseStatus::Consumed);

56
tests/Feature/Legal/AdminLegalRequestExecutionTest.php
View file

@ -3,11 +3,13 @@
use App\Enums\LegalRequestStatus;
use App\Enums\LegalRequestType;
use App\Enums\PressReleaseStatus;
use App\Mail\LegalRequestExecuted;
use App\Models\LegalRequest;
use App\Models\PressRelease;
use App\Models\User;
use App\Services\PressRelease\AnonymizationService;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Support\Facades\Mail;
use Livewire\Volt\Volt;
use Tests\TestCase;
@ -76,6 +78,60 @@ test('the panel prefills the replacement and shows the full content for copying
expect($pressRelease->fresh()->title)->toBe('Matvey Teplitsky im Vorstand');
});
test('the editor is prefilled from a structured web redaction order', function () {
/** @var TestCase $this */
$this->actingAs(adminUserForLegalQueue());
$pressRelease = PressRelease::factory()->published()->create();
$request = LegalRequest::factory()
->type(LegalRequestType::Dsgvo)
->create([
'press_release_id' => $pressRelease->id,
'payload' => [
'source' => 'self_service',
'concern' => 'dsgvo',
'redaction' => [
'terms' => ['Max Mustermann', 'Mustermanns'],
'detach_contacts' => false,
'remove_images_requested' => true,
'preview_total_hits' => 3,
],
],
]);
Volt::test('admin.legal-requests.show', ['id' => $request->id])
->assertSet('redactionTerms', "Max Mustermann\nMustermanns")
->assertSet('detachContacts', false)
->assertSee('Strukturierter Schwärzungsauftrag')
->assertSee('Entfernung von Bildern mit Personenbezug');
});
test('executing sends an execution confirmation to the requester', function () {
/** @var TestCase $this */
Mail::fake();
$this->actingAs(adminUserForLegalQueue());
$pressRelease = PressRelease::factory()->published()->create([
'title' => 'Matvey Teplitsky im Vorstand',
]);
$request = LegalRequest::factory()
->type(LegalRequestType::Dsgvo)
->create([
'press_release_id' => $pressRelease->id,
'requester_email' => 'presse@firma.example',
]);
Volt::test('admin.legal-requests.show', ['id' => $request->id])
->set('redactionTerms', 'Matvey Teplitsky')
->call('previewAnonymization')
->call('executeAnonymization')
->assertHasNoErrors();
Mail::assertQueued(LegalRequestExecuted::class, function (LegalRequestExecuted $mail) {
return $mail->hasTo('presse@firma.example') && $mail->action === 'anonymized';
});
});
test('execute without a prior preview is refused', function () {
/** @var TestCase $this */
$this->actingAs(adminUserForLegalQueue());

