recht: Meldeverfahren v2 Phasen 5+7 — DSGVO-Strukturformular, 10-€-Checkout mit KI-Vorprüfung, Triage & Panel-Modal

Phase 7 (Spur D, E2 revidiert): KI-Vorprüfung VOR der Zahlung im Modal — rot lehnt ohne Zahlung ab, gelb/grün führt zum Stripe-Checkout (SinglePurchaseType::Change, 10 € netto), nach Zahlungseingang übernimmt der Webhook die geprüfte Fassung sofort (applyPaid: Snapshot, Sperre, Verlauf). Nur einmal je PM; Obergrenze legal.change_max_distance_percent (50 %) verhindert die verdeckte Selbst-Depublizierung. Phase 5 (Spur B): strukturiertes Schwärzungsformular mit Pflicht-Vorschau im verifizierten Web-Bereich UND als Modal im Kunden-Panel; Admin-Editor wird aus payload.redaction vorbefüllt. Umsetzungsmail LegalRequestExecuted an Antragsteller, Bestätigungsmail PressReleaseChangeApplied (Spur A/D, neuer abbestellbarer Typ press_release_corrected). Außerdem: - Re-Sync-Sperre + Sitemap-Invalidierung fest in depublish() verankert (Lücke im bezahlten Webhook-Pfad geschlossen) - Öffentliche „Rechtliches"-Seite als zweistufige Triage: primär der Portal-Anmeldelink, Formular nur Fallback mit Identifizierungs-Hinweis; Store auf report/dsgvo/personal_rights gehärtet - Panel-Button „Ändern/Melden" öffnet Anliegen-Modal (4 Spuren) statt des Web-Formulars - Pressekontakt-Fallback für Legacy-Bestände (30k PMs ohne Verknüpfung): Detailseite + pressContactEmail() nutzen PM-Kontakt → Firmen-Kontakt → Firmendaten - Korrektur-Gate entity-fest (Editor-Normalisierung zählt nicht als Änderung), toEditorHtml() in Admin-Edit + Korrektur-Panel, Wochenlimit-Hinweis in Text und Bremsen-Meldung Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-23 13:02:57 +00:00 · 2026-07-23 13:02:57 +00:00 · e6eca9c85f
commit e6eca9c85f
parent 04b49c567d
40 changed files with 2507 additions and 169 deletions
--- a/tests/Feature/Admin/AdminPressReleaseFormFieldsTest.php
+++ b/tests/Feature/Admin/AdminPressReleaseFormFieldsTest.php
@ -151,6 +151,26 @@ test('admin edit hydratisiert subtitle, boilerplate_override und Kontakt', funct
        ->assertSet('contactId', $contact->id);
 });

