auth/mail: Magic-Link-2FA (M1) + Mailversand über die Queue
- Magic-Link-Login übergibt bei aktiviertem 2FA an die 2FA-Challenge, statt sie zu umgehen (M1). - Bestätigungs-/Benachrichtigungs-Mails (Kontakt, Recht, Kündigung, Widerruf, Magic-Link) laufen als ShouldQueue+afterCommit über die Queue, damit die Response nicht am SMTP-Roundtrip hängt. Hinweis: Der Queue-Worker muss im Betrieb laufen und überwacht werden, da fristrelevante Bestätigungen darüber zugestellt werden (siehe Betriebsüberwachung). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
parent
6764fb9bc2
commit
ea8d017445
20 changed files with 135 additions and 60 deletions
|
|
@ -22,7 +22,7 @@ test('requesting access for an unknown email creates nothing and sends no mail',
|
|||
|
||||
expect($sent)->toBeFalse();
|
||||
expect(User::query()->where('email', 'nobody@example.test')->exists())->toBeFalse();
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('requesting access for a known contact lazily creates a scoped account and sends a link', function () {
|
||||
|
|
@ -53,7 +53,7 @@ test('requesting access for a known contact lazily creates a scoped account and
|
|||
expect($user->accessibleCompanyIds())->toContain($company->id);
|
||||
expect($user->gdpr_consent_at)->not->toBeNull();
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
|
||||
Mail::assertQueued(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
|
||||
});
|
||||
|
||||
test('requesting access reuses an existing user without creating a duplicate', function () {
|
||||
|
|
@ -73,7 +73,7 @@ test('requesting access reuses an existing user without creating a duplicate', f
|
|||
|
||||
expect(User::query()->where('email', 'existing@example.test')->count())->toBe(1);
|
||||
expect($existing->fresh()->accessibleCompanyIds())->toContain($company->id);
|
||||
Mail::assertSent(MagicLoginLink::class);
|
||||
Mail::assertQueued(MagicLoginLink::class);
|
||||
});
|
||||
|
||||
test('the magic link form responds neutrally and triggers the service for a contact', function () {
|
||||
|
|
@ -92,7 +92,7 @@ test('the magic link form responds neutrally and triggers the service for a cont
|
|||
->assertHasNoErrors()
|
||||
->assertSet('email', '');
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class);
|
||||
Mail::assertQueued(MagicLoginLink::class);
|
||||
expect(User::query()->where('email', 'form@example.test')->exists())->toBeTrue();
|
||||
});
|
||||
|
||||
|
|
@ -109,7 +109,7 @@ test('the magic link form sends a link to an existing active user without a cont
|
|||
->assertHasNoErrors()
|
||||
->assertSet('email', '');
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
|
||||
Mail::assertQueued(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
|
||||
});
|
||||
|
||||
test('requestMagicAccess does nothing for an unknown email', function () {
|
||||
|
|
@ -120,7 +120,7 @@ test('requestMagicAccess does nothing for an unknown email', function () {
|
|||
|
||||
expect($sent)->toBeFalse();
|
||||
expect(User::query()->where('email', 'nobody@example.test')->exists())->toBeFalse();
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('requestMagicAccess does not send to an inactive existing user', function () {
|
||||
|
|
@ -132,7 +132,7 @@ test('requestMagicAccess does not send to an inactive existing user', function (
|
|||
$sent = app(ContactAccessService::class)->requestMagicAccess('off@example.test');
|
||||
|
||||
expect($sent)->toBeFalse();
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('a later-added company with the same email is linked on the next password login', function () {
|
||||
|
|
@ -213,7 +213,7 @@ test('a company email lazily creates an account scoped to that company', functio
|
|||
expect($user->name)->toBe('Firma AG');
|
||||
expect($user->accessibleCompanyIds())->toContain($company->id);
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
|
||||
Mail::assertQueued(MagicLoginLink::class, fn (MagicLoginLink $mail) => $mail->user->is($user));
|
||||
});
|
||||
|
||||
test('one account is created for an email stored across multiple companies and contacts', function () {
|
||||
|
|
@ -247,7 +247,7 @@ test('one account is created for an email stored across multiple companies and c
|
|||
expect($ids)->toContain($companyB->id);
|
||||
expect($ids)->toContain($companyC->id);
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, 1);
|
||||
Mail::assertQueued(MagicLoginLink::class, 1);
|
||||
});
|
||||
|
||||
test('requesting access does not mutate an existing inactive account', function () {
|
||||
|
|
@ -268,7 +268,7 @@ test('requesting access does not mutate an existing inactive account', function
|
|||
expect($sent)->toBeFalse();
|
||||
// Keine Firmenzuordnung an einem deaktivierten Bestands-Account.