112
tests/Feature/Legal/CorrectionServiceTest.php
View file

@ -4,9 +4,12 @@ use App\Enums\ActivityType;
use App\Enums\LegalRequestStatus;
use App\Enums\LegalRequestType;
use App\Enums\LegalRequestVerificationMethod;
use App\Enums\PressReleaseClassification;
use App\Models\ActivityEvent;
use App\Models\CreditTransaction;
use App\Models\LegalRequest;
use App\Models\PressRelease;
use App\Services\PressRelease\BlacklistService;
use App\Services\PressRelease\CorrectionRateLimitException;
use App\Services\PressRelease\CorrectionService;
use App\Services\PressRelease\CorrectionTooLargeException;
@ -54,6 +57,37 @@ test('markup-only changes count as no change', function () {
expect($classification['has_changes'])->toBeFalse();
});
test('editor normalization of entities and line breaks counts as no change', function () {
/** @var TestCase $this */
$pressRelease = PressRelease::factory()->published()->create([
'text' => '<p>Preis &amp; Leistung&nbsp;stimmen.<br />Zeile zwei mit &quot;Zitat&quot;.</p>',
]);
// So liefert der Rich-Text-Editor denselben Inhalt zurück: Entities
// dekodiert, <br> als eigener Absatz.
$classification = app(CorrectionService::class)->classify($pressRelease, [
'text' => "<p>Preis & Leistung\u{00A0}stimmen.</p><p>Zeile zwei mit \"Zitat\".</p>",
]);
expect($classification['has_changes'])->toBeFalse();
});
test('one added letter in an entity-laden text stays near zero distance', function () {
/** @var TestCase $this */
$words = implode(' ', array_fill(0, 60, 'Wort&nbsp;und &amp; mehr'));
$pressRelease = PressRelease::factory()->published()->create([
'text' => '<p>'.$words.' Betrieb genomen.</p>',
]);
$decoded = implode(' ', array_fill(0, 60, "Wort\u{00A0}und & mehr"));
$classification = app(CorrectionService::class)->classify($pressRelease, [
'text' => '<p>'.$decoded.' Betrieb genommen.</p>',
]);
expect($classification['is_minor'])->toBeTrue()
->and($classification['fields']['text']['distance_percent'])->toBeLessThan(1.0);
});
test('apply saves a minor correction immediately with snapshot, lock and log', function () {
/** @var TestCase $this */
Queue::fake();
@ -110,6 +144,84 @@ test('the weekly correction brake blocks the third correction', function () {
$service->apply($pressRelease->refresh(), ['title' => 'Titel A4'], 'k@f.example', LegalRequestVerificationMethod::LoggedIn);
})->throws(CorrectionRateLimitException::class);
test('classify flags changes above the paid distance limit', function () {
/** @var TestCase $this */
$pressRelease = PressRelease::factory()->published()->create([
'title' => 'Kurzer Titel der Mitteilung',
]);
$classification = app(CorrectionService::class)->classify($pressRelease, [
'title' => 'Ein voellig anderer, deutlich laengerer und inhaltlich komplett neuer Titel',
]);
expect($classification['exceeds_paid_limit'])->toBeTrue()
->and($classification['is_minor'])->toBeFalse();
});
test('applyPaid executes a paid change with snapshot, lock and resolved request', function () {
/** @var TestCase $this */
Queue::fake();
$pressRelease = PressRelease::factory()->published()->create([
'title' => 'Solaranlage in Hamburg eroeffnet und in Betrieb',
]);
$legalRequest = LegalRequest::factory()
->type(LegalRequestType::Change)
->create([
'press_release_id' => $pressRelease->id,
'payload' => ['new_values' => ['title' => 'Solaranlage in Muenchen eroeffnet und in Vollbetrieb']],
]);
$applied = app(CorrectionService::class)->applyPaid($pressRelease, $legalRequest);
$pressRelease->refresh();
$legalRequest->refresh();
expect($applied)->toBeTrue()
->and($pressRelease->title)->toBe('Solaranlage in Muenchen eroeffnet und in Vollbetrieb')
->and($pressRelease->isSyncLocked())->toBeTrue()
->and($legalRequest->status)->toBe(LegalRequestStatus::Resolved)
->and($legalRequest->executed_at)->not->toBeNull()
->and($legalRequest->redactionSnapshots()->count())->toBe(1);
});
test('applyPaid refuses a change above the paid distance limit', function () {
/** @var TestCase $this */
$pressRelease = PressRelease::factory()->published()->create([
'title' => 'Kurzer Titel der Mitteilung',
]);
$legalRequest = LegalRequest::factory()
->type(LegalRequestType::Change)
->create([
'press_release_id' => $pressRelease->id,
'payload' => ['new_values' => ['title' => 'Ein voellig anderer, deutlich laengerer und inhaltlich komplett neuer Titel']],
]);
app(CorrectionService::class)->applyPaid($pressRelease, $legalRequest);
})->throws(CorrectionTooLargeException::class);
test('the precheck classifies the proposed content instead of the stored one', function () {
/** @var TestCase $this */
config()->set('scoring.classification.provider', 'deterministic');
config()->set('blacklist.words', ['skandalwort']);
app()->forgetInstance(BlacklistService::class);
$pressRelease = PressRelease::factory()->published()->create([
'title' => 'Harmloser Titel der Mitteilung',
]);
$service = app(CorrectionService::class);
$red = $service->precheckProposedContent($pressRelease, ['title' => 'Titel mit Skandalwort darin']);
$green = $service->precheckProposedContent($pressRelease, ['title' => 'Harmlose neue Fassung des Titels']);
expect($red->classification)->toBe(PressReleaseClassification::Red)
->and($green->classification)->toBe(PressReleaseClassification::Green)
->and($pressRelease->fresh()->title)->toBe('Harmloser Titel der Mitteilung');
});
test('restoreSnapshot brings back the previous field values and keeps the lock', function () {
/** @var TestCase $this */
Queue::fake();