+test('admin edit wandelt Legacy-Plaintext für den Editor in Absätze', function () {
+    /** @var TestCase $this */
+    $admin = makeFieldsAdmin();
+    $company = Company::factory()->presseecho()->create();
+
+    $pr = PressRelease::factory()->create([
+        'company_id' => $company->id,
+        'text' => "Erster Absatz der Meldung.\r\n\r\nZweiter Absatz nach Leerzeile.\r\nDritte Zeile direkt darunter.",
+    ]);
+
+    $this->actingAs($admin);
+
+    $component = LivewireVolt::test('admin.press-releases.edit', ['id' => $pr->id]);
+    $editorText = $component->get('text');
+
+    expect($editorText)->toContain('<p>Erster Absatz der Meldung.</p>')
+        ->and($editorText)->toContain('<p>Zweiter Absatz nach Leerzeile.<br>')
+        ->and($editorText)->toContain('Dritte Zeile direkt darunter.');
+});
+
 test('admin edit speichert subtitle, boilerplate_override und Kontakt', function () {
    /** @var TestCase $this */
    $admin = makeFieldsAdmin();
--- a/tests/Feature/Billing/ChangeCheckoutTest.php
+++ b/tests/Feature/Billing/ChangeCheckoutTest.php
@ -0,0 +1,195 @@
+<?php
+
+use App\Enums\LegalRequestStatus;
+use App\Enums\LegalRequestType;
+use App\Enums\LegalRequestVerificationMethod;
+use App\Enums\Portal;
+use App\Enums\SinglePurchaseStatus;
+use App\Enums\SinglePurchaseType;
+use App\Listeners\ProcessStripeWebhook;
+use App\Mail\PressReleaseChangeApplied;
+use App\Models\BillingAddress;
+use App\Models\BookingConfirmation;
+use App\Models\LegalRequest;
+use App\Models\PressRelease;
+use App\Models\SinglePurchase;
+use App\Models\User;
+use App\Services\Billing\StripeCheckoutService;
+use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Queue;
+use Laravel\Cashier\Checkout;
+use Laravel\Cashier\Events\WebhookReceived;
+use Tests\TestCase;
+
+beforeEach(function (): void {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+    config()->set('billing.change_price_cents', 1000);
+});
+
+function changeCustomer(): User
+{
+    $user = User::factory()->create(['is_active' => true, 'email_verified_at' => now()]);
+    $user->assignRole('customer');
+    BillingAddress::factory()->create(['user_id' => $user->id]);
+
+    // B2B-Gate: zeitnahe Unternehmer-Bestätigung (wie im Änderungs-Modal).
+    BookingConfirmation::query()->create([
+        'user_id' => $user->id,
+        'booking_type' => 'press_release_change',
+        'agb_version' => (string) config('legal.agb_version'),
+        'confirmed_at' => now(),
+    ]);
+
+    return $user;
+}
+
+function publishedChangeReleaseFor(User $user): PressRelease
+{
+    return PressRelease::factory()
+        ->published()
+        ->forPortal(Portal::Businessportal24)
+        ->create([
+            'user_id' => $user->id,
+            'published_at' => now()->subDay(),
+            'title' => 'Solaranlage in Hamburg eroeffnet und in Betrieb',
+        ]);
+}
+
+function approvedChangeRequestFor(PressRelease $release, User $user): LegalRequest
+{
+    return LegalRequest::query()->create([
+        'press_release_id' => $release->id,
+        'portal' => $release->portal?->value,
+        'type' => LegalRequestType::Change->value,
+        'status' => LegalRequestStatus::Open->value,
+        'requester_email' => (string) $user->email,
+        'message' => 'Kostenpflichtige Änderung (Spur D) über das Kunden-Panel eingereicht.',
+        'payload' => [
+            'source' => 'self_service',
+            'new_values' => ['title' => 'Solaranlage in Muenchen eroeffnet und in Vollbetrieb'],
+            'ki_check' => ['classification' => 'green', 'reasons' => []],
+        ],
+        'verified_at' => now(),
+        'verification_method' => LegalRequestVerificationMethod::LoggedIn->value,
+    ]);
+}
+
+test('the change checkout refuses without an approved precheck request', function () {
+    /** @var TestCase $this */
+    $user = changeCustomer();
+    $release = publishedChangeReleaseFor($user);
+
+    $this->actingAs($user)
+        ->get(route('me.checkout.change', $release->id))
+        ->assertRedirect(route('me.bookings.index'))
+        ->assertSessionHas('checkout-notice');
+
+    expect(SinglePurchase::count())->toBe(0);
+});
+
+test('a red-rejected precheck request does not unlock the checkout', function () {
+    /** @var TestCase $this */
+    $user = changeCustomer();
+    $release = publishedChangeReleaseFor($user);
+
+    $request = approvedChangeRequestFor($release, $user);
+    $request->forceFill([
+        'status' => LegalRequestStatus::Rejected->value,
+        'payload' => array_merge($request->payload, ['ki_check' => ['classification' => 'red', 'reasons' => ['Unzulässiges Wort.']]]),
+    ])->save();
+
+    $this->actingAs($user)
+        ->get(route('me.checkout.change', $release->id))
+        ->assertRedirect(route('me.bookings.index'))
+        ->assertSessionHas('checkout-notice');
+
+    expect(SinglePurchase::count())->toBe(0);
+});
+
+test('the change checkout creates a pending purchase, links the request and reuses pendings', function () {
+    /** @var TestCase $this */
+    $user = changeCustomer();
+    $release = publishedChangeReleaseFor($user);
+    $legalRequest = approvedChangeRequestFor($release, $user);
+
+    $checkout = Mockery::mock(Checkout::class);
+    $checkout->shouldReceive('toResponse')->andReturn(new RedirectResponse('https://checkout.stripe.com/c/pay/test'));
+    $this->mock(StripeCheckoutService::class, function ($mock) use ($checkout) {
+        // Zweimal: der zweite Aufruf verwendet den offenen Kauf wieder.
+        $mock->shouldReceive('forChange')->twice()->andReturn($checkout);
+    });
+
+    $this->actingAs($user)
+        ->get(route('me.checkout.change', $release->id))
+        ->assertRedirect('https://checkout.stripe.com/c/pay/test');
+
+    $purchase = SinglePurchase::sole();
+    expect($purchase->type)->toBe(SinglePurchaseType::Change);
+    expect($purchase->status)->toBe(SinglePurchaseStatus::Pending);
+    expect($purchase->price_cents)->toBe(1000);
+    expect($purchase->press_release_id)->toBe($release->id);
+    expect($legalRequest->fresh()->single_purchase_id)->toBe($purchase->id);
+
+    // Abgebrochener Checkout blockiert nicht: erneuter Aufruf nutzt den
+    // Pending-Kauf wieder statt einen zweiten anzulegen.
+    $this->actingAs($user)
+        ->get(route('me.checkout.change', $release->id))
+        ->assertRedirect('https://checkout.stripe.com/c/pay/test');
+
+    expect(SinglePurchase::count())->toBe(1);
+});
+
+test('the paid webhook applies the change immediately with snapshot, lock and consumed purchase', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+    Queue::fake();
+
+    $user = changeCustomer();
+    $release = publishedChangeReleaseFor($user);
+    $legalRequest = approvedChangeRequestFor($release, $user);
+
+    $purchase = SinglePurchase::query()->create([
+        'user_id' => $user->id,
+        'type' => SinglePurchaseType::Change->value,
+        'status' => SinglePurchaseStatus::Pending->value,
+        'price_cents' => 1000,
+        'currency' => 'EUR',
+        'press_release_id' => $release->id,
+    ]);
+    $legalRequest->forceFill(['single_purchase_id' => $purchase->id])->save();
+
+    $event = new WebhookReceived([
+        'type' => 'checkout.session.completed',
+        'data' => ['object' => [
+            'id' => 'cs_test_change',
+            'payment_intent' => 'pi_test_change',
+            'payment_status' => 'paid',
+            'metadata' => ['single_purchase_id' => (string) $purchase->id],
+        ]],
+    ]);
+
+    app(ProcessStripeWebhook::class)->handle($event);
+    app(ProcessStripeWebhook::class)->handle($event); // Replay bleibt folgenlos.
+
+    $release->refresh();
+    $legalRequest->refresh();
+
+    expect($release->title)->toBe('Solaranlage in Muenchen eroeffnet und in Vollbetrieb')
+        ->and($release->isSyncLocked())->toBeTrue()
+        ->and($legalRequest->status)->toBe(LegalRequestStatus::Resolved)
+        ->and($legalRequest->executed_at)->not->toBeNull()
+        ->and($legalRequest->redactionSnapshots()->count())->toBe(1)
+        ->and($legalRequest->redactionSnapshots()->first()->encrypted_before['fields']['title'])->toBe('Solaranlage in Hamburg eroeffnet und in Betrieb');
+
+    expect($purchase->fresh()->status)->toBe(SinglePurchaseStatus::Consumed);
+    expect($purchase->fresh()->consumed_at)->not->toBeNull();
+
+    // Der Käufer erhält genau eine Bestätigung (Replay löst keine zweite aus).
+    Mail::assertQueued(PressReleaseChangeApplied::class, function (PressReleaseChangeApplied $mail) use ($user, $release) {
+        return $mail->hasTo($user->email) && $mail->pressRelease->is($release) && $mail->isPaidChange;
+    });
+    Mail::assertQueuedCount(1);
+});
--- a/tests/Feature/Billing/DepublicationTest.php
+++ b/tests/Feature/Billing/DepublicationTest.php
@ -224,6 +224,9 @@ test('the paid webhook depublishes the release and the public page shows a tombs
    $release->refresh();
    expect($release->status)->toBe(PressReleaseStatus::Archived);
    expect($release->depublished_at)->not->toBeNull();
+    // Re-Sync-Sperre (Meldeverfahren §7): ohne sie würde der nächste
+    // Importer-Lauf die bezahlte Entfernung überschreiben.
+    expect($release->isSyncLocked())->toBeTrue();
    // Eingelöst = Status Consumed — nur so erscheint der Kauf unter
    // „Eingelöste Käufe" auf der Buchungs-Seite.
    expect($purchase->fresh()->status)->toBe(SinglePurchaseStatus::Consumed);
--- a/tests/Feature/Legal/AdminLegalRequestExecutionTest.php
+++ b/tests/Feature/Legal/AdminLegalRequestExecutionTest.php
@ -3,11 +3,13 @@
 use App\Enums\LegalRequestStatus;
 use App\Enums\LegalRequestType;
 use App\Enums\PressReleaseStatus;
+use App\Mail\LegalRequestExecuted;
 use App\Models\LegalRequest;
 use App\Models\PressRelease;
 use App\Models\User;
 use App\Services\PressRelease\AnonymizationService;
 use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Support\Facades\Mail;
 use Livewire\Volt\Volt;
 use Tests\TestCase;