|
||||
expect($existing->fresh()->accessibleCompanyIds())->not->toContain($company->id);
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
});
|
||||
|
||||
test('the honeypot blocks bots without creating an account', function () {
|
||||
|
|
@ -287,6 +287,6 @@ test('the honeypot blocks bots without creating an account', function () {
|
|||
->call('requestLink')
|
||||
->assertHasNoErrors();
|
||||
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
expect(User::query()->where('email', 'bot-target@example.test')->exists())->toBeFalse();
|
||||
});
|
||||
|
|
|
|||
|
|
@ -6,6 +6,7 @@ use App\Models\User;
|
|||
use Database\Seeders\RolesAndPermissionsSeeder;
|
||||
use Illuminate\Support\Facades\Mail;
|
||||
use Livewire\Volt\Volt as LivewireVolt;
|
||||
use PragmaRX\Google2FA\Google2FA;
|
||||
use Tests\TestCase;
|
||||
|
||||
test('user can request a magic login link from the magic-link page', function () {
|
||||
|
|
@ -17,7 +18,7 @@ test('user can request a magic login link from the magic-link page', function ()
|
|||
->call('requestLink')
|
||||
->assertHasNoErrors();
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, function (MagicLoginLink $mail) use ($user) {
|
||||
Mail::assertQueued(MagicLoginLink::class, function (MagicLoginLink $mail) use ($user) {
|
||||
return $mail->user->is($user) && str_contains($mail->loginUrl, '/magic-login/');
|
||||
});
|
||||
|
||||
|
|
@ -37,7 +38,7 @@ test('the magic link form validates its email field and clears on success', func
|
|||
->call('requestLink')
|
||||
->assertHasErrors(['email']);
|
||||
|
||||
Mail::assertNothingSent();
|
||||
Mail::assertNothingOutgoing();
|
||||
|
||||
// Gültige Eingabe → Feld wird geleert.
|
||||
LivewireVolt::test('auth.magic-link')
|
||||
|
|
@ -64,7 +65,7 @@ test('magic link requests are rate limited per email', function () {
|
|||
->call('requestLink')
|
||||
->assertHasErrors(['email']);
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, 3);
|
||||
Mail::assertQueued(MagicLoginLink::class, 3);
|
||||
});
|
||||
|
||||
test('admin can login with a valid magic link and lands on admin dashboard', function () {
|
||||
|
|
@ -80,7 +81,7 @@ test('admin can login with a valid magic link and lands on admin dashboard', fun
|
|||
|
||||
$sentMail = null;
|
||||
|
||||
Mail::assertSent(MagicLoginLink::class, function (MagicLoginLink $mail) use (&$sentMail) {
|
||||
Mail::assertQueued(MagicLoginLink::class, function (MagicLoginLink $mail) use (&$sentMail) {
|
||||
$sentMail = $mail;
|
||||
|
||||
return true;
|
||||
|
|
@ -111,7 +112,7 @@ test('customer is redirected to me dashboard after magic link login', function (
|
|||
->call('requestLink');
|
||||
|
||||
$sentMail = null;
|
||||
Mail::assertSent(MagicLoginLink::class, function (MagicLoginLink $mail) use (&$sentMail) {
|
||||
Mail::assertQueued(MagicLoginLink::class, function (MagicLoginLink $mail) use (&$sentMail) {
|
||||
$sentMail = $mail;
|
||||
|
||||
return true;
|
||||
|
|
@ -147,6 +148,36 @@ test('a stale intended admin url does not send a customer into the 403 admin are
|
|||
$this->assertAuthenticatedAs($customer);
|
||||
});
|
||||
|
||||
test('magic link login with two-factor enabled is handed to the challenge', function () {
|
||||
/**
|
||||
* Regression zu Befund M1 (Audit 14.07.2026): Magic-Link darf 2FA nicht
|
||||
* umgehen — bei aktivem 2FA wird wie beim Passwort-Login in die Challenge
|
||||
* übergeben, statt direkt einzuloggen.
|
||||
*/
|
||||
/** @var TestCase $this */
|
||||
$user = User::factory()->create(['is_active' => true]);
|
||||
$user->forceFill([
|
||||
'two_factor_secret' => encrypt(app(Google2FA::class)->generateSecretKey()),
|
||||
'two_factor_confirmed_at' => now(),
|
||||
])->save();
|
||||
|
||||
$plainToken = 'twofactor-token';
|
||||
MagicLink::query()->create([
|
||||
'user_id' => $user->id,
|
||||
'token_hash' => hash('sha256', $plainToken),
|
||||
'purpose' => 'login',
|
||||
'expires_at' => now()->addMinutes(5),
|
||||
]);
|
||||
|
||||
$this->get(route('magic-links.consume', ['token' => $plainToken]))
|
||||
->assertRedirect(route('two-factor.challenge'));
|
||||
|
||||
$this->assertGuest();
|
||||
expect(session('login.id'))->toBe($user->id);
|
||||
// Einmal-Nutzung bleibt erhalten: Link ist verbraucht.
|
||||
expect(MagicLink::query()->firstOrFail()->consumed_at)->not->toBeNull();
|
||||
});
|
||||
|
||||
test('expired magic link can not be used', function () {
|
||||
/** @var TestCase $this */
|
||||
$user = User::factory()->create(['is_active' => true]);
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue