Optimierung Phase 0: Korrektheit & Security

Konsolidierter Entwicklungsplan aus den zwei Analyse-Dokumenten plus
Umsetzung der Phase-0-Massnahmen (Korrektheit/Security, je mit Tests):

0.1 BasicAuth: timing-sicherer Vergleich (hash_equals, beide Felder ohne
    Short-Circuit); Enabled-Check zur Laufzeit via config('auth.basic.*')
    statt env() im Bootstrap-Closure (greift jetzt unter config:cache);
    Config-Block + .env.example. Fund: auth.basic.* war nie als Config
    definiert, Gate war faktisch unkonfigurierbar.
0.2 Legacy-Invoice-"latest"-Abfrage zentralisiert (LegacyInvoice::
    scopeLatestFirst + User::latestLegacyInvoice); beide Consumer N+1-frei
    umgestellt; unterschiedliches null-Verhalten bewusst erhalten.
0.3 Payment-Option-Eligibility vereinheitlicht (period-aware, strikt):
    UserPaymentOption::scopeActiveNow/grandfatheredNow + User::
    hasActivePaymentOption; hasActiveBooking/hasUnlimitedPressReleaseQuota
    und ApiAccessEligibilityService darauf umgestellt; $hasGrandfathered-
    Mislabel behoben.
0.4 Theme->Portal-Vokabular: totes, projektfremdes ThemeMiddleware
    geloescht; Mapping in Portal::fromTheme() zentralisiert; fremden
    b2in-Default im ThemeServiceProvider auf Portal-Default korrigiert.
0.5 InvoiceNumberGenerator: Erst-Insert race-sicher via insertOrIgnore
    (Unique-Index auf circle existiert bereits). CreditWalletService war
    bereits abgesichert (Unique-Index + createOrFirst).

Tests: 4 neue Dateien, 5 bestehende auf gueltiges grandfathered_until
angepasst. Volle Suite gruen (793 passed, 1 skipped).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/Feature/ApiAccessEligibilityServiceTest.php

