recht: Meldeverfahren v2 Phasen 1-4 — Re-Sync-Sperre, Anonymisierung, Magic-Link-Intake, Self-Service-Korrektur

Phase 1: sync_locked_at auf press_releases (Importer überspringt gesperrte
PMs auch bei --force), LegalRequest um Verifikation/Ausführung erweitert,
verschlüsselte Vorher-Snapshots mit Löschfrist (snapshots:purge, täglich).

Phase 2: AnonymizationService (Unicode-Wortgrenzen-Schwärzung, Pflicht-Diff,
transaktionale Ausführung mit Snapshot, Kontakt-Detach, Bild-Löschung,
Sitemap-Invalidierung, Verlauf ohne Klartext-Altwerte); Admin-Queue kann
DSGVO-Anfragen anonymisieren oder depublizieren, inkl. Snapshot-Restore.

Phase 3: Deflektions-Trichter „PM melden/ändern" (melden/pm) mit Kosten-
Tabelle vorab; Magic-Link geht nur an die hinterlegte Pressekontaktadresse
(neuer purpose press_release_report), atomare Verifikation, Anliegen-Auswahl
erzeugt verifizierte Queue-Anfragen; toter-Kanal-Fallback; Owner-Einstieg.

Phase 4: Panel-Abschnitt „Änderung & Korrektur" — Levenshtein-Gate (5 %,
Mini-Edit-Ausnahme ≤ 2 Zeichen) stuft klein/groß ein; kleine Korrektur
kostenlos sofort live (Snapshot, Sperre, Verlauf, Re-Score), größere als
Change-Anfrage (Interim bis 10-€-Checkout, Phase 7).

Entwicklungsplan mit Entscheidungen E1-E8 und offenen Punkten in
docs/Decision-Update; 41 Pest-Tests (tests/Feature/Legal) grün.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/Feature/Legal/PressReleaseReportFlowTest.php

@@ -0,0 +1,190 @@
+<?php
+
+use App\Enums\LegalRequestStatus;
+use App\Enums\LegalRequestType;
+use App\Enums\LegalRequestVerificationMethod;
+use App\Mail\LegalRequestReceived;
+use App\Mail\PressReleaseReportLink;
+use App\Models\Contact;
+use App\Models\LegalRequest;
+use App\Models\MagicLink;
+use App\Models\PressRelease;
+use App\Models\User;
+use App\Services\Auth\MagicLinkGenerator;
+use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\RateLimiter;
+use Tests\TestCase;
+
+beforeEach(function () {
+    RateLimiter::clear('pm-report|127.0.0.1');
+});
+
+function publishedReleaseWithContact(string $contactEmail = 'presse@firma.example'): PressRelease
+{
+    $pressRelease = PressRelease::factory()->published()->create();
+    $contact = Contact::factory()->create(['email' => $contactEmail]);
+    $pressRelease->contacts()->attach($contact->id);
+
+    return $pressRelease;
+}
+
+function detailUrlFor(PressRelease $pressRelease): string
+{
+    return 'https://presseecho.test/de/press-release/'.$pressRelease->slug;
+}
+
+test('the intake sends a magic link to the stored press contact, never to a form address', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $pressRelease = publishedReleaseWithContact('presse@firma.example');
+
+    $response = $this->post('/de/melden/pm', [
+        'reported_url' => detailUrlFor($pressRelease),
+    ]);
+
+    $response->assertRedirect();
+    $response->assertSessionHas('pm-report-status', fn (string $status) => str_contains($status, 'p***@firma.example'));
+
+    Mail::assertQueued(PressReleaseReportLink::class, fn (PressReleaseReportLink $mail) => $mail->hasTo('presse@firma.example'));
+
+    $link = MagicLink::query()->where('purpose', 'press_release_report')->sole();
+    expect($link->payload['press_release_id'])->toBe($pressRelease->id)
+        ->and($link->payload['contact_email'])->toBe('presse@firma.example');
+});
+
+test('an unknown url is rejected with a validation error', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $this->post('/de/melden/pm', ['reported_url' => 'https://presseecho.test/de/press-release/gibt-es-nicht'])
+        ->assertSessionHasErrors('reported_url');
+
+    Mail::assertNothingQueued();
+});
+
+test('a release without any contact email points to the manual fallback', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $pressRelease = PressRelease::factory()->published()->create();
+    $pressRelease->company()->withoutGlobalScopes()->update(['email' => null]);
+
+    $this->post('/de/melden/pm', ['reported_url' => detailUrlFor($pressRelease)])
+        ->assertSessionHas('pm-report-manual', true);
+
+    Mail::assertNothingQueued();
+});
+
+test('link requests per release are rate limited', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+    config()->set('legal.report_links_per_day', 1);
+
+    $pressRelease = publishedReleaseWithContact();
+
+    $this->post('/de/melden/pm', ['reported_url' => detailUrlFor($pressRelease)])
+        ->assertSessionHas('pm-report-status');
+
+    $this->post('/de/melden/pm', ['reported_url' => detailUrlFor($pressRelease)])
+        ->assertSessionHasErrors('reported_url');
+
+    Mail::assertQueuedCount(1);
+});
+
+test('the magic link verifies once and opens the concern selection', function () {
+    /** @var TestCase $this */
+    $pressRelease = publishedReleaseWithContact();
+    $link = app(MagicLinkGenerator::class)->createReportLink($pressRelease, 'presse@firma.example');
+
+    $this->get('/de/melden/pm/verifizieren/'.$link['plain_token'])
+        ->assertRedirect('/de/melden/pm/anliegen');
+
+    $this->get('/de/melden/pm/anliegen')
+        ->assertOk()
+        ->assertSee($pressRelease->title)
+        ->assertSee('p***@firma.example');
+
+    // Zweiter Klick: Link ist verbraucht.
+    $this->get('/de/melden/pm/verifizieren/'.$link['plain_token'])
+        ->assertRedirect('/de/melden/pm')
+        ->assertSessionHas('pm-report-error');
+});
+
+test('a verified visitor can submit a concern which lands verified in the queue', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $pressRelease = publishedReleaseWithContact();
+    $link = app(MagicLinkGenerator::class)->createReportLink($pressRelease, 'presse@firma.example');
+    $this->get('/de/melden/pm/verifizieren/'.$link['plain_token']);
+
+    $this->post('/de/melden/pm/anliegen', [
+        'concern' => 'dsgvo',
+        'message' => 'Bitte meinen Namen aus dem Pressekontakt entfernen.',
+    ])->assertSessionHas('pm-report-status');
+
+    $request = LegalRequest::query()->sole();
+
+    expect($request->type)->toBe(LegalRequestType::Dsgvo)
+        ->and($request->press_release_id)->toBe($pressRelease->id)
+        ->and($request->requester_email)->toBe('presse@firma.example')
+        ->and($request->verified_at)->not->toBeNull()
+        ->and($request->verification_method)->toBe(LegalRequestVerificationMethod::MagicLink)
+        ->and($request->status)->toBe(LegalRequestStatus::Open);
+
+    Mail::assertQueued(LegalRequestReceived::class, fn (LegalRequestReceived $mail) => $mail->hasTo('presse@firma.example'));
+});
+
+test('a second open concern of the same type is blocked', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $pressRelease = publishedReleaseWithContact();
+    $link = app(MagicLinkGenerator::class)->createReportLink($pressRelease, 'presse@firma.example');
+    $this->get('/de/melden/pm/verifizieren/'.$link['plain_token']);
+
+    LegalRequest::factory()->type(LegalRequestType::Correction)->create([
+        'press_release_id' => $pressRelease->id,
+        'status' => LegalRequestStatus::Open,
+    ]);
+
+    $this->post('/de/melden/pm/anliegen', [
+        'concern' => 'correction',
+        'message' => 'Bitte Tippfehler im Titel korrigieren.',
+    ])->assertSessionHasErrors('concern');
+});
+
+test('the concern page requires a verified session', function () {
+    /** @var TestCase $this */
+    $this->get('/de/melden/pm/anliegen')
+        ->assertRedirect('/de/melden/pm')
+        ->assertSessionHas('pm-report-error');
+});
+
+test('a logged-in owner skips verification and lands in the concern selection', function () {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+    $owner = User::factory()->create(['is_active' => true]);
+    $owner->assignRole('customer');
+    $pressRelease = PressRelease::factory()->published()->create(['user_id' => $owner->id]);
+
+    $this->actingAs($owner)
+        ->post('/admin/me/press-releases/'.$pressRelease->id.'/melden')
+        ->assertRedirect('/de/melden/pm/anliegen');
+
+    $this->get('/de/melden/pm/anliegen')->assertOk()->assertSee($pressRelease->title);
+});
+
+test('a foreign user cannot start the report flow for someone elses release', function () {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+    $stranger = User::factory()->create(['is_active' => true]);
+    $stranger->assignRole('customer');
+    $pressRelease = PressRelease::factory()->published()->create();
+
+    $this->actingAs($stranger)
+        ->post('/admin/me/press-releases/'.$pressRelease->id.'/melden')
+        ->assertForbidden();
+});