@ -76,6 +78,60 @@ test('the panel prefills the replacement and shows the full content for copying
    expect($pressRelease->fresh()->title)->toBe('Matvey Teplitsky im Vorstand');
 });

+test('the editor is prefilled from a structured web redaction order', function () {
+    /** @var TestCase $this */
+    $this->actingAs(adminUserForLegalQueue());
+
+    $pressRelease = PressRelease::factory()->published()->create();
+    $request = LegalRequest::factory()
+        ->type(LegalRequestType::Dsgvo)
+        ->create([
+            'press_release_id' => $pressRelease->id,
+            'payload' => [
+                'source' => 'self_service',
+                'concern' => 'dsgvo',
+                'redaction' => [
+                    'terms' => ['Max Mustermann', 'Mustermanns'],
+                    'detach_contacts' => false,
+                    'remove_images_requested' => true,
+                    'preview_total_hits' => 3,
+                ],
+            ],
+        ]);
+
+    Volt::test('admin.legal-requests.show', ['id' => $request->id])
+        ->assertSet('redactionTerms', "Max Mustermann\nMustermanns")
+        ->assertSet('detachContacts', false)
+        ->assertSee('Strukturierter Schwärzungsauftrag')
+        ->assertSee('Entfernung von Bildern mit Personenbezug');
+});
+
+test('executing sends an execution confirmation to the requester', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+    $this->actingAs(adminUserForLegalQueue());
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'title' => 'Matvey Teplitsky im Vorstand',
+    ]);
+    $request = LegalRequest::factory()
+        ->type(LegalRequestType::Dsgvo)
+        ->create([
+            'press_release_id' => $pressRelease->id,
+            'requester_email' => 'presse@firma.example',
+        ]);
+
+    Volt::test('admin.legal-requests.show', ['id' => $request->id])
+        ->set('redactionTerms', 'Matvey Teplitsky')
+        ->call('previewAnonymization')
+        ->call('executeAnonymization')
+        ->assertHasNoErrors();
+
+    Mail::assertQueued(LegalRequestExecuted::class, function (LegalRequestExecuted $mail) {
+        return $mail->hasTo('presse@firma.example') && $mail->action === 'anonymized';
+    });
+});
+
 test('execute without a prior preview is refused', function () {
    /** @var TestCase $this */
    $this->actingAs(adminUserForLegalQueue());
--- a/tests/Feature/Legal/CorrectionServiceTest.php
+++ b/tests/Feature/Legal/CorrectionServiceTest.php
@ -4,9 +4,12 @@ use App\Enums\ActivityType;
 use App\Enums\LegalRequestStatus;
 use App\Enums\LegalRequestType;
 use App\Enums\LegalRequestVerificationMethod;
+use App\Enums\PressReleaseClassification;
 use App\Models\ActivityEvent;
 use App\Models\CreditTransaction;
+use App\Models\LegalRequest;
 use App\Models\PressRelease;
+use App\Services\PressRelease\BlacklistService;
 use App\Services\PressRelease\CorrectionRateLimitException;
 use App\Services\PressRelease\CorrectionService;
 use App\Services\PressRelease\CorrectionTooLargeException;
@ -54,6 +57,37 @@ test('markup-only changes count as no change', function () {
    expect($classification['has_changes'])->toBeFalse();
 });

