From a4184af4fb3b65fed4eef4a5fd7ba3e0bb424c8b Mon Sep 17 00:00:00 2001 From: Kevin Adametz Date: Fri, 3 Jul 2026 07:53:41 +0000 Subject: [PATCH] R0.2: gdpr_consent_at bei allen Registrierungspfaden befuellen (DSGVO) Feld existierte seit der Migration-2026-Erweiterung, wurde aber nirgends geschrieben. Jetzt gesetzt bei: Volt-Registrierung (bestaetigte AGB-/ Datenschutz-Checkbox), Magic-Link-Provisioning und Google-OAuth (beide via CustomerAccountProvisioner, Konto-Anlage nutzerinitiiert). Co-Authored-By: Claude Fable 5 --- app/Services/Auth/CustomerAccountProvisioner.php | 3 +++ resources/views/livewire/auth/register.blade.php | 3 +++ tests/Feature/Auth/ContactAccessTest.php | 1 + tests/Feature/Auth/GoogleLoginTest.php | 1 + tests/Feature/Auth/RegistrationTest.php | 3 +++ 5 files changed, 11 insertions(+) diff --git a/app/Services/Auth/CustomerAccountProvisioner.php b/app/Services/Auth/CustomerAccountProvisioner.php index 384c8f33..fd112491 100644 --- a/app/Services/Auth/CustomerAccountProvisioner.php +++ b/app/Services/Auth/CustomerAccountProvisioner.php @@ -30,6 +30,9 @@ class CustomerAccountProvisioner 'email' => $email, 'registration_type' => RegistrationType::Company->value, 'is_active' => true, + // Konto-Anlage ist hier immer nutzerinitiiert (Magic-Link-Anforderung + // bzw. OAuth-Login) – der Zeitpunkt gilt als DSGVO-Einwilligung. + 'gdpr_consent_at' => now(), ...$extraAttributes, ]); diff --git a/resources/views/livewire/auth/register.blade.php b/resources/views/livewire/auth/register.blade.php index f2074d0b..881ebeae 100644 --- a/resources/views/livewire/auth/register.blade.php +++ b/resources/views/livewire/auth/register.blade.php @@ -33,7 +33,10 @@ new #[Layout('components.layouts.auth.pressekonto', ['heading' => 'Konto erstell 'terms_accepted.accepted' => 'Bitte bestätigen Sie unsere AGB und die Datenschutzerklärung.', ]); + // Die bestätigte AGB-/Datenschutz-Checkbox wird als DSGVO-Einwilligung + // mit Zeitstempel festgehalten (users.gdpr_consent_at). unset($validated['terms_accepted']); + $validated['gdpr_consent_at'] = now(); $validated['password'] = Hash::make($validated['password']); // Konto bleibt bis zur E-Mail-Verifizierung inaktiv und rollenlos diff --git a/tests/Feature/Auth/ContactAccessTest.php b/tests/Feature/Auth/ContactAccessTest.php index 5e22d0ed..a9bfb535 100644 --- a/tests/Feature/Auth/ContactAccessTest.php +++ b/tests/Feature/Auth/ContactAccessTest.php @@ -51,6 +51,7 @@ test('requesting access for a known contact lazily creates a scoped account and expect($user->canAccessAdmin())->toBeFalse(); expect($user->canAccessCustomer())->toBeTrue(); expect($user->accessibleCompanyIds())->toContain($company->id); + expect($user->gdpr_consent_at)->not->toBeNull(); Mail::assertSent(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user)); }); diff --git a/tests/Feature/Auth/GoogleLoginTest.php b/tests/Feature/Auth/GoogleLoginTest.php index 04349a19..71341818 100644 --- a/tests/Feature/Auth/GoogleLoginTest.php +++ b/tests/Feature/Auth/GoogleLoginTest.php @@ -39,6 +39,7 @@ test('a new google user is created active, verified and as customer', function ( expect($user->hasRole('customer'))->toBeTrue(); expect($user->oauth_provider)->toBe('google'); expect($user->oauth_provider_id)->toBe('g-new-1'); + expect($user->gdpr_consent_at)->not->toBeNull(); $this->assertAuthenticatedAs($user); }); diff --git a/tests/Feature/Auth/RegistrationTest.php b/tests/Feature/Auth/RegistrationTest.php index be11e185..3f501b68 100644 --- a/tests/Feature/Auth/RegistrationTest.php +++ b/tests/Feature/Auth/RegistrationTest.php @@ -36,6 +36,9 @@ test('new users register inactive and are sent to the verification notice', func expect($user->hasVerifiedEmail())->toBeFalse(); expect($user->roles()->count())->toBe(0); + // Die bestätigte AGB-/Datenschutz-Checkbox wird als Einwilligung festgehalten. + expect($user->gdpr_consent_at)->not->toBeNull(); + Notification::assertSentTo($user, VerifyEmail::class); });