recht: Meldeverfahren v2 Phasen 1-4 — Re-Sync-Sperre, Anonymisierung, Magic-Link-Intake, Self-Service-Korrektur

Phase 1: sync_locked_at auf press_releases (Importer überspringt gesperrte
PMs auch bei --force), LegalRequest um Verifikation/Ausführung erweitert,
verschlüsselte Vorher-Snapshots mit Löschfrist (snapshots:purge, täglich).

Phase 2: AnonymizationService (Unicode-Wortgrenzen-Schwärzung, Pflicht-Diff,
transaktionale Ausführung mit Snapshot, Kontakt-Detach, Bild-Löschung,
Sitemap-Invalidierung, Verlauf ohne Klartext-Altwerte); Admin-Queue kann
DSGVO-Anfragen anonymisieren oder depublizieren, inkl. Snapshot-Restore.

Phase 3: Deflektions-Trichter „PM melden/ändern" (melden/pm) mit Kosten-
Tabelle vorab; Magic-Link geht nur an die hinterlegte Pressekontaktadresse
(neuer purpose press_release_report), atomare Verifikation, Anliegen-Auswahl
erzeugt verifizierte Queue-Anfragen; toter-Kanal-Fallback; Owner-Einstieg.

Phase 4: Panel-Abschnitt „Änderung & Korrektur" — Levenshtein-Gate (5 %,
Mini-Edit-Ausnahme ≤ 2 Zeichen) stuft klein/groß ein; kleine Korrektur
kostenlos sofort live (Snapshot, Sperre, Verlauf, Re-Score), größere als
Change-Anfrage (Interim bis 10-€-Checkout, Phase 7).

Entwicklungsplan mit Entscheidungen E1-E8 und offenen Punkten in
docs/Decision-Update; 41 Pest-Tests (tests/Feature/Legal) grün.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Feature/Legal/AdminLegalRequestExecutionTest.php