@@ -0,0 +1,97 @@
+<?php
+
+use App\Enums\UserPaymentOptionStatus;
+use App\Models\LegacyInvoice;
+use App\Models\User;
+use App\Models\UserPaymentOption;
+use App\Services\Api\ApiAccessEligibilityService;
+
+function makeLegacyInvoice(User $user, string $status, string $invoiceDate): LegacyInvoice
+{
+    return LegacyInvoice::query()->create([
+        'legacy_portal' => 'businessportal24',
+        'legacy_id' => fake()->unique()->numberBetween(1, 1_000_000),
+        'user_id' => $user->id,
+        'legacy_user_id' => $user->id,
+        'number' => 'LEG-'.fake()->unique()->numberBetween(1, 1_000_000),
+        'total_cents' => 4900,
+        'status' => $status,
+        'invoice_date' => $invoiceDate,
+        'paid_at' => $status === 'paid' ? $invoiceDate : null,
+        'imported_at' => now(),
+    ]);
+}
+
+test('latestLegacyInvoice returns newest by invoice_date then id', function () {
+    $user = User::factory()->create();
+    makeLegacyInvoice($user, 'paid', '2024-01-01');
+    $newest = makeLegacyInvoice($user, 'reminder', '2024-06-01');
+    makeLegacyInvoice($user, 'paid', '2024-03-01');
+
+    expect($user->latestLegacyInvoice()->id)->toBe($newest->id);
+});
+
+test('token gate grants access when latest legacy invoice is paid', function () {
+    $user = User::factory()->create(['is_active' => true]);
+    makeLegacyInvoice($user, 'paid', '2024-01-01');
+
+    expect((new ApiAccessEligibilityService)->canCreateToken($user))->toBeTrue();
+});
+
+test('token gate denies when latest legacy invoice is unpaid even if an older one was paid', function () {
+    $user = User::factory()->create(['is_active' => true]);
+    makeLegacyInvoice($user, 'paid', '2024-01-01');
+    makeLegacyInvoice($user, 'reminder', '2024-06-01');
+
+    expect((new ApiAccessEligibilityService)->canCreateToken($user))->toBeFalse();
+});
+
+test('token gate denies when there is no legacy invoice and no active payment option', function () {
+    $user = User::factory()->create(['is_active' => true]);
+
+    expect((new ApiAccessEligibilityService)->canCreateToken($user))->toBeFalse();
+});
+
+test('hasActivePaymentOption is period-aware for active options', function () {
+    $user = User::factory()->create(['is_active' => true]);
+
+    UserPaymentOption::factory()->for($user)->create([
+        'status' => UserPaymentOptionStatus::Active->value,
+        'current_period_start' => now()->subDay(),
+        'current_period_end' => now()->addDay(),
+    ]);
+    expect($user->hasActivePaymentOption())->toBeTrue();
+
+    $user->userPaymentOptions()->update([
+        'current_period_start' => now()->subMonths(2),
+        'current_period_end' => now()->subMonth(),
+    ]);
+    expect($user->fresh()->hasActivePaymentOption())->toBeFalse();
+});
+
+test('hasActivePaymentOption is period-aware for grandfathering', function () {
+    $user = User::factory()->create(['is_active' => true]);
+
+    $option = UserPaymentOption::factory()->for($user)->create([
+        'status' => UserPaymentOptionStatus::Grandfathered->value,
+        'grandfathered_until' => now()->addMonth(),
+    ]);
+    expect($user->hasActivePaymentOption())->toBeTrue();
+
+    $option->update(['grandfathered_until' => now()->subDay()]);
+    expect($user->fresh()->hasActivePaymentOption())->toBeFalse();
+});
+
+test('booking and quota gates are period-aware when enforcement is on', function () {
+    config()->set('billing.enforce_booking', true);
+
+    $user = User::factory()->create(['is_active' => true]);
+    UserPaymentOption::factory()->for($user)->create([
+        'status' => UserPaymentOptionStatus::Active->value,
+        'current_period_start' => now()->subMonths(2),
+        'current_period_end' => now()->subMonth(),
+    ]);
+
+    expect($user->hasActiveBooking())->toBeFalse()
+        ->and($user->hasUnlimitedPressReleaseQuota())->toBeFalse();
+});

tests/Feature/BasicAuthMiddlewareTest.php

@@ -0,0 +1,59 @@
+<?php
+
+use App\Http\Middleware\BasicAuthMiddleware;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+beforeEach(function () {
+    config()->set('auth.basic.enabled', true);
+    config()->set('auth.basic.user', 'staging');
+    config()->set('auth.basic.password', 'secret');
+});
+
+function handleBasicAuth(Request $request): Response
+{
+    return (new BasicAuthMiddleware)->handle($request, fn () => response('ok'));
+}
+
+test('rejects request without credentials', function () {
+    $response = handleBasicAuth(Request::create('/dashboard', 'GET'));
+
+    expect($response->getStatusCode())->toBe(401)
+        ->and($response->headers->get('WWW-Authenticate'))->toBe('Basic');
+});
+
+test('rejects request with wrong password', function () {
+    $request = Request::create('/dashboard', 'GET', server: [
+        'PHP_AUTH_USER' => 'staging',
+        'PHP_AUTH_PW' => 'wrong',
+    ]);
+
+    expect(handleBasicAuth($request)->getStatusCode())->toBe(401);
+});
+
+test('passes request with correct credentials', function () {
+    $request = Request::create('/dashboard', 'GET', server: [
+        'PHP_AUTH_USER' => 'staging',
+        'PHP_AUTH_PW' => 'secret',
+    ]);
+
+    expect(handleBasicAuth($request)->getStatusCode())->toBe(200);
+});
+
+test('skips gate entirely when disabled', function () {
+    config()->set('auth.basic.enabled', false);
+
+    expect(handleBasicAuth(Request::create('/dashboard', 'GET'))->getStatusCode())->toBe(200);
+});
+
+test('skips gate when credentials are not configured', function () {
+    config()->set('auth.basic.user', null);
+    config()->set('auth.basic.password', null);
+
+    expect(handleBasicAuth(Request::create('/dashboard', 'GET'))->getStatusCode())->toBe(200);
+});
+
+test('skips basic auth for api and livewire routes', function () {
+    expect(handleBasicAuth(Request::create('/api/v1/press-releases', 'GET'))->getStatusCode())->toBe(200)
+        ->and(handleBasicAuth(Request::create('/livewire/update', 'POST'))->getStatusCode())->toBe(200);
+});