152
tests/Feature/Legal/CustomerCorrectionPanelTest.php
View file

@ -2,10 +2,13 @@
use App\Enums\LegalRequestStatus;
use App\Enums\LegalRequestType;
use App\Mail\PressReleaseChangeApplied;
use App\Models\LegalRequest;
use App\Models\PressRelease;
use App\Models\User;
use App\Services\PressRelease\BlacklistService;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Support\Facades\Mail;
use Illuminate\Support\Facades\Queue;
use Livewire\Volt\Volt;
use Tests\TestCase;
@ -26,6 +29,7 @@ function correctionPanelOwner(): User
test('an owner can apply a minor correction from the panel and it goes live instantly', function () {
/** @var TestCase $this */
Queue::fake();
Mail::fake();
$owner = correctionPanelOwner();
$this->actingAs($owner);
@ -48,9 +52,90 @@ test('an owner can apply a minor correction from the panel and it goes live inst
expect($pressRelease->title)->toBe('Betrieb genommen')
->and($pressRelease->isSyncLocked())->toBeTrue()
->and(LegalRequest::query()->where('type', LegalRequestType::Correction->value)->count())->toBe(1);
// Bestätigungsmail an den Auftraggeber (abbestellbar über die Präferenzen).
Mail::assertQueued(PressReleaseChangeApplied::class, function (PressReleaseChangeApplied $mail) use ($owner) {
return $mail->hasTo($owner->email) && ! $mail->isPaidChange;
});
});
test('a major change from the panel becomes an open paid change request instead', function () {
test('a major change passes the green precheck and unlocks the payment step', function () {
/** @var TestCase $this */
config()->set('scoring.classification.provider', 'deterministic');
config()->set('blacklist.words', []);
app()->forgetInstance(BlacklistService::class);
$owner = correctionPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'title' => 'Solaranlage in Hamburg eroeffnet und in Betrieb',
]);
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->call('startCorrection')
->set('correctionValues.title', 'Solaranlage in Muenchen eroeffnet und in Vollbetrieb')
->call('previewCorrection')
->assertHasNoErrors()
->call('openPaidChangeModal')
->assertHasNoErrors()
->call('runPaidChangePrecheck')
->assertHasNoErrors()
->assertSet('paidChangePrecheck.classification', 'green')
->assertSee('Prüfung bestanden');
$request = LegalRequest::query()->where('type', LegalRequestType::Change->value)->sole();
expect($request->status)->toBe(LegalRequestStatus::Open)
->and($request->payload['ki_check']['classification'])->toBe('green')
->and($request->payload['new_values']['title'])->toContain('Muenchen')
->and($request->executed_at)->toBeNull()
->and($pressRelease->fresh()->title)->toBe('Solaranlage in Hamburg eroeffnet und in Betrieb');
});
test('a red precheck rejects the change before payment and the process is one-time', function () {
/** @var TestCase $this */
config()->set('scoring.classification.provider', 'deterministic');
config()->set('blacklist.words', ['skandalwort']);
app()->forgetInstance(BlacklistService::class);
$owner = correctionPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'title' => 'Solaranlage in Hamburg eroeffnet und in Betrieb',
]);
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->call('startCorrection')
->set('correctionValues.title', 'Solaranlage in Hamburg eroeffnet mit Skandalwort dabei')
->call('previewCorrection')
->call('openPaidChangeModal')
->assertHasNoErrors()
->call('runPaidChangePrecheck')
->assertSet('paidChangePrecheck.classification', 'red')