@@ -0,0 +1,165 @@
+<?php
+
+use App\Enums\LegalRequestStatus;
+use App\Enums\LegalRequestType;
+use App\Enums\PressReleaseStatus;
+use App\Models\LegalRequest;
+use App\Models\PressRelease;
+use App\Models\User;
+use App\Services\PressRelease\AnonymizationService;
+use Database\Seeders\RolesAndPermissionsSeeder;
+use Livewire\Volt\Volt;
+use Tests\TestCase;
+
+beforeEach(function () {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+});
+
+function adminUserForLegalQueue(): User
+{
+    $admin = User::factory()->create(['is_active' => true]);
+    $admin->assignRole('admin');
+
+    return $admin;
+}
+
+test('an admin can preview and execute an anonymization from the queue', function () {
+    /** @var TestCase $this */
+    $this->actingAs(adminUserForLegalQueue());
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'title' => 'Matvey Teplitsky im Vorstand',
+    ]);
+    $request = LegalRequest::factory()
+        ->type(LegalRequestType::Dsgvo)
+        ->create(['press_release_id' => $pressRelease->id]);
+
+    Volt::test('admin.legal-requests.show', ['id' => $request->id])
+        ->set('redactionTerms', "Matvey Teplitsky\nTeplitsky")
+        ->set('redactionReplacement', 'der Sprecher')
+        ->call('previewAnonymization')
+        ->assertHasNoErrors()
+        ->call('executeAnonymization')
+        ->assertHasNoErrors();
+
+    $pressRelease->refresh();
+    $request->refresh();
+
+    expect($pressRelease->title)->toBe('der Sprecher im Vorstand')
+        ->and($pressRelease->isSyncLocked())->toBeTrue()
+        ->and($request->status)->toBe(LegalRequestStatus::Resolved)
+        ->and($request->executed_at)->not->toBeNull();
+});
+
+test('the panel prefills the replacement and shows the full content for copying terms', function () {
+    /** @var TestCase $this */
+    $this->actingAs(adminUserForLegalQueue());
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'title' => 'Matvey Teplitsky im Vorstand',
+        'text' => '<p>Ansprechpartner ist Matvey Teplitsky, Telefon 0123.</p>',
+    ]);
+    $request = LegalRequest::factory()
+        ->type(LegalRequestType::Dsgvo)
+        ->create(['press_release_id' => $pressRelease->id]);
+
+    Volt::test('admin.legal-requests.show', ['id' => $request->id])
+        ->assertSet('redactionReplacement', AnonymizationService::DEFAULT_REPLACEMENT)
+        ->assertSee('Ansprechpartner ist Matvey Teplitsky')
+        ->set('redactionTerms', 'Matvey Teplitsky')
+        ->call('previewAnonymization')
+        ->assertHasNoErrors()
+        ->assertSee('Ansprechpartner ist [entfernt]')
+        ->assertSee('Vorschau nach Schwärzung');
+
+    expect($pressRelease->fresh()->title)->toBe('Matvey Teplitsky im Vorstand');
+});
+
+test('execute without a prior preview is refused', function () {
+    /** @var TestCase $this */
+    $this->actingAs(adminUserForLegalQueue());
+
+    $pressRelease = PressRelease::factory()->published()->create(['title' => 'Original']);
+    $request = LegalRequest::factory()
+        ->type(LegalRequestType::Dsgvo)
+        ->create(['press_release_id' => $pressRelease->id]);
+
+    Volt::test('admin.legal-requests.show', ['id' => $request->id])
+        ->set('redactionTerms', 'Original')
+        ->call('executeAnonymization')
+        ->assertHasErrors('redactionTerms');
+
+    expect($pressRelease->fresh()->title)->toBe('Original')
+        ->and($request->fresh()->executed_at)->toBeNull();
+});
+
+test('an admin can depublish instead of anonymizing', function () {
+    /** @var TestCase $this */
+    $this->actingAs(adminUserForLegalQueue());
+
+    $pressRelease = PressRelease::factory()->published()->create();
+    $request = LegalRequest::factory()
+        ->type(LegalRequestType::Dsgvo)
+        ->create(['press_release_id' => $pressRelease->id]);
+
+    Volt::test('admin.legal-requests.show', ['id' => $request->id])
+        ->call('depublishRelease')
+        ->assertHasNoErrors();
+
+    $pressRelease->refresh();
+    $request->refresh();
+
+    expect($pressRelease->status)->toBe(PressReleaseStatus::Archived)
+        ->and($pressRelease->depublished_at)->not->toBeNull()
+        ->and($pressRelease->isSyncLocked())->toBeTrue()
+        ->and($request->status)->toBe(LegalRequestStatus::Resolved)
+        ->and($request->executed_at)->not->toBeNull();
+});
+
+test('an executed anonymization can be rolled back from the snapshot', function () {
+    /** @var TestCase $this */
+    $this->actingAs(adminUserForLegalQueue());
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'title' => 'Matvey Teplitsky im Vorstand',
+    ]);
+    $request = LegalRequest::factory()
+        ->type(LegalRequestType::Dsgvo)
+        ->create(['press_release_id' => $pressRelease->id]);
+
+    Volt::test('admin.legal-requests.show', ['id' => $request->id])
+        ->set('redactionTerms', 'Matvey Teplitsky')
+        ->call('previewAnonymization')
+        ->call('executeAnonymization')
+        ->assertHasNoErrors()
+        ->call('restoreSnapshot')
+        ->assertHasNoErrors();
+
+    $pressRelease->refresh();
+    $request->refresh();
+
+    expect($pressRelease->title)->toBe('Matvey Teplitsky im Vorstand')
+        ->and($pressRelease->isSyncLocked())->toBeTrue()
+        ->and($request->status)->toBe(LegalRequestStatus::InProgress)
+        ->and($request->executed_at)->toBeNull();
+});
+
+test('anonymization actions are forbidden without the compliance permission', function () {
+    /** @var TestCase $this */
+    $customer = User::factory()->create(['is_active' => true]);
+    $customer->assignRole('customer');
+    $this->actingAs($customer);
+
+    $pressRelease = PressRelease::factory()->published()->create(['title' => 'Original']);
+    $request = LegalRequest::factory()
+        ->type(LegalRequestType::Dsgvo)
+        ->create(['press_release_id' => $pressRelease->id]);
+
+    Volt::test('admin.legal-requests.show', ['id' => $request->id])
+        ->set('redactionTerms', 'Original')
+        ->call('previewAnonymization')
+        ->assertForbidden();
+
+    expect($pressRelease->fresh()->title)->toBe('Original');
+});