tests/Feature/Billing/BookingsPageTest.php

@@ -125,6 +125,7 @@ test('a grandfathered legacy user sees the bestandsschutz package with portal an
         'user_id' => $user->id,
         'status' => UserPaymentOptionStatus::Grandfathered->value,
         'current_period_end' => now()->addMonths(3),
+        'grandfathered_until' => now()->addYear(),
         'legacy_conditions' => [
             'name' => 'Presseverteiler Premium',
             'legacy_portal' => 'presseecho',

tests/Feature/Billing/InvoiceNumberGeneratorTest.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Services\Billing\InvoiceNumberGenerator;
+use Illuminate\Support\Facades\DB;
 
 test('numbers are sequential per circle and circles are independent', function () {
     $generator = app(InvoiceNumberGenerator::class);
@@ -16,3 +17,15 @@ test('an unknown circle is rejected', function () {
     expect(fn () => app(InvoiceNumberGenerator::class)->next('XXX'))
         ->toThrow(InvalidArgumentException::class);
 });
+
+test('an existing sequence row is not reset by the race-safe ensure-insert', function () {
+    DB::table('invoice_number_sequences')->insert([
+        'circle' => InvoiceNumberGenerator::CIRCLE_MANUAL,
+        'next_number' => 5,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    expect(app(InvoiceNumberGenerator::class)->nextManualNumber())->toBe('MAN-00005');
+    expect(DB::table('invoice_number_sequences')->where('circle', 'MAN')->count())->toBe(1);
+});

tests/Feature/Billing/LegacyBundleTest.php

@@ -20,6 +20,7 @@ function grandfatheredPost(User $user, string $portal, int $netCents = 100000):
     return UserPaymentOption::factory()->create([
         'user_id' => $user->id,
         'status' => UserPaymentOptionStatus::Grandfathered->value,
+        'grandfathered_until' => now()->addYear(),
         'stripe_subscription_id' => null,
         'cancelled_at' => null,
         'legacy_conditions' => [

tests/Feature/Customer/DashboardTest.php

@@ -162,6 +162,7 @@ test('a grandfathered bestandskunde does not see the booking-required banner', f
     UserPaymentOption::factory()->create([
         'user_id' => $customer->id,
         'status' => UserPaymentOptionStatus::Grandfathered->value,
+        'grandfathered_until' => now()->addYear(),
         'stripe_subscription_id' => null,
     ]);
 

tests/Feature/CustomerStatusSummaryTest.php

@@ -50,6 +50,7 @@ test('a grandfathered bestandskunde is labelled and counts as active', function
     UserPaymentOption::factory()->create([
         'user_id' => $user->id,
         'status' => UserPaymentOptionStatus::Grandfathered->value,
+        'grandfathered_until' => now()->addYear(),
         'stripe_subscription_id' => null,
     ]);
 

tests/Feature/PressReleaseQuotaTest.php

@@ -89,6 +89,7 @@ test('a grandfathered legacy user has an unlimited quota', function () {
     UserPaymentOption::factory()->create([
         'user_id' => $user->id,
         'status' => UserPaymentOptionStatus::Grandfathered->value,
+        'grandfathered_until' => now()->addYear(),
     ]);
 
     expect($user->pressReleaseQuotaRemaining())->toBeNull();