+test('editor normalization of entities and line breaks counts as no change', function () {
+    /** @var TestCase $this */
+    $pressRelease = PressRelease::factory()->published()->create([
+        'text' => '<p>Preis &amp; Leistung&nbsp;stimmen.<br />Zeile zwei mit &quot;Zitat&quot;.</p>',
+    ]);
+
+    // So liefert der Rich-Text-Editor denselben Inhalt zurück: Entities
+    // dekodiert, <br> als eigener Absatz.
+    $classification = app(CorrectionService::class)->classify($pressRelease, [
+        'text' => "<p>Preis & Leistung\u{00A0}stimmen.</p><p>Zeile zwei mit \"Zitat\".</p>",
+    ]);
+
+    expect($classification['has_changes'])->toBeFalse();
+});
+
+test('one added letter in an entity-laden text stays near zero distance', function () {
+    /** @var TestCase $this */
+    $words = implode(' ', array_fill(0, 60, 'Wort&nbsp;und &amp; mehr'));
+    $pressRelease = PressRelease::factory()->published()->create([
+        'text' => '<p>'.$words.' Betrieb genomen.</p>',
+    ]);
+
+    $decoded = implode(' ', array_fill(0, 60, "Wort\u{00A0}und & mehr"));
+    $classification = app(CorrectionService::class)->classify($pressRelease, [
+        'text' => '<p>'.$decoded.' Betrieb genommen.</p>',
+    ]);
+
+    expect($classification['is_minor'])->toBeTrue()
+        ->and($classification['fields']['text']['distance_percent'])->toBeLessThan(1.0);
+});
+
 test('apply saves a minor correction immediately with snapshot, lock and log', function () {
    /** @var TestCase $this */
    Queue::fake();
@ -110,6 +144,84 @@ test('the weekly correction brake blocks the third correction', function () {
    $service->apply($pressRelease->refresh(), ['title' => 'Titel A4'], 'k@f.example', LegalRequestVerificationMethod::LoggedIn);
 })->throws(CorrectionRateLimitException::class);

+test('classify flags changes above the paid distance limit', function () {
+    /** @var TestCase $this */
+    $pressRelease = PressRelease::factory()->published()->create([
+        'title' => 'Kurzer Titel der Mitteilung',
+    ]);
+
+    $classification = app(CorrectionService::class)->classify($pressRelease, [
+        'title' => 'Ein voellig anderer, deutlich laengerer und inhaltlich komplett neuer Titel',
+    ]);
+
+    expect($classification['exceeds_paid_limit'])->toBeTrue()
+        ->and($classification['is_minor'])->toBeFalse();
+});
+
+test('applyPaid executes a paid change with snapshot, lock and resolved request', function () {
+    /** @var TestCase $this */
+    Queue::fake();
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'title' => 'Solaranlage in Hamburg eroeffnet und in Betrieb',
+    ]);
+
+    $legalRequest = LegalRequest::factory()
+        ->type(LegalRequestType::Change)
+        ->create([
+            'press_release_id' => $pressRelease->id,
+            'payload' => ['new_values' => ['title' => 'Solaranlage in Muenchen eroeffnet und in Vollbetrieb']],
+        ]);
+
+    $applied = app(CorrectionService::class)->applyPaid($pressRelease, $legalRequest);
+
+    $pressRelease->refresh();
+    $legalRequest->refresh();
+
+    expect($applied)->toBeTrue()
+        ->and($pressRelease->title)->toBe('Solaranlage in Muenchen eroeffnet und in Vollbetrieb')
+        ->and($pressRelease->isSyncLocked())->toBeTrue()
+        ->and($legalRequest->status)->toBe(LegalRequestStatus::Resolved)
+        ->and($legalRequest->executed_at)->not->toBeNull()
+        ->and($legalRequest->redactionSnapshots()->count())->toBe(1);
+});
+
+test('applyPaid refuses a change above the paid distance limit', function () {
+    /** @var TestCase $this */
+    $pressRelease = PressRelease::factory()->published()->create([
+        'title' => 'Kurzer Titel der Mitteilung',
+    ]);
+
+    $legalRequest = LegalRequest::factory()
+        ->type(LegalRequestType::Change)
+        ->create([
+            'press_release_id' => $pressRelease->id,
+            'payload' => ['new_values' => ['title' => 'Ein voellig anderer, deutlich laengerer und inhaltlich komplett neuer Titel']],
+        ]);
+
+    app(CorrectionService::class)->applyPaid($pressRelease, $legalRequest);
+})->throws(CorrectionTooLargeException::class);
+
+test('the precheck classifies the proposed content instead of the stored one', function () {
+    /** @var TestCase $this */
+    config()->set('scoring.classification.provider', 'deterministic');
+    config()->set('blacklist.words', ['skandalwort']);
+    app()->forgetInstance(BlacklistService::class);
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'title' => 'Harmloser Titel der Mitteilung',
+    ]);
+
+    $service = app(CorrectionService::class);
+
+    $red = $service->precheckProposedContent($pressRelease, ['title' => 'Titel mit Skandalwort darin']);
+    $green = $service->precheckProposedContent($pressRelease, ['title' => 'Harmlose neue Fassung des Titels']);
+
+    expect($red->classification)->toBe(PressReleaseClassification::Red)
+        ->and($green->classification)->toBe(PressReleaseClassification::Green)
+        ->and($pressRelease->fresh()->title)->toBe('Harmloser Titel der Mitteilung');
+});
+
 test('restoreSnapshot brings back the previous field values and keeps the lock', function () {
    /** @var TestCase $this */
    Queue::fake();
--- a/tests/Feature/Legal/CustomerCorrectionPanelTest.php
+++ b/tests/Feature/Legal/CustomerCorrectionPanelTest.php
@ -2,10 +2,13 @@

 use App\Enums\LegalRequestStatus;
 use App\Enums\LegalRequestType;
+use App\Mail\PressReleaseChangeApplied;
 use App\Models\LegalRequest;
 use App\Models\PressRelease;
 use App\Models\User;
+use App\Services\PressRelease\BlacklistService;
 use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Support\Facades\Mail;
 use Illuminate\Support\Facades\Queue;
 use Livewire\Volt\Volt;
 use Tests\TestCase;
@ -26,6 +29,7 @@ function correctionPanelOwner(): User
 test('an owner can apply a minor correction from the panel and it goes live instantly', function () {
    /** @var TestCase $this */
    Queue::fake();
+    Mail::fake();

    $owner = correctionPanelOwner();
    $this->actingAs($owner);
@ -48,9 +52,90 @@ test('an owner can apply a minor correction from the panel and it goes live inst
    expect($pressRelease->title)->toBe('Betrieb genommen')
        ->and($pressRelease->isSyncLocked())->toBeTrue()
        ->and(LegalRequest::query()->where('type', LegalRequestType::Correction->value)->count())->toBe(1);
+
+    // Bestätigungsmail an den Auftraggeber (abbestellbar über die Präferenzen).
+    Mail::assertQueued(PressReleaseChangeApplied::class, function (PressReleaseChangeApplied $mail) use ($owner) {
+        return $mail->hasTo($owner->email) && ! $mail->isPaidChange;
+    });
 });

-test('a major change from the panel becomes an open paid change request instead', function () {
+test('a major change passes the green precheck and unlocks the payment step', function () {
+    /** @var TestCase $this */
+    config()->set('scoring.classification.provider', 'deterministic');
+    config()->set('blacklist.words', []);
+    app()->forgetInstance(BlacklistService::class);
+
+    $owner = correctionPanelOwner();
+    $this->actingAs($owner);
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'user_id' => $owner->id,
+        'title' => 'Solaranlage in Hamburg eroeffnet und in Betrieb',
+    ]);
+
+    Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
+        ->call('startCorrection')
+        ->set('correctionValues.title', 'Solaranlage in Muenchen eroeffnet und in Vollbetrieb')
+        ->call('previewCorrection')
+        ->assertHasNoErrors()
+        ->call('openPaidChangeModal')
+        ->assertHasNoErrors()
+        ->call('runPaidChangePrecheck')
+        ->assertHasNoErrors()
+        ->assertSet('paidChangePrecheck.classification', 'green')
+        ->assertSee('Prüfung bestanden');
+
+    $request = LegalRequest::query()->where('type', LegalRequestType::Change->value)->sole();
+
+    expect($request->status)->toBe(LegalRequestStatus::Open)
+        ->and($request->payload['ki_check']['classification'])->toBe('green')
+        ->and($request->payload['new_values']['title'])->toContain('Muenchen')
+        ->and($request->executed_at)->toBeNull()
+        ->and($pressRelease->fresh()->title)->toBe('Solaranlage in Hamburg eroeffnet und in Betrieb');
+});
+
+test('a red precheck rejects the change before payment and the process is one-time', function () {
+    /** @var TestCase $this */
+    config()->set('scoring.classification.provider', 'deterministic');
+    config()->set('blacklist.words', ['skandalwort']);
+    app()->forgetInstance(BlacklistService::class);
+
+    $owner = correctionPanelOwner();
+    $this->actingAs($owner);
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'user_id' => $owner->id,
+        'title' => 'Solaranlage in Hamburg eroeffnet und in Betrieb',
+    ]);
+
+    Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
+        ->call('startCorrection')
+        ->set('correctionValues.title', 'Solaranlage in Hamburg eroeffnet mit Skandalwort dabei')
+        ->call('previewCorrection')
+        ->call('openPaidChangeModal')
+        ->assertHasNoErrors()
+        ->call('runPaidChangePrecheck')
+        ->assertSet('paidChangePrecheck.classification', 'red')
+        ->assertSee('Prüfung nicht bestanden');
+
+    $request = LegalRequest::query()->where('type', LegalRequestType::Change->value)->sole();
+
+    expect($request->status)->toBe(LegalRequestStatus::Rejected)
+        ->and($request->payload['ki_check']['classification'])->toBe('red')
+        ->and($pressRelease->fresh()->title)->toBe('Solaranlage in Hamburg eroeffnet und in Betrieb');
+
+    // Nur einmal möglich: nach der Ablehnung gibt es keinen zweiten Anlauf.
+    Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
+        ->call('startCorrection')
+        ->set('correctionValues.title', 'Solaranlage in Muenchen eroeffnet und in Vollbetrieb')
+        ->call('previewCorrection')
+        ->call('openPaidChangeModal')
+        ->assertHasErrors('correction');
+
+    expect(LegalRequest::query()->where('type', LegalRequestType::Change->value)->count())->toBe(1);
+});
+
+test('a change above the paid distance limit cannot be booked at all', function () {
    /** @var TestCase $this */
    $owner = correctionPanelOwner();
    $this->actingAs($owner);
@ -62,17 +147,68 @@ test('a major change from the panel becomes an open paid change request instead'

    Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
        ->call('startCorrection')
-        ->set('correctionValues.title', 'Ein komplett anderer, deutlich längerer und inhaltlich neuer Titel')
+        ->set('correctionValues.title', 'Ein voellig anderer, deutlich laengerer und inhaltlich komplett neuer Titel')
        ->call('previewCorrection')
-        ->assertHasNoErrors()
-        ->call('submitPaidChangeRequest')
+        ->assertSee('Zu umfangreich')
+        ->call('openPaidChangeModal')
+        ->assertHasErrors('correction');
+
+    expect(LegalRequest::query()->count())->toBe(0);
+});
+
+test('a legacy plain-text release is prefilled as paragraphs and counts as unchanged', function () {
+    /** @var TestCase $this */
+    $owner = correctionPanelOwner();
+    $this->actingAs($owner);
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'user_id' => $owner->id,
+        'text' => "Erster Absatz.\r\n\r\nZweiter Absatz mit Inhalt.",
+    ]);
+
+    $component = Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
+        ->call('startCorrection');
+
+    expect($component->get('correctionValues')['text'])->toContain('<p>Erster Absatz.</p>');
+
+    // Unverändert abschicken: die Plaintext→HTML-Wandlung darf nicht als
+    // inhaltliche Änderung zählen.
+    $component->call('previewCorrection')
+        ->assertHasErrors('correction');
+
+    expect($pressRelease->fresh()->text)->toContain("Erster Absatz.\r\n");
+});
+
+test('the panel names the weekly limit and the brake message states it too', function () {
+    /** @var TestCase $this */
+    Queue::fake();
+    config()->set('legal.corrections_per_week', 1);
+
+    $owner = correctionPanelOwner();
+    $this->actingAs($owner);
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'user_id' => $owner->id,
+        'title' => 'Titel B1',
+    ]);
+
+    $component = Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
+        ->assertSee('höchstens eine kostenlose Korrektur pro Woche')
+        ->call('startCorrection')
+        ->set('correctionValues.title', 'Titel B2')
+        ->call('previewCorrection')
+        ->call('applyCorrection')
        ->assertHasNoErrors();

-    $request = LegalRequest::query()->where('type', LegalRequestType::Change->value)->sole();
+    $component
+        ->call('startCorrection')
+        ->set('correctionValues.title', 'Titel B3')
+        ->call('previewCorrection')
+        ->call('applyCorrection')
+        ->assertHasErrors('correction')
+        ->assertSee('das Limit ist bereits erreicht');

-    expect($request->status)->toBe(LegalRequestStatus::Open)
-        ->and($request->payload['new_values']['title'])->toContain('komplett anderer')
-        ->and($pressRelease->fresh()->title)->toBe('Kurzer Titel der Mitteilung');
+    expect($pressRelease->fresh()->title)->toBe('Titel B2');
 });

 test('apply without preview is refused', function () {
--- a/tests/Feature/Legal/CustomerDsgvoPanelTest.php
+++ b/tests/Feature/Legal/CustomerDsgvoPanelTest.php
@ -0,0 +1,137 @@
+<?php
+
+use App\Enums\LegalRequestStatus;
+use App\Enums\LegalRequestType;
+use App\Enums\LegalRequestVerificationMethod;
+use App\Mail\LegalRequestReceived;
+use App\Mail\LegalRequestSubmitted;
+use App\Models\LegalRequest;
+use App\Models\PressRelease;
+use App\Models\User;
+use Database\Seeders\RolesAndPermissionsSeeder;
+use Illuminate\Support\Facades\Mail;
+use Livewire\Volt\Volt;
+use Tests\TestCase;
+
+beforeEach(function () {
+    /** @var TestCase $this */
+    $this->seed(RolesAndPermissionsSeeder::class);
+});
+
+function dsgvoPanelOwner(): User
+{
+    $owner = User::factory()->create(['is_active' => true]);
+    $owner->assignRole('customer');
+
+    return $owner;
+}
+
+test('the concerns modal offers all four tracks', function () {
+    /** @var TestCase $this */
+    $owner = dsgvoPanelOwner();
+    $this->actingAs($owner);
+
+    $pressRelease = PressRelease::factory()->published()->create(['user_id' => $owner->id]);
+
+    Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
+        ->assertSee('Was möchten Sie tun?')
+        ->assertSee('Kleine Korrektur')
+        ->assertSee('Inhaltliche Änderung')
+        ->assertSee('Entfernung persönlicher Daten (DSGVO)')
+        ->assertSee('Depublizierung');
+});
+
+test('the dsgvo preview validates input and never touches the release', function () {
+    /** @var TestCase $this */
+    $owner = dsgvoPanelOwner();
+    $this->actingAs($owner);
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'user_id' => $owner->id,
+        'title' => 'Max Mustermann übernimmt die Leitung',
+    ]);
+
+    $component = Volt::test('customer.press-releases.show', ['id' => $pressRelease->id]);
+
+    // Leeres Formular → Fehler.
+    $component->call('previewDsgvo')->assertHasErrors('dsgvo');
+
+    // Begriffe ohne Treffer → Fehler.
+    $component->set('dsgvoTerms', 'Kommtnichtvor')
+        ->call('previewDsgvo')
+        ->assertHasErrors('dsgvo');
+
+    // Treffer → Vorschau, PM unverändert.
+    $component->set('dsgvoTerms', 'Max Mustermann')
+        ->call('previewDsgvo')
+        ->assertHasNoErrors()
+        ->assertSee('[entfernt] übernimmt die Leitung');
+
+    expect($pressRelease->fresh()->title)->toBe('Max Mustermann übernimmt die Leitung')
+        ->and(LegalRequest::query()->count())->toBe(0);
+});
+
+test('the confirmed dsgvo submission creates a verified open request for the admin queue', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $owner = dsgvoPanelOwner();
+    $this->actingAs($owner);
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'user_id' => $owner->id,
+        'title' => 'Max Mustermann übernimmt die Leitung',
+    ]);
+
+    Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
+        ->set('dsgvoTerms', "Max Mustermann\nMustermanns")
+        ->set('dsgvoDetachContacts', true)
+        ->set('dsgvoMessage', 'Ich bin die betroffene Person und wünsche die Entfernung.')
+        ->call('submitDsgvo')
+        ->assertHasErrors('dsgvo') // ohne Vorschau keine Einreichung
+        ->call('previewDsgvo')
+        ->assertHasNoErrors()
+        ->call('submitDsgvo')
+        ->assertHasNoErrors();
+
+    $request = LegalRequest::query()->sole();
+
+    expect($request->type)->toBe(LegalRequestType::Dsgvo)
+        ->and($request->status)->toBe(LegalRequestStatus::Open)
+        ->and($request->verification_method)->toBe(LegalRequestVerificationMethod::LoggedIn)
+        ->and($request->requester_email)->toBe($owner->email)
+        ->and($request->payload['redaction']['terms'])->toBe(['Max Mustermann', 'Mustermanns'])
+        ->and($request->payload['redaction']['detach_contacts'])->toBeTrue()
+        ->and($request->executed_at)->toBeNull()
+        ->and($pressRelease->fresh()->title)->toBe('Max Mustermann übernimmt die Leitung');
+
+    Mail::assertQueued(LegalRequestReceived::class, fn (LegalRequestReceived $mail) => $mail->hasTo($owner->email));
+    Mail::assertQueued(LegalRequestSubmitted::class);
+});
+
+test('a second open dsgvo request for the same release is blocked', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $owner = dsgvoPanelOwner();
+    $this->actingAs($owner);
+
+    $pressRelease = PressRelease::factory()->published()->create([
+        'user_id' => $owner->id,
+        'title' => 'Max Mustermann übernimmt die Leitung',
+    ]);
+
+    LegalRequest::factory()->type(LegalRequestType::Dsgvo)->create([
+        'press_release_id' => $pressRelease->id,
+        'status' => LegalRequestStatus::Open,
+    ]);
+
+    Volt::test('customer.press-releases.show', ['id' => $pressRelease->id])
+        ->set('dsgvoTerms', 'Max Mustermann')
+        ->set('dsgvoMessage', 'Bitte meinen Namen entfernen, danke.')
+        ->call('previewDsgvo')
+        ->call('submitDsgvo')
+        ->assertHasErrors('dsgvo');
+
+    expect(LegalRequest::query()->count())->toBe(1);
+});
--- a/tests/Feature/Legal/PressReleaseReportFlowTest.php
+++ b/tests/Feature/Legal/PressReleaseReportFlowTest.php
@ -54,6 +54,27 @@ test('the intake sends a magic link to the stored press contact, never to a form
        ->and($link->payload['contact_email'])->toBe('presse@firma.example');
 });