->assertSee('Prüfung nicht bestanden');
$request = LegalRequest::query()->where('type', LegalRequestType::Change->value)->sole();
expect($request->status)->toBe(LegalRequestStatus::Rejected)
->and($request->payload['ki_check']['classification'])->toBe('red')
->and($pressRelease->fresh()->title)->toBe('Solaranlage in Hamburg eroeffnet und in Betrieb');
// Nur einmal möglich: nach der Ablehnung gibt es keinen zweiten Anlauf.
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->call('startCorrection')
->set('correctionValues.title', 'Solaranlage in Muenchen eroeffnet und in Vollbetrieb')
->call('previewCorrection')
->call('openPaidChangeModal')
->assertHasErrors('correction');
expect(LegalRequest::query()->where('type', LegalRequestType::Change->value)->count())->toBe(1);
});
test('a change above the paid distance limit cannot be booked at all', function () {
/** @var TestCase $this */
$owner = correctionPanelOwner();
$this->actingAs($owner);
@ -62,17 +147,68 @@ test('a major change from the panel becomes an open paid change request instead'
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->call('startCorrection')
->set('correctionValues.title', 'Ein komplett anderer, deutlich längerer und inhaltlich neuer Titel')
->set('correctionValues.title', 'Ein voellig anderer, deutlich laengerer und inhaltlich komplett neuer Titel')
->call('previewCorrection')
->assertHasNoErrors()
->call('submitPaidChangeRequest')
->assertSee('Zu umfangreich')
->call('openPaidChangeModal')
->assertHasErrors('correction');
expect(LegalRequest::query()->count())->toBe(0);
});
test('a legacy plain-text release is prefilled as paragraphs and counts as unchanged', function () {
/** @var TestCase $this */
$owner = correctionPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'text' => "Erster Absatz.\r\n\r\nZweiter Absatz mit Inhalt.",
]);
$component = Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->call('startCorrection');
expect($component->get('correctionValues')['text'])->toContain('<p>Erster Absatz.</p>');
// Unverändert abschicken: die Plaintext→HTML-Wandlung darf nicht als
// inhaltliche Änderung zählen.
$component->call('previewCorrection')
->assertHasErrors('correction');
expect($pressRelease->fresh()->text)->toContain("Erster Absatz.\r\n");
});
test('the panel names the weekly limit and the brake message states it too', function () {
/** @var TestCase $this */
Queue::fake();
config()->set('legal.corrections_per_week', 1);
$owner = correctionPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'title' => 'Titel B1',
]);
$component = Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->assertSee('höchstens eine kostenlose Korrektur pro Woche')
->call('startCorrection')
->set('correctionValues.title', 'Titel B2')
->call('previewCorrection')
->call('applyCorrection')
->assertHasNoErrors();
$request = LegalRequest::query()->where('type', LegalRequestType::Change->value)->sole();
$component
->call('startCorrection')
->set('correctionValues.title', 'Titel B3')
->call('previewCorrection')
->call('applyCorrection')
->assertHasErrors('correction')
->assertSee('das Limit ist bereits erreicht');
expect($request->status)->toBe(LegalRequestStatus::Open)
->and($request->payload['new_values']['title'])->toContain('komplett anderer')
->and($pressRelease->fresh()->title)->toBe('Kurzer Titel der Mitteilung');
expect($pressRelease->fresh()->title)->toBe('Titel B2');
});
test('apply without preview is refused', function () {

137
tests/Feature/Legal/CustomerDsgvoPanelTest.php Normal file
View file

@ -0,0 +1,137 @@
<?php
use App\Enums\LegalRequestStatus;
use App\Enums\LegalRequestType;
use App\Enums\LegalRequestVerificationMethod;
use App\Mail\LegalRequestReceived;
use App\Mail\LegalRequestSubmitted;
use App\Models\LegalRequest;
use App\Models\PressRelease;
use App\Models\User;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Support\Facades\Mail;
use Livewire\Volt\Volt;
use Tests\TestCase;
beforeEach(function () {
/** @var TestCase $this */
$this->seed(RolesAndPermissionsSeeder::class);
});
function dsgvoPanelOwner(): User
{
$owner = User::factory()->create(['is_active' => true]);
$owner->assignRole('customer');
return $owner;
}
test('the concerns modal offers all four tracks', function () {
/** @var TestCase $this */
$owner = dsgvoPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create(['user_id' => $owner->id]);
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->assertSee('Was möchten Sie tun?')
->assertSee('Kleine Korrektur')
->assertSee('Inhaltliche Änderung')
->assertSee('Entfernung persönlicher Daten (DSGVO)')
->assertSee('Depublizierung');
});
test('the dsgvo preview validates input and never touches the release', function () {
/** @var TestCase $this */
$owner = dsgvoPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'title' => 'Max Mustermann übernimmt die Leitung',
]);
$component = Volt::test('customer.press-releases.show', ['id' => $pressRelease->id]);
// Leeres Formular → Fehler.
$component->call('previewDsgvo')->assertHasErrors('dsgvo');
// Begriffe ohne Treffer → Fehler.
$component->set('dsgvoTerms', 'Kommtnichtvor')
->call('previewDsgvo')
->assertHasErrors('dsgvo');
// Treffer → Vorschau, PM unverändert.
$component->set('dsgvoTerms', 'Max Mustermann')
->call('previewDsgvo')
->assertHasNoErrors()
->assertSee('[entfernt] übernimmt die Leitung');
expect($pressRelease->fresh()->title)->toBe('Max Mustermann übernimmt die Leitung')
->and(LegalRequest::query()->count())->toBe(0);
});
test('the confirmed dsgvo submission creates a verified open request for the admin queue', function () {
/** @var TestCase $this */
Mail::fake();
$owner = dsgvoPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'title' => 'Max Mustermann übernimmt die Leitung',
]);
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->set('dsgvoTerms', "Max Mustermann\nMustermanns")
->set('dsgvoDetachContacts', true)
->set('dsgvoMessage', 'Ich bin die betroffene Person und wünsche die Entfernung.')
->call('submitDsgvo')
->assertHasErrors('dsgvo') // ohne Vorschau keine Einreichung
->call('previewDsgvo')
->assertHasNoErrors()
->call('submitDsgvo')
->assertHasNoErrors();
$request = LegalRequest::query()->sole();
expect($request->type)->toBe(LegalRequestType::Dsgvo)
->and($request->status)->toBe(LegalRequestStatus::Open)
->and($request->verification_method)->toBe(LegalRequestVerificationMethod::LoggedIn)
->and($request->requester_email)->toBe($owner->email)
->and($request->payload['redaction']['terms'])->toBe(['Max Mustermann', 'Mustermanns'])
->and($request->payload['redaction']['detach_contacts'])->toBeTrue()
->and($request->executed_at)->toBeNull()
->and($pressRelease->fresh()->title)->toBe('Max Mustermann übernimmt die Leitung');
Mail::assertQueued(LegalRequestReceived::class, fn (LegalRequestReceived $mail) => $mail->hasTo($owner->email));
Mail::assertQueued(LegalRequestSubmitted::class);
});
test('a second open dsgvo request for the same release is blocked', function () {
/** @var TestCase $this */
Mail::fake();
$owner = dsgvoPanelOwner();
$this->actingAs($owner);
$pressRelease = PressRelease::factory()->published()->create([
'user_id' => $owner->id,
'title' => 'Max Mustermann übernimmt die Leitung',
]);
LegalRequest::factory()->type(LegalRequestType::Dsgvo)->create([
'press_release_id' => $pressRelease->id,
'status' => LegalRequestStatus::Open,
]);
Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
->set('dsgvoTerms', 'Max Mustermann')
->set('dsgvoMessage', 'Bitte meinen Namen entfernen, danke.')
->call('previewDsgvo')
->call('submitDsgvo')
->assertHasErrors('dsgvo');
expect(LegalRequest::query()->count())->toBe(1);
});

