R2.1: Kontaktformular-Backend (Controller + Mailable + Brand-Empfaenger)

POST kontakt mit Validierung, Honeypot (vor der Validierung, stilles Abnicken), IP-Rate-Limit (5/h) + throttle:10,1. Versand an brand.contact_email (neue CONTACT_EMAIL_*-Keys, [EXTERN: echte Adressen]), Fallback MAIL_FROM_ADDRESS; Reply-To = Absender. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-03 08:14:52 +00:00 · 2026-07-03 08:14:52 +00:00 · a4d054b3ab
commit a4d054b3ab
parent 1e9c2f96ed
7 changed files with 234 additions and 0 deletions
--- a/app/Http/Controllers/Web/ContactController.php
+++ b/app/Http/Controllers/Web/ContactController.php
@ -0,0 +1,79 @@
+<?php
+
+namespace App\Http\Controllers\Web;
+
+use App\Http\Controllers\Controller;
+use App\Mail\ContactRequestSubmitted;
+use App\Support\WebPortalContext;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Validation\ValidationException;
+
+/**
+ * Öffentliches Kontaktformular der Web-Domains. Versendet die Anfrage per
+ * Mail an die Brand-Kontaktadresse (config domains.*.brand.contact_email,
+ * Fallback: Absenderadresse der Anwendung). Kein Persistieren.
+ */
+class ContactController extends Controller
+{
+    public function __invoke(Request $request): RedirectResponse
+    {
+        // Bot: ein ausgefülltes Honeypot-Feld → still und neutral abnicken,
+        // bewusst VOR der Validierung (sonst verrät die size:0-Regel die Falle).
+        if (filled($request->input('website')) || filled($request->input('homepage'))) {
+            return $this->done();
+        }
+
+        $validated = $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'email' => ['required', 'email', 'max:255'],
+            'message' => ['required', 'string', 'min:10', 'max:5000'],
+        ]);
+
+        $this->ensureNotRateLimited($request);
+        RateLimiter::hit($this->throttleKey($request), 3600);
+
+        Mail::to($this->recipient())->send(new ContactRequestSubmitted(
+            senderName: $validated['name'],
+            senderEmail: $validated['email'],
+            messageText: $validated['message'],
+            host: $request->getHost(),
+        ));
+
+        return $this->done();
+    }
+
+    private function done(): RedirectResponse
+    {
+        return back()->with('contact-status', __('Vielen Dank für Ihre Nachricht. Wir melden uns schnellstmöglich bei Ihnen zurück.'));
+    }
+
+    private function recipient(): string
+    {
+        $brand = WebPortalContext::fromRequest()->domainConfig['brand'] ?? [];
+
+        return $brand['contact_email'] ?? config('mail.from.address');
+    }
+
+    private function ensureNotRateLimited(Request $request): void
+    {
+        if (! RateLimiter::tooManyAttempts($this->throttleKey($request), 5)) {
+            return;
+        }
+
+        $seconds = RateLimiter::availableIn($this->throttleKey($request));
+
+        throw ValidationException::withMessages([
+            'message' => __('Zu viele Anfragen. Bitte versuchen Sie es in :minutes Minuten erneut.', [
+                'minutes' => max(1, (int) ceil($seconds / 60)),
+            ]),
+        ]);
+    }
+
+    private function throttleKey(Request $request): string
+    {
+        return 'contact-form|'.$request->ip();
+    }
+}