+test('the intake falls back to the company contact when the release has none', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    // Legacy-Import-Fall: keine PM↔Kontakt-Verknüpfung, aber die Firma hat
+    // einen Pressekontakt — der zählt als verifizierbarer Kanal.
+    $pressRelease = PressRelease::factory()->published()->create();
+    Contact::factory()->create([
+        'company_id' => $pressRelease->company_id,
+        'email' => 'firmenkontakt@firma.example',
+    ]);
+
+    expect($pressRelease->contacts()->count())->toBe(0);
+
+    $this->post('/de/melden/pm', [
+        'reported_url' => detailUrlFor($pressRelease),
+    ])->assertRedirect();
+
+    Mail::assertQueued(PressReleaseReportLink::class, fn (PressReleaseReportLink $mail) => $mail->hasTo('firmenkontakt@firma.example'));
+});
+
 test('an unknown url is rejected with a validation error', function () {
    /** @var TestCase $this */
    Mail::fake();
@ -121,13 +142,13 @@ test('a verified visitor can submit a concern which lands verified in the queue'
    $this->get('/de/melden/pm/verifizieren/'.$link['plain_token']);

    $this->post('/de/melden/pm/anliegen', [
-        'concern' => 'dsgvo',
-        'message' => 'Bitte meinen Namen aus dem Pressekontakt entfernen.',
+        'concern' => 'correction',
+        'message' => 'Bitte den Tippfehler im Firmennamen korrigieren.',
    ])->assertSessionHas('pm-report-status');

    $request = LegalRequest::query()->sole();

-    expect($request->type)->toBe(LegalRequestType::Dsgvo)
+    expect($request->type)->toBe(LegalRequestType::Correction)
        ->and($request->press_release_id)->toBe($pressRelease->id)
        ->and($request->requester_email)->toBe('presse@firma.example')
        ->and($request->verified_at)->not->toBeNull()
@ -137,6 +158,76 @@ test('a verified visitor can submit a concern which lands verified in the queue'
    Mail::assertQueued(LegalRequestReceived::class, fn (LegalRequestReceived $mail) => $mail->hasTo('presse@firma.example'));
 });

+test('the dsgvo concern requires terms and enforces the mandatory preview', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $pressRelease = publishedReleaseWithContact();
+    $pressRelease->forceFill(['title' => 'Max Mustermann übernimmt die Leitung'])->save();
+    $link = app(MagicLinkGenerator::class)->createReportLink($pressRelease, 'presse@firma.example');
+    $this->get('/de/melden/pm/verifizieren/'.$link['plain_token']);
+
+    // Ohne Begriffe und ohne Entfernungs-Option → Fehler.
+    $this->post('/de/melden/pm/anliegen', [
+        'concern' => 'dsgvo',
+        'message' => 'Bitte meinen Namen entfernen, danke.',
+    ])->assertSessionHasErrors('redaction_terms');
+
+    // Begriffe ohne Treffer → Fehler mit Hinweis auf die Schreibweise.
+    $this->post('/de/melden/pm/anliegen', [
+        'concern' => 'dsgvo',
+        'message' => 'Bitte meinen Namen entfernen, danke.',
+        'redaction_terms' => 'Kommtnichtvor',
+    ])->assertSessionHasErrors('redaction_terms');
+
+    // Mit Treffern → Pflicht-Vorschau (kein Redirect), noch KEINE Anfrage.
+    $this->post('/de/melden/pm/anliegen', [
+        'concern' => 'dsgvo',
+        'message' => 'Bitte meinen Namen entfernen, danke.',
+        'redaction_terms' => 'Max Mustermann',
+    ])->assertOk()
+        ->assertSee('Vorschau: So sieht die Mitteilung nach der Schwärzung aus')
+        ->assertSee('[entfernt] übernimmt die Leitung')
+        ->assertSee('Verbindlich einreichen');
+
+    expect(LegalRequest::query()->count())->toBe(0)
+        ->and($pressRelease->fresh()->title)->toBe('Max Mustermann übernimmt die Leitung');
+});
+
+test('the confirmed dsgvo submission stores a structured redaction order without touching the release', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+
+    $pressRelease = publishedReleaseWithContact();
+    $pressRelease->forceFill(['title' => 'Max Mustermann übernimmt die Leitung'])->save();
+    $link = app(MagicLinkGenerator::class)->createReportLink($pressRelease, 'presse@firma.example');
+    $this->get('/de/melden/pm/verifizieren/'.$link['plain_token']);
+
+    $this->post('/de/melden/pm/anliegen', [
+        'concern' => 'dsgvo',
+        'message' => 'Bitte meinen Namen entfernen, danke.',
+        'redaction_terms' => "Max Mustermann\nMustermanns",
+        'detach_contacts' => '1',
+        'remove_images' => '1',
+        'confirmed' => '1',
+    ])->assertSessionHas('pm-report-status');
+
+    $request = LegalRequest::query()->sole();
+
+    expect($request->type)->toBe(LegalRequestType::Dsgvo)
+        ->and($request->status)->toBe(LegalRequestStatus::Open)
+        ->and($request->payload['redaction']['terms'])->toBe(['Max Mustermann', 'Mustermanns'])
+        ->and($request->payload['redaction']['detach_contacts'])->toBeTrue()
+        ->and($request->payload['redaction']['remove_images_requested'])->toBeTrue()
+        ->and($request->payload['redaction']['preview_total_hits'])->toBeGreaterThan(0)
+        ->and($request->executed_at)->toBeNull()
+        // Einreichung ≠ Ausführung: an der PM ändert sich nichts.
+        ->and($pressRelease->fresh()->title)->toBe('Max Mustermann übernimmt die Leitung')
+        ->and($pressRelease->fresh()->contacts()->count())->toBe(1);
+
+    Mail::assertQueued(LegalRequestReceived::class, fn (LegalRequestReceived $mail) => $mail->hasTo('presse@firma.example'));
+});
+
 test('a second open concern of the same type is blocked', function () {
    /** @var TestCase $this */
    Mail::fake();
--- a/tests/Feature/LegalRequestTest.php
+++ b/tests/Feature/LegalRequestTest.php
@ -49,6 +49,56 @@ test('the legal request form renders with per-type hints and hidden honeypots',
        ->assertSee('name="homepage"', false);
 });