97
tests/Feature/Legal/PressReleaseReportFlowTest.php
View file

@ -54,6 +54,27 @@ test('the intake sends a magic link to the stored press contact, never to a form
->and($link->payload['contact_email'])->toBe('presse@firma.example');
});
test('the intake falls back to the company contact when the release has none', function () {
/** @var TestCase $this */
Mail::fake();
// Legacy-Import-Fall: keine PM↔Kontakt-Verknüpfung, aber die Firma hat
// einen Pressekontakt — der zählt als verifizierbarer Kanal.
$pressRelease = PressRelease::factory()->published()->create();
Contact::factory()->create([
'company_id' => $pressRelease->company_id,
'email' => 'firmenkontakt@firma.example',
]);
expect($pressRelease->contacts()->count())->toBe(0);
$this->post('/de/melden/pm', [
'reported_url' => detailUrlFor($pressRelease),
])->assertRedirect();
Mail::assertQueued(PressReleaseReportLink::class, fn (PressReleaseReportLink $mail) => $mail->hasTo('firmenkontakt@firma.example'));
});
test('an unknown url is rejected with a validation error', function () {
/** @var TestCase $this */
Mail::fake();
@ -121,13 +142,13 @@ test('a verified visitor can submit a concern which lands verified in the queue'
$this->get('/de/melden/pm/verifizieren/'.$link['plain_token']);
$this->post('/de/melden/pm/anliegen', [
'concern' => 'dsgvo',
'message' => 'Bitte meinen Namen aus dem Pressekontakt entfernen.',
'concern' => 'correction',
'message' => 'Bitte den Tippfehler im Firmennamen korrigieren.',
])->assertSessionHas('pm-report-status');
$request = LegalRequest::query()->sole();
expect($request->type)->toBe(LegalRequestType::Dsgvo)
expect($request->type)->toBe(LegalRequestType::Correction)
->and($request->press_release_id)->toBe($pressRelease->id)
->and($request->requester_email)->toBe('presse@firma.example')
->and($request->verified_at)->not->toBeNull()
@ -137,6 +158,76 @@ test('a verified visitor can submit a concern which lands verified in the queue'
Mail::assertQueued(LegalRequestReceived::class, fn (LegalRequestReceived $mail) => $mail->hasTo('presse@firma.example'));
});
test('the dsgvo concern requires terms and enforces the mandatory preview', function () {
/** @var TestCase $this */
Mail::fake();
$pressRelease = publishedReleaseWithContact();
$pressRelease->forceFill(['title' => 'Max Mustermann übernimmt die Leitung'])->save();
$link = app(MagicLinkGenerator::class)->createReportLink($pressRelease, 'presse@firma.example');
$this->get('/de/melden/pm/verifizieren/'.$link['plain_token']);
// Ohne Begriffe und ohne Entfernungs-Option → Fehler.
$this->post('/de/melden/pm/anliegen', [
'concern' => 'dsgvo',
'message' => 'Bitte meinen Namen entfernen, danke.',
])->assertSessionHasErrors('redaction_terms');
// Begriffe ohne Treffer → Fehler mit Hinweis auf die Schreibweise.
$this->post('/de/melden/pm/anliegen', [
'concern' => 'dsgvo',
'message' => 'Bitte meinen Namen entfernen, danke.',
'redaction_terms' => 'Kommtnichtvor',
])->assertSessionHasErrors('redaction_terms');
// Mit Treffern → Pflicht-Vorschau (kein Redirect), noch KEINE Anfrage.
$this->post('/de/melden/pm/anliegen', [
'concern' => 'dsgvo',
'message' => 'Bitte meinen Namen entfernen, danke.',
'redaction_terms' => 'Max Mustermann',
])->assertOk()
->assertSee('Vorschau: So sieht die Mitteilung nach der Schwärzung aus')
->assertSee('[entfernt] übernimmt die Leitung')
->assertSee('Verbindlich einreichen');
expect(LegalRequest::query()->count())->toBe(0)
->and($pressRelease->fresh()->title)->toBe('Max Mustermann übernimmt die Leitung');
});
test('the confirmed dsgvo submission stores a structured redaction order without touching the release', function () {
/** @var TestCase $this */
Mail::fake();
$pressRelease = publishedReleaseWithContact();
$pressRelease->forceFill(['title' => 'Max Mustermann übernimmt die Leitung'])->save();
$link = app(MagicLinkGenerator::class)->createReportLink($pressRelease, 'presse@firma.example');
$this->get('/de/melden/pm/verifizieren/'.$link['plain_token']);
$this->post('/de/melden/pm/anliegen', [
'concern' => 'dsgvo',
'message' => 'Bitte meinen Namen entfernen, danke.',
'redaction_terms' => "Max Mustermann\nMustermanns",
'detach_contacts' => '1',
'remove_images' => '1',
'confirmed' => '1',
])->assertSessionHas('pm-report-status');
$request = LegalRequest::query()->sole();
expect($request->type)->toBe(LegalRequestType::Dsgvo)
->and($request->status)->toBe(LegalRequestStatus::Open)
->and($request->payload['redaction']['terms'])->toBe(['Max Mustermann', 'Mustermanns'])
->and($request->payload['redaction']['detach_contacts'])->toBeTrue()
->and($request->payload['redaction']['remove_images_requested'])->toBeTrue()
->and($request->payload['redaction']['preview_total_hits'])->toBeGreaterThan(0)
->and($request->executed_at)->toBeNull()
// Einreichung ≠ Ausführung: an der PM ändert sich nichts.
->and($pressRelease->fresh()->title)->toBe('Max Mustermann übernimmt die Leitung')
->and($pressRelease->fresh()->contacts()->count())->toBe(1);
Mail::assertQueued(LegalRequestReceived::class, fn (LegalRequestReceived $mail) => $mail->hasTo('presse@firma.example'));
});
test('a second open concern of the same type is blocked', function () {
/** @var TestCase $this */
Mail::fake();

50
tests/Feature/LegalRequestTest.php
View file

@ -49,6 +49,56 @@ test('the legal request form renders with per-type hints and hidden honeypots',
->assertSee('name="homepage"', false);
});
test('the triage offers the portal magic-link path', function () {
/** @var TestCase $this */
$release = publishedRelease();
$this->get(route('legal-request.create', ['slug' => $release->slug, 'type' => 'dsgvo']))
->assertOk()
// Stufe 1: Anliegen-Karten inkl. Absender-Selbstservice.
->assertSee('Korrektur, Änderung oder Depublizierung')
->assertSee('Rechtswidrige Inhalte melden')
// Passwortloser Anmeldelink ins Portal (PMs werden im Konto zusammengeführt).
->assertSee('Anmeldelink im Portal anfordern')
->assertSee(rtrim(config('domains.domain_portal_url', config('app.url')), '/').'/anmeldelink', false)
// Fallback nur mit Identifizierungs-Hinweis.
->assertSee('persönliche Identifizierung erforderlich')
// Vorauswahl aus dem Query-Parameter.
->assertSee("concern: 'dsgvo'", false);
});
test('owner concerns preselect the self-service card', function () {
/** @var TestCase $this */
$release = publishedRelease();
$this->get(route('legal-request.create', ['slug' => $release->slug, 'type' => 'depublication']))
->assertOk()
->assertSee("concern: 'owner'", false);
});
test('owner track types are rejected by the public store endpoint', function () {
/** @var TestCase $this */
Mail::fake();
$release = publishedRelease();
$this->from(route('legal-request.create', ['slug' => $release->slug]))
->post(route('legal-request.store', ['slug' => $release->slug]), [
'type' => 'correction',
'message' => 'Bitte den Titel dieser Mitteilung komplett austauschen.',
])->assertSessionHasErrors('type');
expect(LegalRequest::query()->count())->toBe(0);
});
test('the report intake prefills the reported url from the query string', function () {
/** @var TestCase $this */
$detailUrl = 'https://presseecho.test/de/press-release/beispiel-pm';
$this->get(route('melden.pm', ['edition' => 'de', 'reported_url' => $detailUrl]))
->assertOk()
->assertSee('value="'.$detailUrl.'"', false);
});
test('the form 404s for a non-published release', function () {
/** @var TestCase $this */
$draft = PressRelease::factory()->forPortal(Portal::Businessportal24)->create();

50
tests/Feature/Web/ReleaseDetailTest.php
View file

@ -80,6 +80,56 @@ test('businessportal24 release detail renders the editorial shell with real data
->assertSee(rtrim(config('domains.domain_portal_url'), '/').'/anmeldelink', false);
});
test('release detail falls back to the company contact when the release has none', function () {
/** @var TestCase $this */
[$category, $company] = detailCategoryAndCompany(Portal::Businessportal24);
// Legacy-Import-Fall: PM ohne eigene Kontakt-Verknüpfung — im Altsystem
// hingen Pressekontakte an der Firma.
$release = PressRelease::factory()
->published()
->forPortal(Portal::Businessportal24)
->for($category)
->for($company)
->create(['published_at' => now()->subDay()]);
Contact::factory()->create([
'portal' => Portal::Businessportal24,
'company_id' => $company->id,
'first_name' => 'Jonas',
'last_name' => 'Feldkamp',
'email' => 'presse@muster-energie.de',
]);
expect($release->contacts()->count())->toBe(0);
$this->get('https://businessportal24.test/de/press-release/'.$release->slug)
->assertSuccessful()
->assertSeeText('Pressekontakt')
->assertSeeText('Jonas Feldkamp');
// Der Fallback ist reine Anzeige — es entsteht keine Pivot-Verknüpfung.
expect($release->contacts()->count())->toBe(0);
});
test('release detail shows company data as press contact when no contact record exists at all', function () {
/** @var TestCase $this */
[$category, $company] = detailCategoryAndCompany(Portal::Businessportal24);
$company->update(['email' => 'kontakt@muster-energie.de']);
$release = PressRelease::factory()
->published()
->forPortal(Portal::Businessportal24)
->for($category)
->for($company)
->create(['published_at' => now()->subDay()]);
$this->get('https://businessportal24.test/de/press-release/'.$release->slug)
->assertSuccessful()
->assertSeeText('Pressekontakt')
->assertSeeText('kontakt@muster-energie.de');
});
test('release detail without image embeds the headline in the generated hero', function () {
/** @var TestCase $this */
[$category, $company] = detailCategoryAndCompany(Portal::Businessportal24);