+test('the triage offers the portal magic-link path', function () {
+    /** @var TestCase $this */
+    $release = publishedRelease();
+
+    $this->get(route('legal-request.create', ['slug' => $release->slug, 'type' => 'dsgvo']))
+        ->assertOk()
+        // Stufe 1: Anliegen-Karten inkl. Absender-Selbstservice.
+        ->assertSee('Korrektur, Änderung oder Depublizierung')
+        ->assertSee('Rechtswidrige Inhalte melden')
+        // Passwortloser Anmeldelink ins Portal (PMs werden im Konto zusammengeführt).
+        ->assertSee('Anmeldelink im Portal anfordern')
+        ->assertSee(rtrim(config('domains.domain_portal_url', config('app.url')), '/').'/anmeldelink', false)
+        // Fallback nur mit Identifizierungs-Hinweis.
+        ->assertSee('persönliche Identifizierung erforderlich')
+        // Vorauswahl aus dem Query-Parameter.
+        ->assertSee("concern: 'dsgvo'", false);
+});
+
+test('owner concerns preselect the self-service card', function () {
+    /** @var TestCase $this */
+    $release = publishedRelease();
+
+    $this->get(route('legal-request.create', ['slug' => $release->slug, 'type' => 'depublication']))
+        ->assertOk()
+        ->assertSee("concern: 'owner'", false);
+});
+
+test('owner track types are rejected by the public store endpoint', function () {
+    /** @var TestCase $this */
+    Mail::fake();
+    $release = publishedRelease();
+
+    $this->from(route('legal-request.create', ['slug' => $release->slug]))
+        ->post(route('legal-request.store', ['slug' => $release->slug]), [
+            'type' => 'correction',
+            'message' => 'Bitte den Titel dieser Mitteilung komplett austauschen.',
+        ])->assertSessionHasErrors('type');
+
+    expect(LegalRequest::query()->count())->toBe(0);
+});
+
+test('the report intake prefills the reported url from the query string', function () {
+    /** @var TestCase $this */
+    $detailUrl = 'https://presseecho.test/de/press-release/beispiel-pm';
+
+    $this->get(route('melden.pm', ['edition' => 'de', 'reported_url' => $detailUrl]))
+        ->assertOk()
+        ->assertSee('value="'.$detailUrl.'"', false);
+});
+
 test('the form 404s for a non-published release', function () {
    /** @var TestCase $this */
    $draft = PressRelease::factory()->forPortal(Portal::Businessportal24)->create();
--- a/tests/Feature/Web/ReleaseDetailTest.php
+++ b/tests/Feature/Web/ReleaseDetailTest.php
@ -80,6 +80,56 @@ test('businessportal24 release detail renders the editorial shell with real data
        ->assertSee(rtrim(config('domains.domain_portal_url'), '/').'/anmeldelink', false);
 });

+test('release detail falls back to the company contact when the release has none', function () {
+    /** @var TestCase $this */
+    [$category, $company] = detailCategoryAndCompany(Portal::Businessportal24);
+
+    // Legacy-Import-Fall: PM ohne eigene Kontakt-Verknüpfung — im Altsystem
+    // hingen Pressekontakte an der Firma.
+    $release = PressRelease::factory()
+        ->published()
+        ->forPortal(Portal::Businessportal24)
+        ->for($category)
+        ->for($company)
+        ->create(['published_at' => now()->subDay()]);
+
+    Contact::factory()->create([
+        'portal' => Portal::Businessportal24,
+        'company_id' => $company->id,
+        'first_name' => 'Jonas',
+        'last_name' => 'Feldkamp',
+        'email' => 'presse@muster-energie.de',
+    ]);
+
+    expect($release->contacts()->count())->toBe(0);
+
+    $this->get('https://businessportal24.test/de/press-release/'.$release->slug)
+        ->assertSuccessful()
+        ->assertSeeText('Pressekontakt')
+        ->assertSeeText('Jonas Feldkamp');
+
+    // Der Fallback ist reine Anzeige — es entsteht keine Pivot-Verknüpfung.
+    expect($release->contacts()->count())->toBe(0);
+});
+
+test('release detail shows company data as press contact when no contact record exists at all', function () {
+    /** @var TestCase $this */
+    [$category, $company] = detailCategoryAndCompany(Portal::Businessportal24);
+    $company->update(['email' => 'kontakt@muster-energie.de']);
+
+    $release = PressRelease::factory()
+        ->published()
+        ->forPortal(Portal::Businessportal24)
+        ->for($category)
+        ->for($company)
+        ->create(['published_at' => now()->subDay()]);
+
+    $this->get('https://businessportal24.test/de/press-release/'.$release->slug)
+        ->assertSuccessful()
+        ->assertSeeText('Pressekontakt')
+        ->assertSeeText('kontakt@muster-energie.de');
+});
+
 test('release detail without image embeds the headline in the generated hero', function () {
    /** @var TestCase $this */
    [$category, $company] = detailCategoryAndCompany(Portal::Businessportal24);